atproto-plc / src / validation.rs

//! Validation logic for operations and operation chains

use crate::crypto::VerifyingKey;
use crate::document::{PlcState, MAX_VERIFICATION_METHODS};
use crate::error::{PlcError, Result};
use crate::operations::Operation;
use chrono::{DateTime, Duration, Utc};

/// Recovery window duration (72 hours)
const RECOVERY_WINDOW_HOURS: i64 = 72;

/// Operation chain validator
pub struct OperationChainValidator;

impl OperationChainValidator {
    /// Validate a complete operation chain and return the final state
    ///
    /// # Errors
    ///
    /// Returns errors if:
    /// - Chain is empty
    /// - First operation is not genesis
    /// - Any operation has invalid prev reference
    /// - Any signature is invalid
    /// - Any operation violates constraints
    pub fn validate_chain(operations: &[Operation]) -> Result<PlcState> {
        if operations.is_empty() {
            return Err(PlcError::EmptyChain);
        }

        // First operation must be genesis
        if !operations[0].is_genesis() {
            return Err(PlcError::FirstOperationNotGenesis);
        }

        let mut current_state = PlcState::new();
        let mut prev_cid: Option<String> = None;

        for (i, operation) in operations.iter().enumerate() {
            // Verify prev field matches expected CID
            if i == 0 {
                // Genesis operation must have prev = None
                if operation.prev().is_some() {
                    return Err(PlcError::InvalidPrev(
                        "Genesis operation must have prev = null".to_string(),
                    ));
                }
            } else {
                // Non-genesis operations must reference previous CID
                let expected_prev = prev_cid.as_ref().ok_or_else(|| {
                    PlcError::ChainValidationFailed("Missing previous CID".to_string())
                })?;

                let actual_prev = operation.prev().ok_or_else(|| {
                    PlcError::InvalidPrev("Non-genesis operation must have prev field".to_string())
                })?;

                if actual_prev != expected_prev {
                    return Err(PlcError::InvalidPrev(format!(
                        "Expected prev = {}, got {}",
                        expected_prev, actual_prev
                    )));
                }
            }

            // Verify signature using current rotation keys
            if !current_state.rotation_keys.is_empty() {
                let verifying_keys: Result<Vec<VerifyingKey>> = current_state
                    .rotation_keys
                    .iter()
                    .map(|k| VerifyingKey::from_did_key(k))
                    .collect();

                let verifying_keys = verifying_keys?;
                operation.verify(&verifying_keys)?;
            } else if i > 0 {
                // After genesis, we must have rotation keys
                return Err(PlcError::InvalidRotationKeys(
                    "No rotation keys available for verification".to_string(),
                ));
            }

            // Apply operation to state
            match operation {
                Operation::PlcOperation {
                    rotation_keys,
                    verification_methods,
                    also_known_as,
                    services,
                    ..
                } => {
                    current_state.rotation_keys = rotation_keys.clone();
                    current_state.verification_methods = verification_methods.clone();
                    current_state.also_known_as = also_known_as.clone();
                    current_state.services = services.clone();

                    // Validate the state
                    current_state.validate()?;
                }
                Operation::PlcTombstone { .. } => {
                    // Tombstone marks the DID as deleted
                    // Clear all state
                    current_state = PlcState::new();
                }
                Operation::LegacyCreate { .. } => {
                    // Legacy create format - convert to modern format
                    // This is for backwards compatibility
                    return Err(PlcError::InvalidOperationType(
                        "Legacy create operations not fully supported".to_string(),
                    ));
                }
            }

            // Update prev CID for next iteration
            prev_cid = Some(operation.cid()?);
        }

        Ok(current_state)
    }

    /// Validate a chain with fork resolution
    ///
    /// This handles the recovery mechanism where operations signed by higher-priority
    /// rotation keys can invalidate later operations if submitted within 72 hours.
    pub fn validate_chain_with_forks(
        operations: &[Operation],
        timestamps: &[DateTime<Utc>],
    ) -> Result<PlcState> {
        if operations.len() != timestamps.len() {
            return Err(PlcError::ChainValidationFailed(
                "Operations and timestamps length mismatch".to_string(),
            ));
        }

        // For now, we do basic validation without fork resolution
        // Full fork resolution would require tracking all possible forks
        // and selecting the canonical chain based on rotation key priority
        Self::validate_chain(operations)
    }

    /// Check if an operation is within the recovery window relative to another operation
    ///
    /// Returns true if the time difference is less than 72 hours
    pub fn is_within_recovery_window(
        fork_timestamp: DateTime<Utc>,
        current_timestamp: DateTime<Utc>,
    ) -> bool {
        let diff = current_timestamp - fork_timestamp;
        diff < Duration::hours(RECOVERY_WINDOW_HOURS) && diff >= Duration::zero()
    }
}

/// Validate rotation keys
///
/// # Errors
///
/// Returns errors if:
/// - Not 1-5 keys
/// - Contains duplicates
/// - Invalid did:key format
/// - Unsupported key type
pub fn validate_rotation_keys(keys: &[String]) -> Result<()> {
    if keys.is_empty() {
        return Err(PlcError::InvalidRotationKeys(
            "At least one rotation key is required".to_string(),
        ));
    }

    if keys.len() > 5 {
        return Err(PlcError::TooManyEntries {
            field: "rotation_keys".to_string(),
            max: 5,
            actual: keys.len(),
        });
    }

    // Check for duplicates
    let mut seen = std::collections::HashSet::new();
    for key in keys {
        if !seen.insert(key) {
            return Err(PlcError::DuplicateEntry {
                field: "rotation_keys".to_string(),
                value: key.clone(),
            });
        }

        // Validate format
        if !key.starts_with("did:key:") {
            return Err(PlcError::InvalidRotationKeys(format!(
                "Rotation key must be in did:key format: {}",
                key
            )));
        }

        // Try to parse to ensure it's valid
        VerifyingKey::from_did_key(key)?;
    }

    Ok(())
}

/// Validate verification methods
///
/// # Errors
///
/// Returns errors if:
/// - More than 10 methods
/// - Invalid did:key format
pub fn validate_verification_methods(
    methods: &std::collections::HashMap<String, String>,
) -> Result<()> {
    if methods.len() > MAX_VERIFICATION_METHODS {
        return Err(PlcError::TooManyEntries {
            field: "verification_methods".to_string(),
            max: MAX_VERIFICATION_METHODS,
            actual: methods.len(),
        });
    }

    for (name, key) in methods {
        if !key.starts_with("did:key:") {
            return Err(PlcError::InvalidVerificationMethods(format!(
                "Verification method '{}' must be in did:key format: {}",
                name, key
            )));
        }

        // Try to parse to ensure it's valid
        VerifyingKey::from_did_key(key)?;
    }

    Ok(())
}

/// Validate also-known-as URIs
///
/// # Errors
///
/// Returns errors if any URI is invalid
pub fn validate_also_known_as(uris: &[String]) -> Result<()> {
    for uri in uris {
        if uri.is_empty() {
            return Err(PlcError::InvalidAlsoKnownAs(
                "URI cannot be empty".to_string(),
            ));
        }

        // Basic URI validation - should start with a scheme
        if !uri.contains(':') {
            return Err(PlcError::InvalidAlsoKnownAs(format!(
                "URI must contain a scheme: {}",
                uri
            )));
        }
    }

    Ok(())
}

/// Validate service endpoints
///
/// # Errors
///
/// Returns errors if any service is invalid
pub fn validate_services(
    services: &std::collections::HashMap<String, crate::document::ServiceEndpoint>,
) -> Result<()> {
    for (name, service) in services {
        if name.is_empty() {
            return Err(PlcError::InvalidService(
                "Service name cannot be empty".to_string(),
            ));
        }

        service.validate()?;
    }

    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::crypto::SigningKey;
    use crate::document::ServiceEndpoint;
    use std::collections::HashMap;

    #[test]
    fn test_validate_rotation_keys() {
        let key1 = SigningKey::generate_p256();
        let key2 = SigningKey::generate_k256();

        let keys = vec![key1.to_did_key(), key2.to_did_key()];
        assert!(validate_rotation_keys(&keys).is_ok());

        // Empty keys
        assert!(validate_rotation_keys(&[]).is_err());

        // Too many keys
        let many_keys: Vec<String> = (0..6).map(|_| SigningKey::generate_p256().to_did_key()).collect();
        assert!(validate_rotation_keys(&many_keys).is_err());

        // Duplicate keys
        let dup_key = key1.to_did_key();
        let dup_keys = vec![dup_key.clone(), dup_key];
        assert!(validate_rotation_keys(&dup_keys).is_err());
    }

    #[test]
    fn test_validate_verification_methods() {
        let mut methods = HashMap::new();
        let key = SigningKey::generate_p256();
        methods.insert("atproto".to_string(), key.to_did_key());

        assert!(validate_verification_methods(&methods).is_ok());

        // Too many methods
        let mut many_methods = HashMap::new();
        for i in 0..11 {
            let key = SigningKey::generate_p256();
            many_methods.insert(format!("key{}", i), key.to_did_key());
        }
        assert!(validate_verification_methods(&many_methods).is_err());
    }

    #[test]
    fn test_validate_also_known_as() {
        let uris = vec![
            "at://alice.example.com".to_string(),
            "https://example.com".to_string(),
        ];
        assert!(validate_also_known_as(&uris).is_ok());

        // Empty URI
        assert!(validate_also_known_as(&[String::new()]).is_err());

        // Invalid URI (no scheme)
        assert!(validate_also_known_as(&["not-a-uri".to_string()]).is_err());
    }

    #[test]
    fn test_recovery_window() {
        let base = Utc::now();
        let within = base + Duration::hours(24);
        let outside = base + Duration::hours(100);

        assert!(OperationChainValidator::is_within_recovery_window(base, within));
        assert!(!OperationChainValidator::is_within_recovery_window(base, outside));
    }

    #[test]
    fn test_validate_chain_genesis() {
        let key = SigningKey::generate_p256();
        let did_key = key.to_did_key();

        let unsigned = Operation::new_genesis(
            vec![did_key],
            HashMap::new(),
            vec![],
            HashMap::new(),
        );

        let signed = unsigned.sign(&key).unwrap();

        // Single genesis operation should validate
        let state = OperationChainValidator::validate_chain(&[signed]).unwrap();
        assert_eq!(state.rotation_keys.len(), 1);
    }

    #[test]
    fn test_validate_chain_empty() {
        assert!(OperationChainValidator::validate_chain(&[]).is_err());
    }
}