config.go

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"strings"
	"time"
)

const (
	configFile                 = "config.json"
	sessionFile                = "session.json"
	activeSessionWindowSeconds = 12 * 60 * 60
)

type LocalConfig struct {
	Version    int              `json:"version"`
	Project    ProjectConfig    `json:"project"`
	ComputeKey ComputeKeyConfig `json:"compute_key"`
	Provider   ProviderConfig   `json:"provider"`
	Target     TargetConfig     `json:"target"`
}

type ProjectConfig struct {
	FullName string  `json:"full_name"`
	ID       *string `json:"id,omitempty"`
}

type ComputeKeyConfig struct {
	ID string `json:"id"`
}

type ProviderConfig struct {
	Name              string  `json:"name"`
	KeyHash           *string `json:"key_hash,omitempty"`
	CredentialStorage string  `json:"credential_storage"`
}

type TargetConfig struct {
	Name string `json:"name"`
}

type LocalSession struct {
	Version         int     `json:"version"`
	ID              string  `json:"id"`
	RepoRoot        string  `json:"repo_root"`
	ProjectFullName string  `json:"project_full_name"`
	ProjectID       *string `json:"project_id,omitempty"`
	ComputeKeyID    string  `json:"compute_key_id"`
	Target          string  `json:"target"`
	StartedAtUnix   uint64  `json:"started_at_unix"`
	UpdatedAtUnix   uint64  `json:"updated_at_unix"`
	FinishedAtUnix  *uint64 `json:"finished_at_unix,omitempty"`

	LaunchProofHash  *string `json:"launch_proof_hash,omitempty"`
	LaunchProofToken string  `json:"-"`
}

type RepoPaths struct {
	Root         string
	RepoStateDir string
	StateDir     string
	Config       string
	Session      string
	GithubOrigin string
}

func discoverRepoPaths(target string) (*RepoPaths, error) {
	cwd, err := os.Getwd()
	if err != nil {
		return nil, fmt.Errorf("read current directory: %w", err)
	}
	return repoPathsFromRoot(cwd, target)
}

func discoverRepoPathsConfigured(target string) (*RepoPaths, error) {
	cwd, err := os.Getwd()
	if err != nil {
		return nil, fmt.Errorf("read current directory: %w", err)
	}
	return repoPathsFromRootConfigured(cwd, target)
}

func repoPathsFromRoot(start, target string) (*RepoPaths, error) {
	root, err := findRepoRoot(start)
	if err != nil {
		return nil, err
	}
	root, err = filepath.EvalSymlinks(root)
	if err != nil {
		return nil, fmt.Errorf("canonicalize %s: %w", root, err)
	}

	gp, err := gitPaths(root)
	if err != nil {
		return nil, err
	}
	origin, err := readGitOrigin(gp)
	if err != nil {
		return nil, err
	}
	if origin == "" {
		return nil, errors.New("could not verify opub project: git origin is not configured")
	}

	stateRoot, err := userStateRoot()
	if err != nil {
		return nil, err
	}

	project := parseGithubRemoteProject(origin)
	if project == "" {
		return nil, fmt.Errorf("could not verify opub project against git origin %q", origin)
	}

	repoStateDir := filepath.Join(stateRoot, "repos", stateKey(root, project))
	stateDir := filepath.Join(repoStateDir, "targets", target)

	return &RepoPaths{
		Root:         root,
		RepoStateDir: repoStateDir,
		StateDir:     stateDir,
		Config:       filepath.Join(stateDir, configFile),
		Session:      filepath.Join(stateDir, sessionFile),
		GithubOrigin: origin,
	}, nil
}

func repoPathsFromRootConfigured(start, target string) (*RepoPaths, error) {
	if target != "" {
		return repoPathsFromRoot(start, target)
	}

	if t := os.Getenv("OPUB_TARGET"); t != "" {
		return repoPathsFromRoot(start, t)
	}

	probe, err := repoPathsFromRoot(start, "_probe")
	if err != nil {
		return nil, err
	}

	targetsDir := filepath.Join(probe.RepoStateDir, "targets")
	entries, err := os.ReadDir(targetsDir)
	if errors.Is(err, os.ErrNotExist) {
		return nil, fmt.Errorf("no opub target config found under %s", targetsDir)
	}
	if err != nil {
		return nil, fmt.Errorf("read %s: %w", targetsDir, err)
	}

	var configured []string
	for _, e := range entries {
		if e.IsDir() {
			candidate := filepath.Join(targetsDir, e.Name(), configFile)
			if _, err := os.Stat(candidate); err == nil {
				configured = append(configured, e.Name())
			}
		}
	}

	switch len(configured) {
	case 1:
		return repoPathsFromRoot(start, configured[0])
	case 0:
		return nil, fmt.Errorf("no opub target config found under %s", targetsDir)
	default:
		return nil, fmt.Errorf("multiple opub target configs found (%s); pass --target or start MCP through `opub run <target>`", strings.Join(configured, ", "))
	}
}

func readConfig(paths *RepoPaths) (*LocalConfig, error) {
	data, err := os.ReadFile(paths.Config)
	if err != nil {
		return nil, fmt.Errorf("read %s: %w", paths.Config, err)
	}
	var cfg LocalConfig
	if err := json.Unmarshal(data, &cfg); err != nil {
		return nil, fmt.Errorf("parse %s: %w", paths.Config, err)
	}
	return &cfg, nil
}

func writeConfig(paths *RepoPaths, cfg *LocalConfig) error {
	if err := os.MkdirAll(paths.StateDir, 0755); err != nil {
		return fmt.Errorf("create %s: %w", paths.StateDir, err)
	}
	data, err := json.MarshalIndent(cfg, "", "  ")
	if err != nil {
		return fmt.Errorf("serialize opub config: %w", err)
	}
	if err := os.WriteFile(paths.Config, append(data, '\n'), 0600); err != nil {
		return fmt.Errorf("write %s: %w", paths.Config, err)
	}
	return nil
}

func readSession(paths *RepoPaths) (*LocalSession, error) {
	data, err := os.ReadFile(paths.Session)
	if err != nil {
		return nil, fmt.Errorf("read %s: %w", paths.Session, err)
	}
	var s LocalSession
	if err := json.Unmarshal(data, &s); err != nil {
		return nil, fmt.Errorf("parse %s: %w", paths.Session, err)
	}
	return &s, nil
}

func writeSession(paths *RepoPaths, cfg *LocalConfig) (*LocalSession, error) {
	if err := os.MkdirAll(paths.StateDir, 0755); err != nil {
		return nil, fmt.Errorf("create %s: %w", paths.StateDir, err)
	}
	now := unixNow()
	launchProofToken, launchProofHash, err := newLaunchProof()
	if err != nil {
		return nil, err
	}

	existing, err := readSession(paths)
	if err != nil && !errors.Is(err, os.ErrNotExist) {
		// unwrap to check the underlying cause
		var pathErr *os.PathError
		if !errors.As(err, &pathErr) {
			return nil, err
		}
	}

	var reusable *LocalSession
	if existing != nil &&
		existing.ProjectFullName == cfg.Project.FullName &&
		existing.ComputeKeyID == cfg.ComputeKey.ID &&
		existing.Target == cfg.Target.Name &&
		existing.FinishedAtUnix == nil &&
		now-existing.UpdatedAtUnix <= activeSessionWindowSeconds {
		reusable = existing
	}

	id := fmt.Sprintf("local-%d-%d", now, os.Getpid())
	if reusable != nil {
		id = reusable.ID
	}

	var startedAt uint64 = now
	if reusable != nil {
		startedAt = reusable.StartedAtUnix
	}

	session := &LocalSession{
		Version:          1,
		ID:               id,
		RepoRoot:         paths.Root,
		ProjectFullName:  cfg.Project.FullName,
		ProjectID:        cfg.Project.ID,
		ComputeKeyID:     cfg.ComputeKey.ID,
		Target:           cfg.Target.Name,
		StartedAtUnix:    startedAt,
		UpdatedAtUnix:    now,
		LaunchProofHash:  &launchProofHash,
		LaunchProofToken: launchProofToken,
	}

	data, err := json.MarshalIndent(session, "", "  ")
	if err != nil {
		return nil, fmt.Errorf("serialize opub session: %w", err)
	}
	if err := os.WriteFile(paths.Session, append(data, '\n'), 0600); err != nil {
		return nil, fmt.Errorf("write %s: %w", paths.Session, err)
	}
	return session, nil
}

func newLaunchProof() (token string, hash string, err error) {
	b := make([]byte, 32)
	if _, err := rand.Read(b); err != nil {
		return "", "", fmt.Errorf("generate launch proof: %w", err)
	}
	token = base64.RawURLEncoding.EncodeToString(b)
	return token, hashLaunchProofToken(token), nil
}

func hashLaunchProofToken(token string) string {
	sum := sha256.Sum256([]byte(token))
	return fmt.Sprintf("%x", sum[:])
}

func persistSession(paths *RepoPaths, session *LocalSession) error {
	data, err := json.MarshalIndent(session, "", "  ")
	if err != nil {
		return fmt.Errorf("serialize opub session: %w", err)
	}
	if err := os.WriteFile(paths.Session, append(data, '\n'), 0600); err != nil {
		return fmt.Errorf("write %s: %w", paths.Session, err)
	}
	return nil
}

func userStateRoot() (string, error) {
	if v := os.Getenv("OPUB_HOME"); v != "" {
		return v, nil
	}
	if v := os.Getenv("XDG_STATE_HOME"); v != "" {
		return filepath.Join(v, "opub"), nil
	}
	home := os.Getenv("HOME")
	if home == "" {
		return "", errors.New("OPUB_HOME, XDG_STATE_HOME, or HOME must be set for opub user state")
	}
	return filepath.Join(home, ".local", "state", "opub"), nil
}

func validateProjectName(name string) error {
	parts := strings.SplitN(name, "/", 3)
	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
		return errors.New("project must be in owner/repo format")
	}
	return nil
}

func verifyProjectMatchesOrigin(paths *RepoPaths, project string) error {
	origin := parseGithubRemoteProject(paths.GithubOrigin)
	if origin == "" {
		return fmt.Errorf("could not verify opub project against git origin %q", paths.GithubOrigin)
	}
	if project != origin {
		return fmt.Errorf("opub project %q does not match git origin %q", project, origin)
	}
	return nil
}

func parseGithubRemoteProject(originURL string) string {
	s := strings.TrimSpace(originURL)
	for _, prefix := range []string{
		"git@github.com:",
		"https://github.com/",
		"http://github.com/",
		"ssh://git@github.com/",
	} {
		if after, ok := strings.CutPrefix(s, prefix); ok {
			s = after
			break
		}
	}

	s = strings.TrimSuffix(s, ".git")
	parts := strings.Split(s, "/")
	if len(parts) != 2 || strings.TrimSpace(parts[0]) == "" || strings.TrimSpace(parts[1]) == "" {
		return ""
	}
	return strings.TrimSpace(parts[0]) + "/" + strings.TrimSpace(parts[1])
}

type gitPathsResult struct {
	gitDir    string
	commonDir string
}

func gitPaths(root string) (*gitPathsResult, error) {
	dotGit := filepath.Join(root, ".git")
	info, err := os.Stat(dotGit)
	if err != nil {
		return nil, fmt.Errorf("stat %s: %w", dotGit, err)
	}

	var gitDir string
	if info.IsDir() {
		gitDir = dotGit
	} else {
		body, err := os.ReadFile(dotGit)
		if err != nil {
			return nil, fmt.Errorf("read %s: %w", dotGit, err)
		}
		ref := strings.TrimSpace(string(body))
		after, ok := strings.CutPrefix(ref, "gitdir:")
		if !ok {
			return nil, fmt.Errorf("unsupported .git file format in %s", dotGit)
		}
		p := strings.TrimSpace(after)
		if !filepath.IsAbs(p) {
			p = filepath.Join(root, p)
		}
		gitDir = p
	}

	gitDir, err = filepath.EvalSymlinks(gitDir)
	if err != nil {
		return nil, fmt.Errorf("canonicalize %s: %w", gitDir, err)
	}

	commonDir := gitDir
	commonDirPath := filepath.Join(gitDir, "commondir")
	if data, err := os.ReadFile(commonDirPath); err == nil {
		p := strings.TrimSpace(string(data))
		if !filepath.IsAbs(p) {
			p = filepath.Join(gitDir, p)
		}
		if cd, err := filepath.EvalSymlinks(p); err == nil {
			commonDir = cd
		}
	}

	return &gitPathsResult{gitDir: gitDir, commonDir: commonDir}, nil
}

func readGitOrigin(gp *gitPathsResult) (string, error) {
	configPath := filepath.Join(gp.commonDir, "config")
	data, err := os.ReadFile(configPath)
	if errors.Is(err, os.ErrNotExist) {
		return "", nil
	}
	if err != nil {
		return "", fmt.Errorf("read %s: %w", configPath, err)
	}
	return parseOriginFromGitConfig(string(data)), nil
}

func parseOriginFromGitConfig(body string) string {
	inOrigin := false
	for _, line := range strings.Split(body, "\n") {
		trimmed := strings.TrimSpace(line)
		if strings.HasPrefix(trimmed, "[") {
			inOrigin = trimmed == `[remote "origin"]`
			continue
		}
		if inOrigin {
			if after, ok := strings.CutPrefix(trimmed, "url = "); ok {
				return after
			}
		}
	}
	return ""
}

func readGitCommit(root string) string {
	gp, err := gitPaths(root)
	if err != nil {
		return ""
	}
	data, err := os.ReadFile(filepath.Join(gp.gitDir, "HEAD"))
	if err != nil {
		return ""
	}
	head := strings.TrimSpace(string(data))
	if ref, ok := strings.CutPrefix(head, "ref: "); ok {
		commitData, err := os.ReadFile(filepath.Join(gp.commonDir, ref))
		if err != nil {
			return ""
		}
		return strings.TrimSpace(string(commitData))
	}
	return head
}

func findRepoRoot(start string) (string, error) {
	dir := start
	for {
		if _, err := os.Stat(filepath.Join(dir, ".git")); err == nil {
			return dir, nil
		}
		parent := filepath.Dir(dir)
		if parent == dir {
			return "", errors.New("not inside a git repository")
		}
		dir = parent
	}
}

func stateKey(root, githubProject string) string {
	input := root + "\n" + githubProject
	return fmt.Sprintf("%016x", fnv1a64([]byte(input)))
}

func fnv1a64(b []byte) uint64 {
	h := uint64(0xcbf29ce484222325)
	for _, c := range b {
		h ^= uint64(c)
		h *= 0x100000001b3
	}
	return h
}

func unixNow() uint64 {
	return uint64(time.Now().Unix())
}