// Copyright (C) 2026 Dcntrlized
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published
// by the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <https://www.gnu.org/licenses/>.

// Package devboot provisions the dev fleet the DCNTRLIZED_DEV way: Maestro
// issues the identities its docker-compose.dev/debug.yaml peers bind-mount at
// /dcntrlized/pki. There is no approval shortcut — a satellite's first mTLS
// contact records a pending authorization and is refused (403) until the owner
// approves it via /api/peers, exactly the real trust-store flow.
package devboot

import (
	"git.dcntrlized.org/Dcntrlized/Maestro/lib/containers"
	"git.dcntrlized.org/Dcntrlized/Maestro/lib/logger"
	"git.dcntrlized.org/Dcntrlized/Maestro/lib/pki"
)

// Infra are the shared services whose identities the dev composes mount. They
// are peers/attesters themselves, not approval candidates (auth is the
// trust-store owner, Maestro uses the internal RequireMaestro endpoints).
var Infra = []string{"dcntrlized-auth"}

// Fleet lists the dev-mode satellite identities Maestro issues. Their CNs must
// match the service names used in the dev composes' pki mounts.
var Fleet = []string{"keepnote", "calendar", "testservice"}

// EnsureIdentities provisions the instance CA identities the dev composes
// bind-mount at /dcntrlized/pki, so compose-managed services come up with a
// valid mTLS identity before they ever dial the auth service. Run before the
// shared infrastructure is ensured, because dcntrlized-auth's mTLS listener
// refuses to start without its identity.
func EnsureIdentities() {
	dataRoot, err := containers.DataRoot()
	if err != nil {
		logger.Warn("devboot: resolve data root: %v", err)
		return
	}
	ca, err := pki.EnsureCA(dataRoot)
	if err != nil {
		logger.Warn("devboot: ensure instance CA: %v", err)
		return
	}
	for _, name := range append(append([]string{}, Infra...), Fleet...) {
		if _, err := pki.EnsureServiceIdentity(ca, name); err != nil {
			logger.Warn("devboot: ensure identity for %s: %v", name, err)
		}
	}
	logger.Info("devboot: ensured dev fleet identities (%d infra + %d satellites)", len(Infra), len(Fleet))
}