package replica

import (
	"fmt"
	"strings"

	"golang.org/x/crypto/ssh"
)

func ParseAllowedSigners(data []byte) ([]ssh.PublicKey, error) {
	var keys []ssh.PublicKey
	for n, line := range strings.Split(string(data), "\n") {
		line = strings.TrimSpace(line)
		if line == "" || strings.HasPrefix(line, "#") {
			continue
		}
		i := strings.IndexAny(line, " \t")
		if i < 0 {
			return nil, fmt.Errorf("replica: allowed signers line %d: no key", n+1)
		}
		key, _, options, _, err := ssh.ParseAuthorizedKey([]byte(strings.TrimSpace(line[i:])))
		if err != nil {
			return nil, fmt.Errorf("replica: allowed signers line %d: %w", n+1, err)
		}
		if signsGit(options) {
			keys = append(keys, key)
		}
	}
	if len(keys) == 0 {
		return nil, ErrNoAllowedKeys
	}
	return keys, nil
}

func signsGit(options []string) bool {
	for _, o := range options {
		if o == "cert-authority" {
			return false
		}
		if v, ok := strings.CutPrefix(o, "namespaces="); ok {
			for _, ns := range strings.Split(strings.Trim(v, `"`), ",") {
				if ns == Namespace {
					return true
				}
			}
			return false
		}
	}
	return true
}