/*
    * capabilities.h
    * Shared reader for the capability grant table (0:/config/capabilities.toml)
    * Copyright (c) 2026 Daniel Hammer
*/

#pragma once
#include <montauk/syscall.h>
#include <montauk/toml.h>
#include <montauk/config.h>
#include <montauk/heap.h>

namespace montauk {
namespace caps {

    inline constexpr const char* GRANT_CONFIG = "capabilities";
    inline constexpr const char* GRANT_PREFIX = "grant.";

    struct CapName {
        const char* name;
        uint64_t    bit;
    };

    // Names as they appear in the config file.  Kept in the same order as the
    // CAP_* bit definitions in Api/Syscall.hpp.
    inline constexpr CapName NAMES[] = {
        {"process_admin", montauk::abi::CAP_PROCESS_ADMIN},
        {"power_request", montauk::abi::CAP_POWER_REQUEST},
        {"power_control", montauk::abi::CAP_POWER_CONTROL},
        {"suspend",       montauk::abi::CAP_SUSPEND},
        {"storage_admin", montauk::abi::CAP_STORAGE_ADMIN},
        {"raw_storage",   montauk::abi::CAP_RAW_STORAGE},
        {"network_admin", montauk::abi::CAP_NETWORK_ADMIN},
        {"set_time",      montauk::abi::CAP_SET_TIME},
        {"user_admin",    montauk::abi::CAP_USER_ADMIN},
        {"display_admin", montauk::abi::CAP_DISPLAY_ADMIN},
        {"device_admin",  montauk::abi::CAP_DEVICE_ADMIN},
        {"log_read",      montauk::abi::CAP_LOG_READ},
        {"system_image",  montauk::abi::CAP_SYSTEM_IMAGE},
        {"compositor",    montauk::abi::CAP_COMPOSITOR},
        {"brightness",    montauk::abi::CAP_BRIGHTNESS},
    };

    // Never implied by "all": each must be named explicitly in a grant.
    inline constexpr uint64_t EXPLICIT_ONLY =
        montauk::abi::CAP_SYSTEM_IMAGE | montauk::abi::CAP_COMPOSITOR;

    inline uint64_t bit_for_name(const char* name) {
        if (name == nullptr || name[0] == '\0') return 0;
        // "all" means "everything this launcher may pass on".
        if (montauk::streq(name, "all"))
            return montauk::abi::CAP_ALL & ~EXPLICIT_ONLY;
        for (const auto& entry : NAMES) {
            if (montauk::streq(entry.name, name)) return entry.bit;
        }

        return 0;
    }

    // True when a grant for `path` can apply: the program is installed under
    // 0:/os or 0:/apps, which cannot be rewritten without system_image. The
    // kernel enforces this (Fs::IsSystemImage) by starting any other program
    // without capabilities; this copy of the rule is only for display.
    inline bool is_installed_path(const char* path) {
        if (path == nullptr) return false;
        const char* p = path;
        uint64_t drive = 0;
        if (*p < '0' || *p > '9') return false;
        while (*p >= '0' && *p <= '9') drive = drive * 10 + (uint64_t)(*p++ - '0');
        if (*p != ':' || drive != 0) return false;
        p++;
        static const char* const roots[] = {"/os", "/apps"};
        for (const char* root : roots) {
            int i = 0;
            while (root[i]) {
                char c = p[i];
                if (c >= 'A' && c <= 'Z') c = (char)(c + ('a' - 'A'));
                if (c != root[i]) break;
                i++;
            }
            if (root[i] == '\0' && (p[i] == '\0' || p[i] == '/')) return true;
        }
        return false;
    }

    // Read an array-of-strings key into a capability mask.
    inline uint64_t mask_from_key(const montauk::toml::Doc& doc, const char* key) {
        montauk::toml::Value* arr = doc.get_array(key);
        if (arr == nullptr) return 0;

        uint64_t mask = 0;
        for (int i = 0; i < arr->array.count; i++) {
            montauk::toml::Value* item = arr->array.items[i];
            if (item == nullptr || item->type != montauk::toml::Type::String) continue;
            mask |= bit_for_name(item->str);
        }
        return mask;
    }

    // Append `suffix` to the "grant.<id>." stem of `path_key`.
    // Returns false if the key is not of that shape or does not fit.
    inline bool build_sibling_key(const char* path_key, const char* suffix,
                                  char* out, int outSz) {
        int prefixLen = 0;
        for (; GRANT_PREFIX[prefixLen]; prefixLen++) {
            if (path_key[prefixLen] != GRANT_PREFIX[prefixLen]) return false;
        }

        // Copy through the final '.' so "grant.foo.path" yields "grant.foo.".
        int lastDot = -1;
        for (int i = 0; path_key[i]; i++) {
            if (path_key[i] == '.') lastDot = i;
        }
        if (lastDot < prefixLen) return false;

        int n = 0;
        for (; n <= lastDot && n < outSz - 1; n++) out[n] = path_key[n];
        for (int i = 0; suffix[i] && n < outSz - 1; i++) out[n++] = suffix[i];
        out[n] = '\0';
        return true;
    }

    // Look up the grant declared for `binary_path`.  Returns false when the
    // path has no entry, which is the common case and means "no authority".
    inline bool lookup(const char* binary_path,
                       montauk::abi::SpawnCapabilities& out) {
        out = {0, 0};
        if (binary_path == nullptr || binary_path[0] == '\0') return false;

        montauk::toml::Doc doc = montauk::config::load(GRANT_CONFIG);

        bool found = false;
        for (int i = 0; i < doc.entries.count && !found; i++) {
            montauk::toml::Value* entry = doc.entries.items[i];
            if (entry == nullptr || entry->key == nullptr) continue;
            if (entry->type != montauk::toml::Type::String) continue;

            char sibling[128];
            if (!build_sibling_key(entry->key, "path", sibling, sizeof(sibling))) continue;
            if (!montauk::streq(sibling, entry->key)) continue;
            if (!montauk::streq(entry->str, binary_path)) continue;

            build_sibling_key(entry->key, "effective", sibling, sizeof(sibling));
            uint64_t effective = mask_from_key(doc, sibling);
            build_sibling_key(entry->key, "delegable", sibling, sizeof(sibling));
            uint64_t delegable = mask_from_key(doc, sibling);

            out.effective = effective;
            out.delegable = delegable;
            found = true;
        }

        doc.destroy();
        return found;
    }

    // The calling process's own capability masks.
    inline bool self(montauk::abi::SpawnCapabilities& out) {
        out = {0, 0};
        return montauk::getcaps(&out) == 0;
    }

    inline uint64_t self_delegable() {
        montauk::abi::SpawnCapabilities mine;
        return self(mine) ? mine.delegable : 0;
    }

    // Build a spawn request for `binary_path`, clamped to what the caller may
    // actually delegate.
    inline montauk::abi::SpawnCapabilities for_binary(const char* binary_path,
                                                      uint64_t caller_delegable) {
        montauk::abi::SpawnCapabilities caps{0, 0};

        if (caller_delegable == 0) return caps;

        if (!lookup(binary_path, caps)) return caps;

        caps.effective &= caller_delegable;
        caps.delegable &= caller_delegable;
        return caps;
    }

    // The calling process's delegable set, cached.
    inline uint64_t my_delegable() {
        static uint64_t cached = 0;
        static bool     loaded = false;
        if (!loaded) {
            cached = self_delegable();
            loaded = true;
        }
        return cached;
    }

    struct LaunchOptions {
        const char* args = nullptr;
        // Owner identity for the child.  Requires CAP_USER_ADMIN and is
        // reserved for session creators (init, login);
        const char* user = nullptr;
        // True for a console host that reads and writes the child's I/O
        // through the childio calls rather than sharing its own.
        bool redirected = false;
    };

    // Unified launch helper.
    inline int launch(const char* path, const LaunchOptions& opt = {}) {
        if (path == nullptr || path[0] == '\0') return -1;

        if (opt.redirected && opt.user != nullptr) return -1;

        montauk::abi::SpawnCapabilities caps = for_binary(path, my_delegable());
        return opt.redirected
            ? spawn_redir_with_caps(path, opt.args, caps)
            : spawn_with_caps(path, opt.args, opt.user, caps);
    }

} // namespace caps
} // namespace montauk