# Copyright © 2017 Guillem Jover <guillem@debian.org>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.
package Dpkg::OpenPGP;
use strict;
use warnings;
use List::Util qw(none);
use Dpkg::Gettext;
use Dpkg::ErrorHandling;
use Dpkg::IPC;
use Dpkg::Path qw(find_command);
our $VERSION = '0.01';
my @BACKENDS = qw(
    sop
    sq
    gpg
);
my %BACKEND = (
    sop => 'SOP',
    sq => 'Sequoia',
    gpg => 'GnuPG',
);
sub new {
    my ($this, %opts) = @_;
    my $class = ref($this) || $this;
    my $self = {};
    bless $self, $class;
    my $backend = $opts{backend} // 'auto';
    my %backend_opts = (
        cmdv => $opts{cmdv} // 'auto',
        cmd => $opts{cmd} // 'auto',
    );
    if ($backend eq 'auto') {
        # Defaults for stateless full API auto-detection.
        $opts{needs}{api} //= 'full';
        $opts{needs}{keystore} //= 0;
        if (none { $opts{needs}{api} eq $_ } qw(full verify)) {
            error(g_('unknown OpenPGP api requested %s'), $opts{needs}{api});
        }
        $self->{backend} = $self->_auto_backend($opts{needs}, %backend_opts);
    } elsif (exists $BACKEND{$backend}) {
        $self->{backend} = $self->_load_backend($BACKEND{$backend}, %backend_opts);
        if (! $self->{backend}) {
            error(g_('cannot load OpenPGP backend %s'), $backend);
        }
    } else {
        error(g_('unknown OpenPGP backend %s'), $backend);
    }
    return $self;
}
sub _load_backend {
    my ($self, $backend, %opts) = @_;
    my $module = "Dpkg::OpenPGP::Backend::$backend";
    eval qq{
        pop \@INC if \$INC[-1] eq '.';
        require $module;
    };
    return if $@;
    return $module->new(%opts);
}
sub _auto_backend {
    my ($self, $needs, %opts) = @_;
    foreach my $backend (@BACKENDS) {
        my $module = $self->_load_backend($BACKEND{$backend}, %opts);
        if ($needs->{api} eq 'verify') {
            next if ! $module->has_verify_cmd();
        } else {
            next if ! $module->has_backend_cmd();
        }
        next if $needs->{keystore} && ! $module->has_keystore();
        return $module;
    }
    # Otherwise load a dummy backend.
    return Dpkg::OpenPGP::Backend->new();
}
sub can_use_secrets {
    my ($self, $key) = @_;
    return 0 unless $self->{backend}->has_backend_cmd();
    return 0 if $key->type eq 'keyfile' && ! -f $key->handle;
    return 0 if $key->type eq 'keystore' && ! -e $key->handle;
    return 0 unless $self->{backend}->can_use_key($key);
    return 1;
}
sub get_trusted_keyrings {
    my $self = shift;
    return $self->{backend}->get_trusted_keyrings();
}
sub armor {
    my ($self, $type, $in, $out) = @_;
    return $self->{backend}->armor($type, $in, $out);
}
sub dearmor {
    my ($self, $type, $in, $out) = @_;
    return $self->{backend}->dearmor($type, $in, $out);
}
sub inline_verify {
    my ($self, $inlinesigned, $data, @certs) = @_;
    return $self->{backend}->inline_verify($inlinesigned, $data, @certs);
}
sub verify {
    my ($self, $data, $sig, @certs) = @_;
    return $self->{backend}->verify($data, $sig, @certs);
}
sub inline_sign {
    my ($self, $data, $inlinesigned, $key) = @_;
    return $self->{backend}->inline_sign($data, $inlinesigned, $key);
}
1;