/*
|--------------------------------------------------------------------------
| Key
|--------------------------------------------------------------------------
|
| Name:
|   - Key
|
| Purpose:
|   - Generate cryptographic key material through a type-driven dispatch
|     model with strict validation, schema isolation, and centralized
|     orchestration.
|
| Guidelines:
|   - Validate all inputs before generation.
|   - Enforce strict schema isolation.
|   - Reject unsupported configuration fields.
|   - Prevent key exposure on failure paths.
|   - Return standardized responses.
|
| Examples:
|   - ObrimKey("symmetric", map[string]any{
|       "algorithm": "aes",
|       "key_size": 256,
|     })
|
|   - ObrimKey("asymmetric", map[string]any{
|       "algorithm": "ecc",
|     })
|
|--------------------------------------------------------------------------
*/

/*
|--------------------------------------------------------------------------
| Credit
|--------------------------------------------------------------------------
|
| Contributor:
|   - Rajon Ahmed
|   - Scionite
|
|--------------------------------------------------------------------------
*/

package key

import (
	"crypto/aes"
	"crypto/ed25519"
	"crypto/rand"
	"encoding/base64"
	"strings"
	"time"

	"go/module/essential/visible/service/helper/log"
	"go/module/essential/visible/service/helper/retriever"
	"go/module/essential/visible/service/helper/status"
)

// Function Name: ObrimKey
// Function Purpose: Dispatch key generation requests and orchestrate validation, generation, and response construction.
func ObrimKey(keyType string, config map[string]any) map[string]any {
	log.ObrimLog("INIT", "Key generation request received.")

	if result := obrimKeyValidate(keyType, config); result != nil {
		return result
	}

	result := obrimKeyDispatch(keyType, config)

	if statusValue, ok := result["status"].(bool); ok && statusValue {
		status.ObrimStatus("SUCCESS", "Key generation completed.")
		log.ObrimLog("SUCCESS", "Key generation completed successfully.")
		return result
	}

	status.ObrimStatus("ERROR", "Key generation failed.")
	log.ObrimLog("ERROR", "Key generation failed.")

	return result
}

// Function Name: obrimKeyValidate
// Function Purpose: Validate common request structure and schema integrity.
func obrimKeyValidate(keyType string, config map[string]any) map[string]any {
	log.ObrimLog("VALIDATION", "Validating key request.")

	if strings.TrimSpace(keyType) == "" {
		return obrimKeyBuildError("FAILED_TYPE_REQUIRED")
	}

	if config == nil {
		return obrimKeyBuildError("FAILED_CONFIG_REQUIRED")
	}

	normalizedType := strings.ToLower(strings.TrimSpace(keyType))

	switch normalizedType {
	case "symmetric":
		return obrimKeyValidateSymmetricConfig(config)

	case "asymmetric":
		return obrimKeyValidateAsymmetricConfig(config)

	default:
		return obrimKeyBuildError("FAILED_UNSUPPORTED_TYPE")
	}
}

// Function Name: obrimKeyDispatch
// Function Purpose: Route execution to the appropriate cryptographic workflow.
func obrimKeyDispatch(keyType string, config map[string]any) map[string]any {
	normalizedType := strings.ToLower(strings.TrimSpace(keyType))

	switch normalizedType {
	case "symmetric":
		return obrimKeyGenerateSymmetric(config)

	case "asymmetric":
		return obrimKeyGenerateAsymmetric(config)

	default:
		return obrimKeyBuildError("FAILED_UNSUPPORTED_TYPE")
	}
}

// Function Name: obrimKeyValidateSymmetricConfig
// Function Purpose: Validate symmetric configuration values.
func obrimKeyValidateSymmetricConfig(config map[string]any) map[string]any {
	if len(config) != 2 {
		return obrimKeyBuildError("FAILED_INVALID_CONFIGURATION")
	}

	// Logic:
	for key := range config {
		if key != "algorithm" && key != "key_size" {
			return obrimKeyBuildError("FAILED_UNSUPPORTED_CONFIGURATION_FIELD")
		}
	}

	algorithmValue, exists := config["algorithm"]
	if !exists {
		return obrimKeyBuildError("FAILED_ALGORITHM_REQUIRED")
	}

	algorithm, ok := algorithmValue.(string)
	if !ok {
		return obrimKeyBuildError("FAILED_INVALID_ALGORITHM")
	}

	if strings.ToLower(strings.TrimSpace(algorithm)) != "aes" {
		return obrimKeyBuildError("FAILED_UNSUPPORTED_ALGORITHM")
	}

	keySizeValue, exists := config["key_size"]
	if !exists {
		return obrimKeyBuildError("FAILED_KEY_SIZE_REQUIRED")
	}

	var keySize int

	switch value := keySizeValue.(type) {
	case int:
		keySize = value
	case int32:
		keySize = int(value)
	case int64:
		keySize = int(value)
	case float64:
		keySize = int(value)
	default:
		return obrimKeyBuildError("FAILED_INVALID_KEY_SIZE")
	}

	switch keySize {
	case 128, 192, 256:
		return nil
	default:
		return obrimKeyBuildError("FAILED_UNSUPPORTED_KEY_SIZE")
	}
}

// Function Name: obrimKeyValidateAsymmetricConfig
// Function Purpose: Validate asymmetric configuration values.
func obrimKeyValidateAsymmetricConfig(config map[string]any) map[string]any {
	if len(config) != 1 {
		return obrimKeyBuildError("FAILED_INVALID_CONFIGURATION")
	}

	// Logic:
	for key := range config {
		if key != "algorithm" {
			return obrimKeyBuildError("FAILED_UNSUPPORTED_CONFIGURATION_FIELD")
		}
	}

	algorithmValue, exists := config["algorithm"]
	if !exists {
		return obrimKeyBuildError("FAILED_ALGORITHM_REQUIRED")
	}

	algorithm, ok := algorithmValue.(string)
	if !ok {
		return obrimKeyBuildError("FAILED_INVALID_ALGORITHM")
	}

	if strings.ToLower(strings.TrimSpace(algorithm)) != "ecc" {
		return obrimKeyBuildError("FAILED_UNSUPPORTED_ALGORITHM")
	}

	return nil
}

// Function Name: obrimKeyGenerateSymmetric
// Function Purpose: Generate symmetric key material.
func obrimKeyGenerateSymmetric(config map[string]any) map[string]any {
	normalizedConfig := obrimKeyNormalizeSymmetricConfig(config)

	payload, err := obrimKeyGenerateAES(normalizedConfig)
	if err != nil {
		log.ObrimLog("ERROR", "AES key generation failed.")
		return obrimKeyBuildError("FAILED_GENERATION")
	}

	return map[string]any{
		"status": true,
		"code":   "SUCCESS_KEY_GENERATED",
		"payload": obrimKeyBuildPayload(
			payload,
		),
	}
}

// Function Name: obrimKeyGenerateAES
// Function Purpose: Generate AES key material.
func obrimKeyGenerateAES(config map[string]any) (map[string]any, error) {
	keySize := config["key_size"].(int)

	// Logic:
	keyMaterial := make([]byte, keySize/8)

	if _, err := rand.Read(keyMaterial); err != nil {
		return nil, err
	}

	if _, err := aes.NewCipher(keyMaterial); err != nil {
		return nil, err
	}

	// Logic:
	generatedAt := time.Now().UTC().Format(time.RFC3339)

	return map[string]any{
		"type":         "symmetric",
		"algorithm":    "aes",
		"key_size":     keySize,
		"key_material": base64.StdEncoding.EncodeToString(keyMaterial),
		"generated_at": generatedAt,
	}, nil
}

// Function Name: obrimKeyNormalizeSymmetricConfig
// Function Purpose: Normalize symmetric configuration values.
func obrimKeyNormalizeSymmetricConfig(config map[string]any) map[string]any {
	// Mutable Variable Purpose: Store normalized configuration.
	normalized := make(map[string]any)

	normalized["algorithm"] = strings.ToLower(strings.TrimSpace(config["algorithm"].(string)))

	switch value := config["key_size"].(type) {
	case int:
		normalized["key_size"] = value
	case int32:
		normalized["key_size"] = int(value)
	case int64:
		normalized["key_size"] = int(value)
	case float64:
		normalized["key_size"] = int(value)
	}

	return normalized
}

// Function Name: obrimKeyGenerateAsymmetric
// Function Purpose: Generate asymmetric key material.
func obrimKeyGenerateAsymmetric(config map[string]any) map[string]any {
	normalizedConfig := obrimKeyNormalizeAsymmetricConfig(config)

	payload, err := obrimKeyGenerateECC(normalizedConfig)
	if err != nil {
		log.ObrimLog("ERROR", "ECC key generation failed.")
		return obrimKeyBuildError("FAILED_GENERATION")
	}

	return map[string]any{
		"status": true,
		"code":   "SUCCESS_KEY_GENERATED",
		"payload": obrimKeyBuildPayload(
			payload,
		),
	}
}

// Function Name: obrimKeyGenerateECC
// Function Purpose: Generate ECC key pair material.
func obrimKeyGenerateECC(config map[string]any) (map[string]any, error) {
	_, _ = retriever.ObrimRetriever(
		"json",
		map[string]any{
			"resource": "application/metadata",
			"path":     "application.lower",
		},
	)

	publicKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		return nil, err
	}

	// Logic:
	generatedAt := time.Now().UTC().Format(time.RFC3339)

	return map[string]any{
		"type":         "asymmetric",
		"algorithm":    "ecc",
		"curve":        "eddsa",
		"public_key":   base64.StdEncoding.EncodeToString(publicKey),
		"private_key":  base64.StdEncoding.EncodeToString(privateKey),
		"generated_at": generatedAt,
	}, nil
}

// Function Name: obrimKeyNormalizeAsymmetricConfig
// Function Purpose: Normalize asymmetric configuration values.
func obrimKeyNormalizeAsymmetricConfig(config map[string]any) map[string]any {
	// Mutable Variable Purpose: Store normalized configuration.
	normalized := make(map[string]any)

	normalized["algorithm"] = strings.ToLower(strings.TrimSpace(config["algorithm"].(string)))

	return normalized
}

// Function Name: obrimKeyBuildPayload
// Function Purpose: Construct standardized success payloads.
func obrimKeyBuildPayload(payload map[string]any) map[string]any {
	return payload
}

// Function Name: obrimKeyBuildError
// Function Purpose: Construct standardized error responses.
func obrimKeyBuildError(code string) map[string]any {
	return map[string]any{
		"status":  false,
		"code":    code,
		"payload": nil,
	}
}