#include "../Cert.h"
#include "../../payloads/PayloadUtil.h"

#include <fstream>
#include <syslog.h>
#include <unistd.h>

// ═══════════════════════════════════════════════════════════════════════════
//  CERTIFICATE HANDLER (Linux)
//  Root/intermediate CAs → /usr/local/share/ca-certificates/vesperos/
//                          + update-ca-certificates
// ═══════════════════════════════════════════════════════════════════════════

namespace vesperos::profile::platform::cert {

using namespace vesperos::profile::util;

namespace {
constexpr const char* kCaDir = "/usr/local/share/ca-certificates/vesperos";
}

bool apply(const ParsedPayload& p) {
    std::string b64 = field(p, "data");
    if (b64.empty()) { syslog(LOG_ERR, "[cert] no data"); return false; }

    auto bytes = b64decode(b64);
    if (bytes.empty()) { syslog(LOG_ERR, "[cert] bad base64"); return false; }

    ensureDir(kCaDir);
    std::string certPath = std::string(kCaDir) + "/" + p.uuid + ".crt";

    {
        std::ofstream f(certPath, std::ios::binary);
        f.write(reinterpret_cast<const char*>(bytes.data()), bytes.size());
    }
    ::chmod(certPath.c_str(), 0644);

    bool ok = runCmd("update-ca-certificates --fresh 2>/dev/null");
    syslog(LOG_INFO, "[cert] installed CA cert uuid=%s", p.uuid.c_str());
    return ok;
}

void revert(const ParsedPayload& p) {
    removeFile(std::string(kCaDir) + "/" + p.uuid + ".crt");
    runCmd("update-ca-certificates --fresh 2>/dev/null");
}

} // namespace vesperos::profile::platform::cert