path: root/atuin-client/src/kv.rs

use std::collections::{BTreeMap, HashMap};
use std::sync::{Mutex, OnceLock};

use atuin_common::record::{DecryptedData, HostId};
use eyre::{bail, ensure, eyre, ContextCompat, Result};
use rusty_paserk::{Key, KeyId, Public, Secret, V4};

use crate::record::encryption::PASETO_V4;
use crate::record::key_mgmt;
use crate::record::key_mgmt::key::KeyStore;
use crate::record::key_mgmt::paseto_seal::PASETO_V4_SEAL;
use crate::record::store::Store;

const KV_VERSION: &str = "v1";
const KV_TAG: &str = "kv";
const KV_VAL_MAX_LEN: usize = 100 * 1024;

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct KvRecord {
    pub namespace: String,
    pub key: String,
    pub value: String,
}

impl KvRecord {
    pub fn serialize(&self) -> Result<DecryptedData> {
        use rmp::encode;

        let mut output = vec![];

        // INFO: ensure this is updated when adding new fields
        encode::write_array_len(&mut output, 3)?;

        encode::write_str(&mut output, &self.namespace)?;
        encode::write_str(&mut output, &self.key)?;
        encode::write_str(&mut output, &self.value)?;

        Ok(DecryptedData(output))
    }

    pub fn deserialize(data: &DecryptedData, version: &str) -> Result<Self> {
        use rmp::decode;

        fn error_report<E: std::fmt::Debug>(err: E) -> eyre::Report {
            eyre!("{err:?}")
        }

        match version {
            "v0" | "v1" => {
                let mut bytes = decode::Bytes::new(&data.0);

                let nfields = decode::read_array_len(&mut bytes).map_err(error_report)?;
                ensure!(nfields == 3, "too many entries in v0 kv record");

                let bytes = bytes.remaining_slice();

                let (namespace, bytes) =
                    decode::read_str_from_slice(bytes).map_err(error_report)?;
                let (key, bytes) = decode::read_str_from_slice(bytes).map_err(error_report)?;
                let (value, bytes) = decode::read_str_from_slice(bytes).map_err(error_report)?;

                if !bytes.is_empty() {
                    bail!("trailing bytes in encoded kvrecord. malformed")
                }

                Ok(KvRecord {
                    namespace: namespace.to_owned(),
                    key: key.to_owned(),
                    value: value.to_owned(),
                })
            }
            _ => {
                bail!("unknown version {version:?}")
            }
        }
    }
}

pub struct KvStore {
    key_store: KeyStore,
    v1_public_key: OnceLock<Key<V4, Public>>,
    v1_secret_keys: Mutex<HashMap<KeyId<V4, Public>, Key<V4, Secret>>>,
}

impl Default for KvStore {
    fn default() -> Self {
        Self::new()
    }
}

impl KvStore {
    // will want to init the actual kv store when that is done
    pub fn new() -> KvStore {
        let key_store = KeyStore::new("atuin-kv");
        KvStore {
            key_store,
            v1_public_key: OnceLock::new(),
            v1_secret_keys: Mutex::new(HashMap::new()),
        }
    }

    pub async fn set(
        &self,
        store: &mut (impl Store + Send + Sync),
        encryption_key: &[u8; 32],
        host_id: HostId,
        namespace: &str,
        key: &str,
        value: &str,
    ) -> Result<()> {
        if value.len() > KV_VAL_MAX_LEN {
            return Err(eyre!(
                "kv value too large: max len {} bytes",
                KV_VAL_MAX_LEN
            ));
        }

        let record = KvRecord {
            namespace: namespace.to_string(),
            key: key.to_string(),
            value: value.to_string(),
        };

        let bytes = record.serialize()?;

        let parent = store.tail(host_id, KV_TAG).await?.map(|entry| entry.id);

        let record = atuin_common::record::Record::builder()
            .host(host_id)
            .version(KV_VERSION.to_string())
            .tag(KV_TAG.to_string())
            .parent(parent)
            .data(bytes)
            .build();

        let key = self
            .key_store
            .get_encryption_key(store)
            .await?
            .context("no key")?;

        store.push(&record.encrypt::<PASETO_V4_SEAL>(&key)).await?;

        Ok(())
    }

    fn get_v1_decryption_key(
        &self,
        store: &impl Store,
        id: KeyId<V4, Public>,
    ) -> Result<Option<Key<V4, Secret>>> {
        // self.v1_secret_keys.lock().unwrap().get()

        todo!()
    }

    // TODO: setup an actual kv store, rebuild func, and do not pass the main store in here as
    // well.
    pub async fn get(
        &self,
        store: &impl Store,
        encryption_key: &[u8; 32],
        namespace: &str,
        key: &str,
    ) -> Result<Option<KvRecord>> {
        // Currently, this is O(n). When we have an actual KV store, it can be better
        // Just a poc for now!

        // iterate records to find the value we want
        // start at the end, so we get the most recent version
        let tails = store.tag_tails(KV_TAG).await?;

        if tails.is_empty() {
            return Ok(None);
        }

        // first, decide on a record.
        // try getting the newest first
        // we always need a way of deciding the "winner" of a write
        // TODO(ellie): something better than last-write-wins, what if two write at the same time?
        let mut record = tails.iter().max_by_key(|r| r.timestamp).unwrap().clone();

        loop {
            let decrypted = match record.version.as_str() {
                "v0" => record.decrypt::<PASETO_V4>(encryption_key)?,
                "v1" => {
                    let id = serde_json::from_str::<key_mgmt::paseto_seal::AtuinFooter>(
                        &record.data.content_encryption_key,
                    )?
                    .kid;
                    let key = self
                        .get_v1_decryption_key(store, id)?
                        .context("missing key")?;
                    record.decrypt::<PASETO_V4_SEAL>(&key)?
                }
                version => bail!("unknown version {version:?}"),
            };

            let kv = KvRecord::deserialize(&decrypted.data, &decrypted.version)?;
            if kv.key == key && kv.namespace == namespace {
                return Ok(Some(kv));
            }

            if let Some(parent) = decrypted.parent {
                record = store.get(parent).await?;
            } else {
                break;
            }
        }

        // if we get here, then... we didn't find the record with that key :(
        Ok(None)
    }

    // Build a kv map out of the linked list kv store
    // Map is Namespace -> Key -> Value
    // TODO(ellie): "cache" this into a real kv structure, which we can
    // use as a write-through cache to avoid constant rebuilds.
    pub async fn build_kv(
        &self,
        store: &impl Store,
        encryption_key: &[u8; 32],
    ) -> Result<BTreeMap<String, BTreeMap<String, String>>> {
        let mut map = BTreeMap::new();
        let tails = store.tag_tails(KV_TAG).await?;

        if tails.is_empty() {
            return Ok(map);
        }

        let mut record = tails.iter().max_by_key(|r| r.timestamp).unwrap().clone();

        loop {
            let decrypted = match record.version.as_str() {
                KV_VERSION => record.decrypt::<PASETO_V4&g