package external

import (
	"fmt"
	"io"

	"git.hypertheory-labs.dev/loom/loom-cli/internal/lock"
)

// auditExposure reports documents adopted from a source that could not be read
// anonymously, into a repository that now can.
//
// Access is verified once, at fetch, and the copy is durable. Whether the
// adoption is still legitimate rests on the relative visibility of two
// repositories — a fact somebody can change with a checkbox a year later,
// without ever seeing the adoption. This is what turns that from a silent
// permanent hazard into something that runs.
func auditExposure(root string, locks *lock.Set, out io.Writer) (changed bool) {
	var suspect []lock.Record
	for _, r := range locks.All() {
		if r.Visibility == lock.NotPublic {
			suspect = append(suspect, r)
		}
	}
	if len(suspect) == 0 {
		return false
	}

	// Only our own visibility has to be current, and it is one request for the
	// whole run rather than one per document.
	public, known := selfVisibility(root)
	if known && !public {
		return false // adopted private into private; nothing has widened
	}
	if !known {
		fmt.Fprintf(out, "\n%d document(s) came from a source that needed a credential, and I cannot\n", len(suspect))
		fmt.Fprintf(out, "tell who may read this repository — no usable origin.\n")
		return false
	}

	// The stored value decays in both directions. A source that has since gone
	// public would otherwise raise this alarm forever, so re-check — but only
	// the suspects, and only when the alarm would actually fire.
	var still []lock.Record
	for _, r := range suspect {
		// Probe with no credential: what matters is what a stranger can read,
		// not what we can.
		if probeAnonymous(r.URL) == lock.Public {
			r.Visibility = lock.Public
			locks.Put(r)
			changed = true
			continue
		}
		still = append(still, r)
	}
	if len(still) == 0 {
		return changed
	}

	fmt.Fprintf(out, "\nEXPOSURE  this repository is public and holds %d document(s) adopted from\n", len(still))
	fmt.Fprintf(out, "          sources that are not:\n")
	for _, r := range still {
		fmt.Fprintf(out, "            %s\n", r.Path)
	}
	fmt.Fprintf(out, "          Confidentiality does not travel with the copy. This was legitimate\n")
	fmt.Fprintf(out, "          when adopted if this repository was not public then.\n")
	return changed
}