"""固定Git commit归档与缓存来源证明；不把旧缓存当作已核实安装包。"""
import datetime
import hashlib
import json
import re
from github_source import canonical_resource_source

ARCHIVE_SCHEMA = 3
ARCHIVE_MAX_BYTES = 500 * 1024 * 1024


def archive_repository(value):
    """仅接收明确的owner/name标识，不能用元数据构造额外URL路径。"""
    if (not isinstance(value, str) or len(value) > 193
            or not re.fullmatch(r'[A-Za-z0-9](?:[A-Za-z0-9_.-]{0,94}[A-Za-z0-9])?/[A-Za-z0-9](?:[A-Za-z0-9_.-]{0,94}[A-Za-z0-9])?', value)
            or '..' in value or '--' in value):
        raise ValueError('invalid archive storage identity')
    return value


def commit_sha(value):
    if not isinstance(value, str) or not re.fullmatch(r'[0-9a-fA-F]{40}', value):
        raise ValueError('invalid commit identity')
    return value.lower()


def commit_ref(value):
    if not isinstance(value, str) or not re.fullmatch(r'(?:[0-9a-fA-F]{7}|[0-9a-fA-F]{40})', value):
        raise ValueError('invalid commit reference')
    return value.lower()


def source_signature(item, token):
    author = item.get('author')
    if not isinstance(author, str) or not author.strip():
        raise ValueError('invalid archive author')
    source = [canonical_resource_source(item), author, token or '']
    # 元数据只保存摘要，不保存或输出凭据。
    return hashlib.sha256(json.dumps(source, ensure_ascii=True, separators=(',', ':')).encode()).hexdigest()


def archive_path(item_id, sha, signature):
    if not isinstance(item_id, str) or not re.fullmatch(r'[A-Za-z0-9_-]{1,100}', item_id):
        raise ValueError('invalid archive item')
    if not isinstance(signature, str) or not re.fullmatch(r'[0-9a-f]{64}', signature):
        raise ValueError('invalid archive source')
    return f'zips/{item_id}_{commit_sha(sha)}_{signature[:16]}.zip'


def cached_archive(item, token, entry, *, repo_id, now=None):
    """只有完整来源、commit、HF不可变提交及未过期元数据才允许命中。"""
    try:
        if not isinstance(entry, dict) or type(entry.get('archive_schema')) is not int or entry['archive_schema'] != ARCHIVE_SCHEMA:
            return None
        repository = archive_repository(repo_id)
        if entry.get('archive_repo_id') != repository:
            return None
        if entry.get('archive_storage_private') is not True:
            return None
        sha = commit_sha(entry.get('archive_commit'))
        if entry.get('version_commit') not in (None, sha):
            return None
        if entry.get('hash') != sha[:7]:
            return None
        signature = source_signature(item, token)
        if entry.get('archive_source') != signature:
            return None
        path = archive_path(item.get('id'), sha, signature)
        if entry.get('archive_path') != path:
            return None
        hf_commit = commit_sha(entry.get('archive_hf_commit'))
        size = entry.get('zip_size')
        if type(size) is not int or not 0 < size <= ARCHIVE_MAX_BYTES:
            return None
        cached_at = datetime.datetime.fromisoformat(entry['cached_at'].replace('Z', '+00:00'))
        if cached_at.tzinfo is None:
            return None
        elapsed = (now or datetime.datetime.now(datetime.timezone.utc)) - cached_at
        if not datetime.timedelta(minutes=-5) <= elapsed <= datetime.timedelta(days=30):
            return None
        return dict(commit=sha, path=path, hf_commit=hf_commit, size=size, repo_id=repository)
    except (ValueError, TypeError, KeyError, AttributeError):
        return None


def publish_archive_metadata(versions, item_id, expected_hash, metadata):
    """锁内只更新目标缓存字段；晚到下载不能改变当前版本或其它资源。"""
    if not isinstance(versions, dict):
        raise ValueError('invalid version source')
    entry = versions.get(item_id)
    if isinstance(entry, str):
        entry = {'hash': entry}
    if not isinstance(entry, dict) or entry.get('hash') != commit_ref(expected_hash)[:7]:
        return False
    if (entry.get('version_commit') not in (None, metadata.get('archive_commit'))
            or entry.get('version_source') not in (None, metadata.get('archive_source'))):
        return False
    keys = ('archive_schema', 'archive_commit', 'archive_source', 'archive_path',
            'archive_hf_commit', 'archive_storage_private', 'archive_repo_id', 'zip_size', 'cached_at')
    archive_repository(metadata['archive_repo_id'])
    entry = {**entry, **{key: metadata[key] for key in keys}}
    versions[item_id] = entry
    return True