open Syntax
open Hash

let read_file fname = Bos.OS.File.read (Fpath.v fname) |> unwrap_err_msg

let write_file fname content =
  Bos.OS.File.write (Fpath.v fname) content |> unwrap_err_msg

let read_master_key_file filename =
  let* master_key = read_file filename in
  Crypto.EddsaPrivateKey.of_octets master_key

let base_url = Uri.of_string "http://localhost:3434/"
let full_url path = Uri.with_path base_url path |> Uri.to_string

let download ~output =
  let open Bos in
  let uri = full_url "/management/keys/" in
  OS.Cmd.run Cmd.(v "curl" % "-s" % "-o" % output % "-X" % "GET" % uri)
  |> unwrap_err_msg

let upload ~input ~url =
  let open Bos in
  let uri = full_url url in
  OS.Cmd.run
    Cmd.(
      v "curl"
      % "-i"
      % "-X"
      % "POST"
      % "-H"
      % "Content-Type: application/json"
      % "--data"
      % ("@" ^ input)
      % uri)
  |> unwrap_err_msg

let setup ~output =
  let () = Mirage_crypto_rng_unix.use_default () in
  let priv, pub = Mirage_crypto_ec.Ed25519.generate () in
  Fmt.pr "generated master public key:@\n%s@."
    (Mirage_crypto_ec.Ed25519.pub_to_octets pub |> B32.encode);
  let priv_data = Mirage_crypto_ec.Ed25519.priv_to_octets priv in
  write_file output priv_data

let sign ~master_key ~input ~output =
  let open Crypto in
  let* master_key = read_master_key_file master_key in
  let* input = read_file input in
  let master_pub = EddsaPrivateKey.pub_of_priv master_key in
  let* future_keys_response = Api.decode Api.FutureKeysResponse.jsont input in
  let* () =
    Offline_sig.verify_future_keys_response master_pub future_keys_response
  in
  let master_signatures =
    Offline_sig.mk_future_keys ~master_key future_keys_response
  in
  let* s = Api.encode Api.MasterSignatures.jsont master_signatures in
  let* () = write_file output s in
  Ok ()

let revoke_denom ~output ~master_key ~h_denom =
  let* key = read_master_key_file master_key in
  let* h_denom_pub = DenominationHash.of_b32 h_denom in
  let denom_revoke =
    let master_sig =
      let open Signatures.MasterDenominationKeyRevocation in
      sign_f ~f:(Crypto.EddsaSignature.sign ~key) { h_denom_pub }
    in
    Api.DenomRevocationSignature.{ master_sig }
  in
  let* s = Api.encode Api.DenomRevocationSignature.jsont denom_revoke in
  let* () = write_file output s in
  Ok ()

let revoke_signkey ~output ~master_key ~signkey =
  let* key = read_master_key_file master_key in
  let signkey_revoke =
    let master_sig =
      let open Signatures.MasterSigningKeyRevocation in
      sign_f ~f:(Crypto.EddsaSignature.sign ~key) { exchange_pub= signkey }
    in
    Api.SignkeyRevocationSignature.{ master_sig }
  in
  let* s = Api.encode Api.SignkeyRevocationSignature.jsont signkey_revoke in
  let* () = write_file output s in
  Ok ()

let global_fees ~output ~master_key ~start_date ~end_date ~history_fee
    ~account_fee ~purse_fee ~history_expiration ~purse_account_limit
    ~purse_timeout =
  let open Crypto in
  let* key = read_master_key_file master_key in
  let* purse_account_limit =
    match
      purse_account_limit >= 0
      && purse_account_limit <= Int32.to_int Int32.max_int
    with
    | false -> Error "invalid purse_account_limit value"
    | true -> Ok (Int32.of_int purse_account_limit)
  in
  let master_sig =
    let open Signatures.GlobalFees in
    sign_f ~f:(EddsaSignature.sign ~key)
      {
        start_date;
        end_date;
        purse_timeout;
        history_expiration;
        history_fee;
        account_fee;
        purse_fee;
        purse_account_limit;
      }
  in
  let global_fees =
    Api.GlobalFees.
      {
        start_date;
        end_date;
        purse_timeout;
        history_expiration;
        history_fee;
        account_fee;
        purse_fee;
        purse_account_limit;
        master_sig;
      }
  in
  let* s = Api.encode Api.GlobalFees.jsont global_fees in
  let* () = write_file output s in
  Ok ()

let enable_auditor ~output ~master_key ~auditor_url ~auditor_name ~auditor_pub
    ~validity_start =
  let open Crypto in
  let* key = read_master_key_file master_key in
  let master_sig =
    let open Signatures.MasterAddAuditor in
    sign_f ~f:(EddsaSignature.sign ~key)
      {
        start_date= validity_start;
        auditor_pub;
        h_auditor_url= Hash.Cstring.H64.hash auditor_url;
      }
  in
  let v =
    Api.AuditorSetupMessage.
      { auditor_url; auditor_name; auditor_pub; master_sig; validity_start }
  in
  let* s = Api.encode Api.AuditorSetupMessage.jsont v in
  let* () = write_file output s in
  Ok ()

let disable_auditor ~output ~master_key ~auditor_pub ~validity_end =
  let open Crypto in
  let* key = read_master_key_file master_key in
  let master_sig =
    let open Signatures.MasterDelAuditor in
    sign_f ~f:(EddsaSignature.sign ~key) { end_date= validity_end; auditor_pub }
  in
  let v = Api.AuditorTeardownMessage.{ master_sig; validity_end } in
  let* s = Api.encode Api.AuditorTeardownMessage.jsont v in
  let* () = write_file output s in
  Ok ()

let wire_fee ~output ~master_key ~wire_method ~fee_start ~fee_end ~closing_fee
    ~wire_fee =
  let open Crypto in
  let* key = read_master_key_file master_key in
  let master_sig_wire =
    let open Signatures.MasterWireFee in
    sign_f ~f:(EddsaSignature.sign ~key)
      {
        h_wire_method= Hash.Cstring.H64.hash wire_method;
        start_date= fee_start;
        end_date= fee_end;
        closing_fee;
        wire_fee;
      }
  in
  let v =
    Api.WireFeeSetupMessage.
      {
        wire_method;
        fee_start;
        fee_end;
        closing_fee;
        wire_fee;
        master_sig_wire;
      }
  in
  let* s = Api.encode Api.WireFeeSetupMessage.jsont v in
  let* () = write_file output s in
  Ok ()

let drain ~output ~master_key ~debit_account_section ~credit_payto_uri ~wtid
    ~date ~amount =
  let open Crypto in
  let* key = read_master_key_file master_key in
  let master_sig =
    let open Signatures.MasterDrainProfit in
    sign_f ~f:(EddsaSignature.sign ~key)
      {
        wtid;
        date;
        amount;
        h_section= Hash.Cstring.H64.hash debit_account_section;
        h_payto= FullPaytoHash.hash credit_payto_uri;
      }
  in
  let v =
    Api.DrainProfitsMessage.
      {
        debit_account_section;
        credit_payto_uri;
        wtid;
        master_sig;
        date;
        amount;
      }
  in
  let* s = Api.encode Api.DrainProfitsMessage.jsont v in
  let* () = write_file output s in
  Ok ()