# This file is part of Gajim.
#
# SPDX-License-Identifier: GPL-3.0-only

from __future__ import annotations

import logging
from pathlib import Path

from gi.repository import Gio
from gi.repository import GLib

from gajim.common import configpaths
from gajim.common.util.filesystem import write_file_async
from gajim.common.util.text import get_random_string

log = logging.getLogger("gajim.c.cert_store")


class CertificateStore:
    def __init__(self):
        self._path = configpaths.get("CERT_STORE")
        self._certs: list[Gio.TlsCertificate] = []

        self._load_certificates()

    def _get_random_path(self) -> Path:
        filename = get_random_string()
        path = self._path / filename
        if path.exists():
            return self._get_random_path()
        return path

    def _load_certificates(self) -> None:
        for path in self._path.iterdir():
            if path.is_dir():
                continue
            try:
                cert = Gio.TlsCertificate.new_from_file(str(path))
            except GLib.Error as error:
                log.warning("Can't load certificate: %s, %s", path, error)
                continue

            log.info("Loaded: %s", path.stem)
            self._certs.append(cert)

        log.info("%s Certificates loaded", len(self._certs))

    def get_certificates(self):
        return list(self._certs)

    def add_certificate(self, certificate: Gio.TlsCertificate) -> None:
        log.info("Add certificate to trust store")
        self._certs.append(certificate)
        pem = certificate.props.certificate_pem
        path = self._get_random_path()
        write_file_async(path, pem.encode(), self._on_certificate_write_finished, path)

    def verify(
        self, certificate: Gio.TlsCertificate, tls_errors: set[Gio.TlsCertificateFlags]
    ):

        if Gio.TlsCertificateFlags.UNKNOWN_CA in tls_errors:
            for trusted_certificate in self._certs:
                if trusted_certificate.is_same(certificate):
                    tls_errors.remove(Gio.TlsCertificateFlags.UNKNOWN_CA)
                    break

        return not tls_errors

    @staticmethod
    def _on_certificate_write_finished(
        _successful: bool, error: GLib.Error | None, path: Path
    ):
        if error is not None:
            log.error("Can't store certificate: %s", error.message)
            return

        log.info("Certificate stored: %s", path)
