namespace DodoSSH.Domain;

/// <summary>
/// An SSH host.
/// </summary>
/// <remarks>
/// <para>
/// The only vault item type in M1. Everything sensitive — username, notes, jump chain, SSH
/// options — lives inside <see cref="Payload"/>. There is deliberately no plaintext label:
/// access-control administration happens in the client, which can decrypt names, so the server
/// never needs a searchable title.
/// </para>
/// <para>
/// <see cref="Hostname"/> and <see cref="Port"/> are the one deliberate plaintext concession, and
/// only when <see cref="RelayEnabled"/> is set. The relay must resolve its target server-side or
/// it becomes an authenticated open TCP proxy into the operator's own network. A database CHECK
/// constraint enforces the pairing so it cannot drift. See ADR 0004.
/// </para>
/// </remarks>
public sealed class SshHost : IVaultItem
{
    /// <summary>Primary key. UUIDv7, generated by the client so items can be created offline.</summary>
    public Guid Id { get; set; }

    /// <summary>Owning vault.</summary>
    public Guid VaultId { get; set; }

    /// <summary>Owning vault.</summary>
    public Vault? Vault { get; set; }

    /// <summary>The encrypted item: a DSH1 envelope. Opaque to the server.</summary>
    public byte[] Payload { get; set; } = [];

    /// <summary>The item's data key, wrapped under the vault key. Opaque.</summary>
    public byte[]? DataKeyWrap { get; set; }

    /// <summary>
    /// Reserved for per-item content keys wrapped to individual users, which is what will make
    /// per-item access control cryptographic rather than server-enforced. Present from the first
    /// migration so that lands without a migration; see docs/crypto.md §3.
    /// </summary>
    public Guid? ContentKeyId { get; set; }

    /// <summary>Vault key generation this payload was encrypted under.</summary>
    public int KeyGeneration { get; set; }

    /// <summary>AAD rule version, enabling a lazy re-encrypt-on-write migration later.</summary>
    public short PayloadAadVersion { get; set; }

    /// <summary>Whether this host may be dialled through the server relay.</summary>
    public bool RelayEnabled { get; set; }

    /// <summary>Target hostname. Permitted only when <see cref="RelayEnabled"/> is set.</summary>
    public string? Hostname { get; set; }

    /// <summary>Target port. Permitted only when <see cref="RelayEnabled"/> is set.</summary>
    public int? Port { get; set; }

    /// <summary>Owning group, for tree placement. Groups arrive in M2.</summary>
    public Guid? GroupId { get; set; }

    /// <summary>
    /// Client-visible, monotonic item version. Used for optimistic concurrency on push, and
    /// deliberately distinct from the internal <c>xmin</c> guard, which is never exposed because
    /// it is not stable across VACUUM FREEZE.
    /// </summary>
    public int Version { get; set; }

    /// <summary>Latest change-log sequence touching this row, so a delta pull can join directly.</summary>
    public long ChangeSequence { get; set; }

    /// <summary>Creation timestamp.</summary>
    public DateTimeOffset CreatedAtUtc { get; set; }

    /// <summary>Last modification timestamp.</summary>
    public DateTimeOffset UpdatedAtUtc { get; set; }

    /// <summary>
    /// Soft-delete marker. Deletes are tombstones: a client that has been offline must be able to
    /// learn an item went away, and a vanished row is indistinguishable from one never seen.
    /// </summary>
    public DateTimeOffset? DeletedAtUtc { get; set; }

    /// <summary>Who created it.</summary>
    public Guid CreatedByUserId { get; set; }

    /// <summary>Who last modified it.</summary>
    public Guid UpdatedByUserId { get; set; }
}

/// <summary>
/// An SSH key pair, held as ciphertext.
/// </summary>
/// <remarks>
/// <para>
/// The private key, its passphrase, its label and its comment are all inside <see cref="Payload"/>. This
/// row is the reason the vault is worth having — a key that syncs between a user's machines and can later be
/// shared with a teammate — and it is also the row that would hurt most if the server could read it, so
/// there is deliberately not one plaintext column of substance.
/// </para>
/// <para>
/// Notably absent: the relay trio. A key is not something the server dials, so the plaintext concession
/// ADR 0004 makes for <see cref="SshHost"/> has no analogue here and no reason to exist. That is the whole
/// argument for a separate table rather than one wide item table: the columns a host needs are columns a key
/// must never have, and a shared table could only make them nullable and trust the code.
/// </para>
/// <para>
/// <see cref="PublicKeyFingerprint"/> is the single exception, and it stays null until something needs it.
/// The contract reserved the slot for showing which key a host is configured to use without decrypting
/// every key first; write it only when that feature lands, and never derive anything security-relevant from
/// it, because a fingerprint the server stores is a fingerprint the server chose.
/// </para>
/// </remarks>
public sealed class VaultSshKey : IVaultItem
{
    /// <summary>Primary key. UUIDv7, generated by the client so keys can be created offline.</summary>
    public Guid Id { get; set; }

    /// <summary>Owning vault.</summary>
    public Guid VaultId { get; set; }

    /// <summary>Owning vault.</summary>
    public Vault? Vault { get; set; }

    /// <summary>The encrypted key material: a DSH1 envelope. Opaque to the server.</summary>
    public byte[] Payload { get; set; } = [];

    /// <summary>The item's data key, wrapped under the vault key. Opaque.</summary>
    public byte[]? DataKeyWrap { get; set; }

    /// <summary>Reserved for per-item content keys wrapped to individual users; see docs/crypto.md §3.</summary>
    public Guid? ContentKeyId { get; set; }

    /// <summary>Vault key generation this payload was encrypted under.</summary>
    public int KeyGeneration { get; set; }

    /// <summary>AAD rule version, enabling a lazy re-encrypt-on-write migration later.</summary>
    public short PayloadAadVersion { get; set; }

    /// <summary>
    /// OpenSSH-style <c>SHA256:base64</c> fingerprint of the public half, when a client publishes it.
    /// </summary>
    /// <remarks>
    /// Plaintext, and therefore opt-in and currently unused. A public key fingerprint is not a secret, but
    /// it is an identifier that links a vault to a machine's <c>authorized_keys</c>, so it is stored only
    /// when a feature needs it rather than because it is harmless.
    /// </remarks>
    public string? PublicKeyFingerprint { get; set; }

    /// <summary>Client-visible, monotonic item version, used for <c>expectedVersion</c> checks.</summary>
    public int Version { get; set; }

    /// <summary>Latest change-log sequence touching this row, so a delta pull can join directly.</summary>
    public long ChangeSequence { get; set; }

    /// <summary>Creation timestamp.</summary>
    public DateTimeOffset CreatedAtUtc { get; set; }

    /// <summary>Last modification timestamp.</summary>
    public DateTimeOffset UpdatedAtUtc { get; set; }

    /// <summary>Soft-delete marker; a tombstone, so an offline client learns the key went away.</summary>
    public DateTimeOffset? DeletedAtUtc { get; set; }

    /// <summary>Who created it.</summary>
    public Guid CreatedByUserId { get; set; }

    /// <summary>Who last modified it.</summary>
    public Guid UpdatedByUserId { get; set; }
}

/// <summary>
/// A stored username and password, as ciphertext.
/// </summary>
/// <remarks>
/// <para>
/// Its own table for the same reason <see cref="VaultSshKey"/> is: the columns a host needs are columns a
/// credential must never have. There is no relay trio here, and unlike a key there is not even a fingerprint
/// — nothing about a password is safe to hold in the clear, not its length, not a hash, not a hint. So this
/// row is an opaque envelope and its bookkeeping, and that is the whole design.
/// </para>
/// <para>
/// <b>The server cannot enforce anything about the contents, and should not pretend to.</b> Whether a
/// credential has a username, whether its password is empty, whether it is still valid — all of that is
/// inside the payload and belongs to the client. The one thing this row asserts is that the ciphertext
/// belongs to a vault and carries a version, which is what the write path needs to order changes.
/// </para>
/// </remarks>
public sealed class VaultCredential : IVaultItem
{
    /// <summary>Primary key. UUIDv7, generated by the client so credentials can be created offline.</summary>
    public Guid Id { get; set; }

    /// <summary>Owning vault.</summary>
    public Guid VaultId { get; set; }

    /// <summary>Owning vault.</summary>
    public Vault? Vault { get; set; }

    /// <summary>The encrypted credential: a DSH1 envelope. Opaque to the server.</summary>
    public byte[] Payload { get; set; } = [];

    /// <summary>The item's data key, wrapped under the vault key. Opaque.</summary>
    public byte[]? DataKeyWrap { get; set; }

    /// <summary>Reserved for per-item content keys wrapped to individual users; see docs/crypto.md §3.</summary>
    public Guid? ContentKeyId { get; set; }

    /// <summary>Vault key generation this payload was encrypted under.</summary>
    public int KeyGeneration { get; set; }

    /// <summary>AAD rule version, enabling a lazy re-encrypt-on-write migration later.</summary>
    public short PayloadAadVersion { get; set; }

    /// <summary>Client-visible, monotonic item version, used for <c>expectedVersion</c> checks.</summary>
    public int Version { get; set; }

    /// <summary>Latest change-log sequence touching this row, so a delta pull can join directly.</summary>
    public long ChangeSequence { get; set; }

    /// <summary>Creation timestamp.</summary>
    public DateTimeOffset CreatedAtUtc { get; set; }

    /// <summary>Last modification timestamp.</summary>
    public DateTimeOffset UpdatedAtUtc { get; set; }

    /// <summary>Soft-delete marker; a tombstone, so an offline client learns the credential went away.</summary>
    public DateTimeOffset? DeletedAtUtc { get; set; }

    /// <summary>Who created it.</summary>
    public Guid CreatedByUserId { get; set; }

    /// <summary>Who last modified it.</summary>
    public Guid UpdatedByUserId { get; set; }
}