//! Decentralized app marketplace: discover, verify, and publish app manifests
//! via Nostr relays. Uses NIP-78 (kind 30078) with d-tag "archipelago-app:<id>".
//!
//! See docs/marketplace-protocol.md for the full protocol specification.

use anyhow::{Context, Result};
use serde::{Deserialize, Serialize};
use std::collections::HashMap;
use std::path::Path;
use std::time::Duration;
use tokio::fs;
use tracing::{debug, info, warn};

const MARKETPLACE_DIR: &str = "marketplace";
const CACHE_FILE: &str = "manifests.json";
const PUBLISHED_DIR: &str = "published";
const ARCHIPELAGO_KIND: u64 = 30078;
const D_TAG_PREFIX: &str = "archipelago-app:";
const MARKETPLACE_TAG: &str = "archipelago-marketplace";

/// Categories for marketplace apps.
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
#[serde(rename_all = "lowercase")]
pub enum AppCategory {
    Money,
    Commerce,
    Data,
    Networking,
    Home,
    Community,
    Other,
}

impl std::fmt::Display for AppCategory {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::Money => write!(f, "money"),
            Self::Commerce => write!(f, "commerce"),
            Self::Data => write!(f, "data"),
            Self::Networking => write!(f, "networking"),
            Self::Home => write!(f, "home"),
            Self::Community => write!(f, "community"),
            Self::Other => write!(f, "other"),
        }
    }
}

/// Author information in a marketplace manifest.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ManifestAuthor {
    pub name: String,
    pub did: String,
    #[serde(default)]
    pub nostr_pubkey: String,
}

/// Container configuration in a marketplace manifest.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ManifestContainer {
    pub image: String,
    #[serde(default)]
    pub ports: Vec<PortMapping>,
    #[serde(default)]
    pub volumes: Vec<VolumeMapping>,
    #[serde(default)]
    pub env: HashMap<String, String>,
    #[serde(default)]
    pub capabilities: Vec<String>,
    #[serde(default = "default_true")]
    pub readonly_root: bool,
    #[serde(default = "default_true")]
    pub no_new_privileges: bool,
    #[serde(default = "default_uid")]
    pub run_as_user: u32,
}

fn default_true() -> bool {
    true
}

fn default_uid() -> u32 {
    1000
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PortMapping {
    pub container: u16,
    pub host: u16,
    #[serde(default = "default_tcp")]
    pub protocol: String,
}

fn default_tcp() -> String {
    "tcp".into()
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct VolumeMapping {
    pub name: String,
    pub path: String,
}

/// App manifest signatures.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ManifestSignatures {
    pub manifest_hash: String,
    pub did_signature: String,
}

/// A marketplace app manifest.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AppManifest {
    pub app_id: String,
    pub name: String,
    pub version: String,
    pub description: ManifestDescription,
    pub author: ManifestAuthor,
    pub container: ManifestContainer,
    pub category: AppCategory,
    #[serde(default)]
    pub icon_url: String,
    #[serde(default)]
    pub repo_url: String,
    #[serde(default)]
    pub license: String,
    #[serde(default)]
    pub min_archipelago_version: String,
    #[serde(default)]
    pub dependencies: Vec<String>,
    #[serde(default)]
    pub signatures: Option<ManifestSignatures>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(untagged)]
pub enum ManifestDescription {
    Simple(String),
    Detailed { short: String, long: String },
}

impl ManifestDescription {
    /// Return the short description regardless of variant.
    #[allow(dead_code)]
    pub fn short(&self) -> &str {
        match self {
            Self::Simple(s) => s,
            Self::Detailed { short, .. } => short,
        }
    }
}

/// A discovered marketplace app with trust scoring.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DiscoveredApp {
    pub manifest: AppManifest,
    pub trust_score: u32,
    pub trust_tier: String,
    pub relay_count: u32,
    pub first_seen: String,
    pub nostr_pubkey: String,
    /// Outcome of checking the manifest's DID signature. `#[serde(default)]`
    /// so a cache written before this field existed still loads (as `missing`,
    /// which is the honest answer for an entry we never verified).
    #[serde(default)]
    pub signature: SignatureStatus,
}

// ─── DID signature layer ────────────────────────────────────────────────
//
// A marketplace manifest travels inside a Nostr event, so it already carries a
// NIP-01 Schnorr signature proving *the publishing relay key* sent it. That
// says nothing about the `author.did` the manifest claims. This layer closes
// that gap: the author signs a digest of their own manifest with the Ed25519
// key their did:key encodes, and every consumer re-derives the digest and
// checks it.
//
// Until this existed, `signatures.manifest_hash` / `signatures.did_signature`
// were struct fields nothing read, and the trust score awarded 30 points for
// `did.starts_with("did:")` — i.e. for typing a string.

/// Outcome of checking a manifest's `signatures` block.
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(tag = "status", rename_all = "lowercase")]
pub enum SignatureStatus {
    /// `manifest_hash` matches the content and `did_signature` verifies against
    /// the key in `author.did`.
    Valid,
    /// No `signatures` block. Not an attack — an unsigned publisher — but it
    /// earns none of the identity-derived trust.
    #[default]
    Missing,
    /// A `signatures` block is present and wrong: corrupt, tampered with, or
    /// signed by a key other than the one `author.did` names.
    Invalid { reason: String },
}

impl SignatureStatus {
    pub fn is_valid(&self) -> bool {
        matches!(self, Self::Valid)
    }
}

/// Recursively rebuild a JSON value with every object's keys in lexicographic
/// order, so the signed preimage is byte-stable.
///
/// This is not belt-and-braces. `ManifestContainer::env` is a `HashMap`, whose
/// iteration order is randomised per process; and `serde_json::Map` is only a
/// sorted `BTreeMap` while the `preserve_order` feature is off — a feature any
/// crate anywhere in the dependency graph can turn on for everyone through
/// Cargo feature unification. Either way the digest would start changing
/// between runs and every signature would break. Sorting here makes the
/// preimage independent of both.
fn canonicalize(value: serde_json::Value) -> serde_json::Value {
    match value {
        serde_json::Value::Object(map) => {
            let mut pairs: Vec<(String, serde_json::Value)> = map.into_iter().collect();
            pairs.sort_by(|a, b| a.0.cmp(&b.0));
            let mut out = serde_json::Map::new();
            for (k, v) in pairs {
                out.insert(k, canonicalize(v));
            }
            serde_json::Value::Object(out)
        }
        serde_json::Value::Array(items) => {
            serde_json::Value::Array(items.into_iter().map(canonicalize).collect())
        }
        other => other,
    }
}

/// The exact bytes a manifest signature covers: the manifest as canonical JSON
/// (sorted keys, no whitespace) with the `signatures` block itself omitted —
/// a signature cannot cover the field that holds it.
pub fn canonical_signing_bytes(manifest: &AppManifest) -> Result<Vec<u8>> {
    let mut unsigned = manifest.clone();
    unsigned.signatures = None;
    let value = serde_json::to_value(&unsigned).context("Serializing manifest for signing")?;
    serde_json::to_vec(&canonicalize(value)).context("Encoding canonical manifest JSON")
}

/// SHA-256 over [`canonical_signing_bytes`]. This digest is what gets signed,
/// and what `signatures.manifest_hash` records as `sha256:<hex>`.
pub fn manifest_digest(manifest: &AppManifest) -> Result<[u8; 32]> {
    use sha2::{Digest, Sha256};
    Ok(Sha256::digest(canonical_signing_bytes(manifest)?).into())
}

/// Sign `manifest` in place with an Ed25519 key, filling in `signatures`.
///
/// The caller must ensure `author.did` is the did:key for `signing_key` —
/// [`publish`] enforces that. Signing with a mismatched key produces a manifest
/// that every verifier rejects.
pub fn sign_manifest(
    manifest: &mut AppManifest,
    signing_key: &ed25519_dalek::SigningKey,
) -> Result<()> {
    use ed25519_dalek::Signer;
    // Clear first so a re-sign never covers a previous signature.
    manifest.signatures = None;
    let digest = manifest_digest(manifest)?;
    let signature = signing_key.sign(&digest);
    manifest.signatures = Some(ManifestSignatures {
        manifest_hash: format!("sha256:{}", hex::encode(digest)),
        did_signature: base64::Engine::encode(
            &base64::engine::general_purpose::STANDARD,
            signature.to_bytes(),
        ),
    });
    Ok(())
}

/// Verify a manifest's `signatures` block against its own content and the
/// Ed25519 key encoded in `author.did`.
///
/// Never returns an error: a manifest arriving off a public relay is untrusted
/// input, and every way it can be wrong is a verdict rather than an exception.
pub fn verify_manifest_signature(manifest: &AppManifest) -> SignatureStatus {
    use ed25519_dalek::Verifier;

    let invalid = |reason: &str| SignatureStatus::Invalid {
        reason: reason.to_string(),
    };

    let sigs = match &manifest.signatures {
        Some(s) => s,
        None => return SignatureStatus::Missing,
    };

    let digest = match manifest_digest(manifest) {
        Ok(d) => d,
        Err(_) => return invalid("manifest could not be canonicalized"),
    };

    // 1. Content integrity: does the recorded hash describe this manifest?
    let claimed_hex = match sigs.manifest_hash.strip_prefix("sha256:") {
        Some(h) => h,
        None => return invalid("manifest_hash is not in sha256:<hex> form"),
    };
    match hex::decode(claimed_hex) {
        Ok(claimed) if claimed == digest => {}
        Ok(_) => return invalid("manifest_hash does not match the manifest content"),
        Err(_) => return invalid("manifest_hash is not valid hex"),
    }

    // 2. Identity: resolve the DID to a key.
    let pubkey_bytes = match crate::identity::pubkey_bytes_from_did_key(&manifest.author.did) {
        Ok(p) => p,
        Err(e) => {
            return SignatureStatus::Invalid {
                reason: format!("author.did is not a resolvable Ed25519 did:key: {e}"),
            }
        }
    };
    let verifying_key = match ed25519_dalek::VerifyingKey::from_bytes(&pubkey_bytes) {
        Ok(k) => k,
        Err(_) => return invalid("author.did does not encode a valid Ed25519 key"),
    };

    // 3. Authenticity: did that key sign this digest?
    let sig_bytes = match base64::Engine::decode(
        &base64::engine::general_purpose::STANDARD,
        &sigs.did_signature,
    ) {
        Ok(b) => b,
        Err(_) => return invalid("did_signature is not valid base64"),
    };
    let sig_array: [u8; 64] = match sig_bytes.as_slice().try_into() {
        Ok(a) => a,
        Err(_) => return invalid("did_signature is not a 64-byte Ed25519 signature"),
    };

    match verifying_key.verify(&digest, &ed25519_dalek::Signature::from_bytes(&sig_array)) {
        Ok(()) => SignatureStatus::Valid,
        Err(_) => invalid("did_signature does not verify against author.did"),
    }
}

/// Cache of discovered marketplace apps.
#[derive(Debug, Clone, Serialize, Deserialize, Default)]
pub struct MarketplaceCache {
    pub apps: Vec<DiscoveredApp>,
    pub last_updated: String,
}

/// Ensure marketplace directories exist.
async fn ensure_dirs(data_dir: &Path) -> Result<()> {
    let market_dir = data_dir.join(MARKETPLACE_DIR);
    fs::create_dir_all(market_dir.join("cache"))
        .await
        .context("Creating marketplace cache dir")?;
    fs::create_dir_all(market_dir.join(PUBLISHED_DIR))
        .await
        .context("Creating marketplace published dir")?;
    Ok(())
}

/// Load cached marketplace data.
pub async fn load_cache(data_dir: &Path) -> Result<MarketplaceCache> {
    let path = data_dir
        .join(MARKETPLACE_DIR)
        .join("cache")
        .join(CACHE_FILE);
    if !path.exists() {
        return Ok(MarketplaceCache::default());
    }
    let data = fs::read_to_string(&path)
        .await
        .context("Reading marketplace cache")?;
    serde_json::from_str(&data).context("Parsing marketplace cache")
}

/// Save marketplace cache.
pub async fn save_cache(data_dir: &Path, cache: &MarketplaceCache) -> Result<()> {
    ensure_dirs(data_dir).await?;
    let path = data_dir
        .join(MARKETPLACE_DIR)
        .join("cache")
        .join(CACHE_FILE);
    let data = serde_json::to_string_pretty(cache)?;
    fs::write(&path, data)
        .await
        .context("Writing marketplace cache")?;
    Ok(())
}

/// Validate a manifest meets security requirements.
pub fn validate_manifest(manifest: &AppManifest) -> Vec<String> {
    let mut issues = Vec::new();

    // Required fields
    if manifest.app_id.is_empty() {
        issues.push("Missing app_id".into());
    }
    if manifest.name.is_empty() {
        issues.push("Missing name".into());
    }
    if manifest.version.is_empty() {
        issues.push("Missing version".into());
    }
    if manifest.container.image.is_empty() {
        issues.push("Missing container image".into());
    }

    // Security checks
    if manifest.container.image.ends_with(":latest") {
        issues.push("Container image uses :latest tag (must pin specific version)".into());
    }
    if !manifest.container.readonly_root {
        issues.push("readonly_root is false (should be true)".into());
    }
    if !manifest.container.no_new_privileges {
        issues.push("no_new_privileges is false (should be true)".into());
    }
    if manifest.container.run_as_user < 1000 {
        issues.push(format!(
            "run_as_user is {} (must be >= 1000)",
            manifest.container.run_as_user
        ));
    }

    // app_id format
    if !manifest
        .app_id
        .chars()
        .all(|c| c.is_ascii_lowercase() || c == '-' || c.is_ascii_digit())
    {
        issues.push("app_id must be lowercase kebab-case".into());
    }

    issues
}

/// Calculate trust score for a discovered app manifest.
/// `signature` gates both identity-derived factors. Pass the result of
/// [`verify_manifest_signature`].
pub fn calculate_trust_score(
    manifest: &AppManifest,
    relay_count: u32,
    federated_dids: &[String],
    signature: &SignatureStatus,
) -> (u32, String) {
    let mut score: u32 = 0;

    // Identity (30 points) — the author proved control of the key their
    // did:key names. This used to be `did.starts_with("did:")`, i.e. a string
    // test any publisher could pass by typing one, which made the whole
    // "Verified" tier meaningless.
    let identity_proven = signature.is_valid();
    if identity_proven {
        score += 30;
    }

    // Relay consensus (20 points) — found on multiple relays
    score += match relay_count {
        0..=1 => 5,
        2..=3 => 12,
        _ => 20,
    };

    // Federation trust (20 points) — developer DID in federation.
    //
    // Also gated on the signature: an unverified `author.did` is just a string
    // the publisher chose, so without this an attacker could copy a DID the
    // user federates with and collect 20 points for impersonating them —
    // exactly the peer they trust most.
    if identity_proven && federated_dids.contains(&manifest.author.did) {
        score += 20;
    }

    // Version history (15 points) — has a proper semver version
    if manifest.version.split('.').count() == 3 {
        score += 10;
    }
    if !manifest.repo_url.is_empty() {
        score += 5;
    }

    // Security compliance (15 points)
    let issues = validate_manifest(manifest);
    if issues.is_empty() {
        score += 15;
    } else if issues.len() <= 2 {
        score += 5;
    }

    let tier = match score {
        80..=100 => "verified",
        50..=79 => "community",
        20..=49 => "unverified",
        _ => "untrusted",
    };

    (score, tier.to_string())
}

/// Discover app manifests from Nostr relays.
///
/// Queries configured relays for kind 30078 events with the marketplace tag,
/// parses manifests, validates, scores, and returns sorted by trust score.
pub async fn discover(
    data_dir: &Path,
    relays: &[String],
    tor_proxy: Option<&str>,
    federated_dids: &[String],
) -> Result<Vec<DiscoveredApp>> {
    if relays.is_empty() {
        return Ok(Vec::new());
    }

    info!(
        relay_count = relays.len(),
        "Discovering marketplace apps from Nostr relays"
    );

    let anon_keys = nostr_sdk::prelude::Keys::generate();
    let client = build_nostr_client(anon_keys, tor_proxy)?;
    for url in relays {
        let _ = client.add_relay(url).await;
    }
    if tokio::time::timeout(Duration::from_secs(10), client.connect())
        .await
        .is_err()
    {
        tracing::warn!("Nostr relay connection timed out after 10s, continuing anyway");
    }

    let filter = nostr_sdk::prelude::Filter::new()
        .kind(nostr_sdk::prelude::Kind::Custom(ARCHIPELAGO_KIND as u16))
        .hashtag(MARKETPLACE_TAG)
        .limit(200);

    let events = client
        .fetch_events(filter, std::time::Duration::from_secs(20))
        .await
        .map(|e| e.to_vec())
        .unwrap_or_default();
    client.disconnect().await;

    debug!(
        event_count = events.len(),
        "Fetched marketplace events from relays"
    );

    // Deduplicate by app_id, keeping the latest version
    let mut app_map: HashMap<String, (DiscoveredApp, u32)> = HashMap::new();

    for event in events {
        // Parse manifest from event content
        let manifest: AppManifest = match serde_json::from_str(&event.content) {
            Ok(m) => m,
            Err(e) => {
                debug!(err = %e, "Skipping invalid marketplace manifest");
                continue;
            }
        };

        // Validate
        let issues = validate_manifest(&manifest);
        if issues
            .iter()
            .any(|i| i.contains("Missing app_id") || i.contains("Missing container image"))
        {
            debug!(issues = ?issues, "Skipping manifest with critical issues");
            continue;
        }

        // Check the DID signature before the manifest is allowed anywhere near
        // the cache. A *wrong* signature is not a low-trust manifest, it is a
        // corrupt or forged one — drop it rather than listing it at reduced
        // score, so it can never be installed. A *missing* signature is
        // different: an unsigned publisher is legitimate, just unproven, and
        // scores zero on the identity factors.
        let signature = verify_manifest_signature(&manifest);
        if let SignatureStatus::Invalid { reason } = &signature {
            warn!(
                app_id = %manifest.app_id,
                author_did = %manifest.author.did,
                nostr_pubkey = %event.pubkey.to_hex(),
                reason = %reason,
                "Rejecting marketplace manifest with a bad DID signature"
            );
            continue;
        }

        let app_id = manifest.app_id.clone();
        let entry = app_map.entry(app_id).or_insert_with(|| {
            let (trust_score, trust_tier) =
                calculate_trust_score(&manifest, 1, federated_dids, &signature);
            (
                DiscoveredApp {
                    manifest,
                    trust_score,
                    trust_tier,
                    relay_count: 0,
                    first_seen: event.created_at.to_human_datetime(),
                    nostr_pubkey: event.pubkey.to_hex(),
                    signature,
                },
                0,
            )
        });
        entry.1 += 1;
    }

    // Update relay counts and recalculate scores
    let mut apps: Vec<DiscoveredApp> = app_map
        .into_values()
        .map(|(mut app, relay_count)| {
            app.relay_count = relay_count;
            let (score, tier) =
                calculate_trust_score(&app.manifest, relay_count, federated_dids, &app.signature);
            app.trust_score = score;
            app.trust_tier = tier;
            app
        })
        .collect();

    // Sort by trust score descending
    apps.sort_by(|a, b| b.trust_score.cmp(&a.trust_score));

    // Cache results
    let cache = MarketplaceCache {
        apps: apps.clone(),
        last_updated: chrono::Utc::now().to_rfc3339(),
    };
    if let Err(e) = save_cache(data_dir, &cache).await {
        warn!(err = %e, "Failed to save marketplace cache");
    }

    info!(app_count = apps.len(), "Marketplace discovery complete");
    Ok(apps)
}

/// Publish an app manifest to Nostr relays.
pub async fn publish(
    data_dir: &Path,
    manifest: &AppManifest,
    relays: &[String],
    tor_proxy: Option<&str>,
) -> Result<String> {
    if relays.is_empty() {
        anyhow::bail!("No relays configured for publishing");
    }

    let issues = validate_manifest(manifest);
    if !issues.is_empty() {
        anyhow::bail!("Manifest validation failed: {}", issues.join(", "));
    }

    let identity_dir = data_dir.join("identity");

    // Sign with the node's Ed25519 identity key — the same key its did:key
    // encodes — so consumers can verify authorship independently of whichever
    // Nostr key happens to relay the event.
    let identity = crate::identity::NodeIdentity::load_or_create(&identity_dir)
        .await
        .context("Loading node identity to sign the manifest")?;
    let our_did = identity.did_key().context("Deriving this node's did:key")?;

    let mut manifest = manifest.clone();
    if manifest.author.did.is_empty() {
        manifest.author.did = our_did.clone();
    } else if manifest.author.did != our_did {
        // We can only sign as ourselves. Publishing under someone else's DID
        // would produce a manifest every verifier rejects, so fail loudly here
        // instead of broadcasting garbage to every relay.
        anyhow::bail!(
            "Cannot publish as author.did {} — this node can only sign as {}",
            manifest.author.did,
            our_did
        );
    }
    sign_manifest(&mut manifest, identity.signing_key()).context("Signing manifest")?;
    debug_assert!(verify_manifest_signature(&manifest).is_valid());
    let manifest = &manifest;

    let keys = load_or_create_keys(&identity_dir).await?;
    let client = build_nostr_client(keys, tor_proxy)?;

    let content = serde_json::to_string(manifest).context("Serializing manifest")?;
    let d_tag = format!("{}{}", D_TAG_PREFIX, manifest.app_id);

    for url in relays {
        let _ = client.add_relay(url).await;
    }
    if tokio::time::timeout(Duration::from_secs(10), client.connect())
        .await
        .is_err()
    {
        tracing::warn!("Nostr relay connection timed out after 10s, continuing anyway");
    }

    let builder = nostr_sdk::prelude::EventBuilder::new(
        nostr_sdk::prelude::Kind::Custom(ARCHIPELAGO_KIND as u16),
        &content,
    )
    .tag(nostr_sdk::prelude::Tag::identifier(&d_tag))
    .tag(nostr_sdk::prelude::Tag::hashtag(MARKETPLACE_TAG))
    .tag(nostr_sdk::prelude::Tag::hashtag(format!(
        "category:{}",
        manifest.category
    )))
    .tag(nostr_sdk::prelude::Tag::custom(
        nostr_sdk::prelude::TagKind::custom("version"),
        [&manifest.version],
    ))
    .tag(nostr_sdk::prelude::Tag::custom(
        nostr_sdk::prelude::TagKind::custom("image"),
        [&manifest.container.image],
    ));

    let output = client.send_event_builder(builder).await?;
    client.disconnect().await;

    // Save to published directory
    ensure_dirs(data_dir).await?;
    let pub_path = data_dir
        .join(MARKETPLACE_DIR)
        .join(PUBLISHED_DIR)
        .join(format!("{}.json", manifest.app_id));
    let pub_data = serde_json::to_string_pretty(manifest)?;
    fs::write(&pub_path, pub_data)
        .await
        .context("Saving published manifest")?;

    info!(app_id = %manifest.app_id, "Published app manifest to {} relays", relays.len());
    Ok(output.id().to_hex())
}

/// List manifests published by this node.
pub async fn list_published(data_dir: &Path) -> Result<Vec<AppManifest>> {
    let pub_dir = data_dir.join(MARKETPLACE_DIR).join(PUBLISHED_DIR);
    if !pub_dir.exists() {
        return Ok(Vec::new());
    }

    let mut manifests = Vec::new();
    let mut entries = fs::read_dir(&pub_dir)
        .await
        .context("Reading published dir")?;
    while let Some(entry) = entries.next_entry().await? {
        let path = entry.path();
        if path.extension().map(|e| e == "json").unwrap_or(false) {
            let data = fs::read_to_string(&path).await?;
            if let Ok(manifest) = serde_json::from_str::<AppManifest>(&data) {
                manifests.push(manifest);
            }
        }
    }

    Ok(manifests)
}

// Re-use nostr client builder pattern from nostr_discovery
fn build_nostr_client(
    keys: nostr_sdk::prelude::Keys,
    tor_proxy: Option<&str>,
) -> Result<nostr_sdk::prelude::Client> {
    use nostr_sdk::prelude::*;
    let client = if let Some(proxy_str) = tor_proxy {
        let addr: std::net::SocketAddr = proxy_str
            .trim()
            .parse()
            .ok()
            .ok_or_else(|| anyhow::anyhow!("Invalid Tor proxy: {}", proxy_str))?;
        let connection = Connection::new().proxy(addr).target(ConnectionTarget::All);
        let opts = ClientOptions::new().connection(connection);
        Client::builder().signer(keys).opts(opts).build()
    } else {
        Client::new(keys)
    };
    Ok(client)
}

/// Load or create Nostr keys for marketplace publishing.
async fn load_or_create_keys(identity_dir: &Path) -> Result<nostr_sdk::prelude::Keys> {
    use nostr_sdk::prelude::Keys;

    let secret_path = identity_dir.join("nostr_secret");
    if secret_path.exists() {
        let hex_secret = fs::read_to_string(&secret_path)
            .await
            .context("Reading Nostr secret")?;
        Keys::parse(hex_secret.trim()).context("Invalid Nostr secret")
    } else {
        let keys = Keys::generate();
        fs::create_dir_all(identity_dir).await?;
        fs::write(&secret_path, keys.secret_key().to_secret_hex()).await?;
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            tokio::fs::set_permissions(&secret_path, std::fs::Permissions::from_mode(0o600))
                .await?;
        }
        Ok(keys)
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    fn sample_manifest() -> AppManifest {
        AppManifest {
            app_id: "test-app".into(),
            name: "Test App".into(),
            version: "1.0.0".into(),
            description: ManifestDescription::Detailed {
                short: "A test app".into(),
                long: "A longer description of the test app".into(),
            },
            author: ManifestAuthor {
                name: "Test Dev".into(),
                did: "did:key:z6MkTest123".into(),
                nostr_pubkey: String::new(),
            },
            container: ManifestContainer {
                image: "docker.io/test/app:1.0.0".into(),
                ports: vec![PortMapping {
                    container: 8080,
                    host: 8180,
                    protocol: "tcp".into(),
                }],
                volumes: vec![],
                env: HashMap::new(),
                capabilities: vec![],
                readonly_root: true,
                no_new_privileges: true,
                run_as_user: 1000,
            },
            category: AppCategory::Other,
            icon_url: String::new(),
            repo_url: "https://github.com/test/app".into(),
            license: "MIT".into(),
            min_archipelago_version: "0.1.0".into(),
            dependencies: vec![],
            signatures: None,
        }
    }

    #[test]
    fn test_validate_valid_manifest() {
        let manifest = sample_manifest();
        let issues = validate_manifest(&manifest);
        assert!(issues.is_empty(), "Expected no issues, got: {:?}", issues);
    }

    #[test]
    fn test_validate_latest_tag() {
        let mut manifest = sample_manifest();
        manifest.container.image = "docker.io/test/app:latest".into();
        let issues = validate_manifest(&manifest);
        assert!(issues.iter().any(|i| i.contains("latest")));
    }

    #[test]
    fn test_validate_root_user() {
        let mut manifest = sample_manifest();
        manifest.container.run_as_user = 0;
        let issues = validate_manifest(&manifest);
        assert!(issues.iter().any(|i| i.contains("run_as_user")));
    }

    #[test]
    fn test_validate_missing_fields() {
        let mut manifest = sample_manifest();
        manifest.app_id = String::new();
        manifest.container.image = String::new();
        let issues = validate_manifest(&manifest);
        assert!(issues.len() >= 2);
    }

    /// A real Ed25519 keypair, its did:key, and a manifest signed by it.
    fn signed_manifest() -> (ed25519_dalek::SigningKey, String, AppManifest) {
        let key = ed25519_dalek::SigningKey::generate(&mut rand::rngs::OsRng);
        let did =
            crate::identity::did_key_from_pubkey_hex(&hex::encode(key.verifying_key().as_bytes()))
                .unwrap();
        let mut manifest = sample_manifest();
        manifest.author.did = did.clone();
        sign_manifest(&mut manifest, &key).unwrap();
        (key, did, manifest)
    }

    #[test]
    fn verify_accepts_a_properly_signed_manifest() {
        let (_key, _did, manifest) = signed_manifest();
        assert_eq!(verify_manifest_signature(&manifest), SignatureStatus::Valid);
    }

    #[test]
    fn verify_reports_missing_when_there_is_no_signature_block() {
        let manifest = sample_manifest();
        assert_eq!(
            verify_manifest_signature(&manifest),
            SignatureStatus::Missing
        );
    }

    /// Tampering with any covered field must break the hash check.
    #[test]
    fn verify_rejects_a_tampered_field() {
        let (_key, _did, mut manifest) = signed_manifest();
        manifest.container.image = "docker.io/evil/backdoor:1.0.0".into();
        match verify_manifest_signature(&manifest) {
            SignatureStatus::Invalid { reason } => {
                assert!(reason.contains("does not match"), "reason: {reason}")
            }
            other => panic!("tampered manifest accepted: {other:?}"),
        }
    }

    /// The interesting attack: tamper with the content AND recompute
    /// `manifest_hash` so the integrity check passes. Without the key the
    /// signature can't be regenerated, so this must still fail.
    #[test]
    fn verify_rejects_tampering_that_also_rewrites_the_hash() {
        let (_key, _did, mut manifest) = signed_manifest();
        let stolen_signature = manifest.signatures.clone().unwrap().did_signature;

        manifest.container.image = "docker.io/evil/backdoor:1.0.0".into();
        let new_digest = manifest_digest(&manifest).unwrap();
        manifest.signatures = Some(ManifestSignatures {
            manifest_hash: format!("sha256:{}", hex::encode(new_digest)),
            did_signature: stolen_signature,
        });

        match verify_manifest_signature(&manifest) {
            SignatureStatus::Invalid { reason } => {
                assert!(reason.contains("does not verify"), "reason: {reason}")
            }
            other => panic!("forged manifest accepted: {other:?}"),
        }
    }

    /// Signing with one key while claiming another's DID must fail — this is
    /// the impersonation case the whole layer exists to stop.
    #[test]
    fn verify_rejects_a_signature_from_a_key_other_than_the_claimed_did() {
        let (_key_a, _did_a, mut manifest) = signed_manifest();
        let (_key_b, did_b, _) = signed_manifest();
        manifest.author.did = did_b;
        assert!(
            !verify_manifest_signature(&manifest).is_valid(),
            "a manifest signed by A must not verify as B"
        );
    }

    #[test]
    fn verify_rejects_unusable_author_dids_and_malformed_signatures() {
        let (key, _did, base) = signed_manifest();

        // Not a did:key at all.
        let mut m = base.clone();
        m.author.did = "did:web:example.com".into();
        assert!(!verify_manifest_signature(&m).is_valid());

        // did:key shaped but not decodable — the old code scored this 30/30.
        let mut m = base.clone();
        m.author.did = "did:key:z6MkTest123".into();
        assert!(!verify_manifest_signature(&m).is_valid());

        // Signature that isn't base64.
        let mut m = base.clone();
        m.signatures.as_mut().unwrap().did_signature = "not!base64!".into();
        assert!(!verify_manifest_signature(&m).is_valid());

        // Base64 of the wrong length.
        let mut m = base.clone();
        m.signatures.as_mut().unwrap().did_signature =
            base64::Engine::encode(&base64::engine::general_purpose::STANDARD, [0u8; 16]);
        assert!(!verify_manifest_signature(&m).is_valid());

        // Hash in the wrong form.
        let mut m = base.clone();
        m.signatures.as_mut().unwrap().manifest_hash = "deadbeef".into();
        assert!(!verify_manifest_signature(&m).is_valid());

        // Sanity: the untouched manifest still verifies, so the cases above
        // failed for their own reasons and not because the fixture is broken.
        let mut ok = base;
        sign_manifest(&mut ok, &key).unwrap();
        assert!(verify_manifest_signature(&ok).is_valid());
    }

    /// `env` is a HashMap, whose iteration order is randomised per process. If
    /// the preimage were not canonicalised, the same manifest would hash
    /// differently between runs and signatures would fail at random.
    #[test]
    fn digest_is_stable_regardless_of_map_insertion_order() {
        let mut a = sample_manifest();
        a.container.env.insert("ZEBRA".into(), "1".into());
        a.container.env.insert("ALPHA".into(), "2".into());
        a.container.env.insert("MIDDLE".into(), "3".into());

        let mut b = sample_manifest();
        b.container.env.insert("MIDDLE".into(), "3".into());
        b.container.env.insert("ALPHA".into(), "2".into());
        b.container.env.insert("ZEBRA".into(), "1".into());

        assert_eq!(manifest_digest(&a).unwrap(), manifest_digest(&b).unwrap());
        assert_eq!(
            canonical_signing_bytes(&a).unwrap(),
            canonical_signing_bytes(&b).unwrap()
        );
    }

    /// The signature must not cover the field that holds it, or re-signing an
    /// already-signed manifest would produce a different digest each time.
    #[test]
    fn digest_ignores_the_signatures_block() {
        let (key, _did, signed) = signed_manifest();
        let mut unsigned = signed.clone();
        unsigned.signatures = None;
        assert_eq!(
            manifest_digest(&signed).unwrap(),
            manifest_digest(&unsigned).unwrap()
        );

        // Re-signing is stable (Ed25519 is deterministic).
        let mut resigned = signed.clone();
        sign_manifest(&mut resigned, &key).unwrap();
        assert_eq!(
            resigned.signatures.unwrap().did_signature,
            signed.signatures.unwrap().did_signature
        );
    }

    #[test]
    fn test_trust_score_full() {
        let (_key, did, manifest) = signed_manifest();
        let signature = verify_manifest_signature(&manifest);
        let (score, tier) = calculate_trust_score(&manifest, 3, &[did], &signature);
        // identity (30) + relays 2-3 (12) + federation (20) + semver (10) + repo (5) + security clean (15) = 92
        assert!(score >= 80, "Expected verified, got score={score}");
        assert_eq!(tier, "verified");
    }

    #[test]
    fn test_trust_score_no_federation() {
        let (_key, _did, manifest) = signed_manifest();
        let signature = verify_manifest_signature(&manifest);
        let (score, tier) = calculate_trust_score(&manifest, 1, &[], &signature);
        // identity (30) + 1 relay (5) + semver (10) + repo (5) + security (15) = 65
        assert_eq!(tier, "community");
        assert!((50..80).contains(&score));
    }

    #[test]
    fn test_trust_score_untrusted() {
        let mut manifest = sample_manifest();
        manifest.author.did = String::new();
        manifest.repo_url = String::new();
        manifest.version = "1".into();
        manifest.container.readonly_root = false;
        let (score, _tier) = calculate_trust_score(&manifest, 1, &[], &SignatureStatus::Missing);
        assert!(score < 50, "Expected low score, got {score}");
    }

    /// The regression that made "Verified" meaningless: an unsigned manifest
    /// with a plausible-looking DID string used to score 30/30 on identity and
    /// land at 65 — "Community" — on nothing but a `starts_with("did:")`.
    #[test]
    fn an_unsigned_manifest_earns_no_identity_points() {
        let manifest = sample_manifest(); // author.did is "did:key:z6MkTest123"
        let signature = verify_manifest_signature(&manifest);
        assert_eq!(signature, SignatureStatus::Missing);

        let (score, tier) = calculate_trust_score(&manifest, 1, &[], &signature);
        // 1 relay (5) + semver (10) + repo (5) + security (15) = 35, no identity 30.
        assert_eq!(score, 35);
        assert_eq!(tier, "unverified");
    }

    /// Impersonation via the federation factor: claiming a DID the user
    /// federates with must earn nothing unless the claim is proven.
    #[test]
    fn claiming_a_federated_did_without_proving_it_earns_no_federation_points() {
        let (_key, victim_did, _) = signed_manifest();

        let mut impostor = sample_manifest();
        impostor.author.did = victim_did.clone();
        assert_eq!(
            verify_manifest_signature(&impostor),
            SignatureStatus::Missing
        );

        let federated = [victim_did];
        let (unproven, _) =
            calculate_trust_score(&impostor, 1, &federated, &SignatureStatus::Missing);
        let (proven, _) = calculate_trust_score(&impostor, 1, &federated, &SignatureStatus::Valid);

        assert_eq!(
            proven - unproven,
            50,
            "identity (30) + federation (20) must both hang off proof"
        );
    }

    #[test]
    fn test_manifest_serialization() {
        let manifest = sample_manifest();
        let json = serde_json::to_string(&manifest).unwrap();
        let parsed: AppManifest = serde_json::from_str(&json).unwrap();
        assert_eq!(parsed.app_id, "test-app");
        assert_eq!(parsed.description.short(), "A test app");
    }

    #[test]
    fn test_category_display() {
        assert_eq!(AppCategory::Money.to_string(), "money");
        assert_eq!(AppCategory::Networking.to_string(), "networking");
    }

    #[tokio::test]
    async fn test_cache_persistence() {
        let dir = tempfile::tempdir().unwrap();
        let cache = MarketplaceCache {
            apps: vec![DiscoveredApp {
                manifest: sample_manifest(),
                trust_score: 75,
                trust_tier: "community".into(),
                relay_count: 2,
                first_seen: "2026-03-10T00:00:00Z".into(),
                nostr_pubkey: "abc123".into(),
                signature: SignatureStatus::Valid,
            }],
            last_updated: "2026-03-10T00:00:00Z".into(),
        };
        save_cache(dir.path(), &cache).await.unwrap();
        let loaded = load_cache(dir.path()).await.unwrap();
        assert_eq!(loaded.apps.len(), 1);
        assert_eq!(loaded.apps[0].manifest.app_id, "test-app");
        assert_eq!(loaded.apps[0].signature, SignatureStatus::Valid);
    }

    /// A cache written before the signature field existed must still load, and
    /// must come back as unverified rather than silently defaulting to trusted.
    #[tokio::test]
    async fn a_legacy_cache_without_the_signature_field_loads_as_missing() {
        let dir = tempfile::tempdir().unwrap();
        ensure_dirs(dir.path()).await.unwrap();
        let legacy = serde_json::json!({
            "apps": [{
                "manifest": sample_manifest(),
                "trust_score": 75,
                "trust_tier": "community",
                "relay_count": 2,
                "first_seen": "2026-03-10T00:00:00Z",
                "nostr_pubkey": "abc123"
            }],
            "last_updated": "2026-03-10T00:00:00Z"
        });
        let path = dir
            .path()
            .join(MARKETPLACE_DIR)
            .join("cache")
            .join(CACHE_FILE);
        fs::write(&path, serde_json::to_vec(&legacy).unwrap())
            .await
            .unwrap();

        let loaded = load_cache(dir.path()).await.unwrap();
        assert_eq!(loaded.apps.len(), 1);
        assert_eq!(loaded.apps[0].signature, SignatureStatus::Missing);
    }

    /// `SignatureStatus` crosses the RPC boundary to the UI, so its wire shape
    /// is a contract worth pinning.
    #[test]
    fn signature_status_serialises_to_a_tagged_object() {
        assert_eq!(
            serde_json::to_value(SignatureStatus::Valid).unwrap(),
            serde_json::json!({ "status": "valid" })
        );
        assert_eq!(
            serde_json::to_value(SignatureStatus::Missing).unwrap(),
            serde_json::json!({ "status": "missing" })
        );
        assert_eq!(
            serde_json::to_value(SignatureStatus::Invalid {
                reason: "nope".into()
            })
            .unwrap(),
            serde_json::json!({ "status": "invalid", "reason": "nope" })
        );
    }
}