use std::collections::BTreeMap;
use std::path::{Path, PathBuf};

use anyhow::{Context, Result};
use clusterflux_core::{
    generate_ed25519_private_key, node_ed25519_public_key_from_private_key, sign_node_request,
    signed_request_payload_digest, Capability, Digest, EnvironmentBackend, NodeCapabilities,
    NodeId,
};
use serde::Serialize;
use serde_json::{json, Value};

use crate::client::{authenticated_or_local_trusted_request, JsonLineSession};
use crate::config::{effective_scope_value, read_cli_session, StoredCliSession};
use crate::tools::{command_available, command_nonce, unix_timestamp_seconds};
use crate::{
    confirmation_required_report, AttachArgs, CliScopeArgs, NodeEnrollArgs, NodeListArgs,
    NodeRevokeArgs, NodeStatusArgs,
};

#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
pub(crate) struct NodeAttachPlan {
    pub(crate) node: String,
    pub(crate) coordinator: Option<String>,
    pub(crate) capabilities: NodeCapabilities,
    pub(crate) detection: NodeAttachDetectionEvidence,
    pub(crate) grant_disclosures: Vec<CapabilityGrantDisclosure>,
    pub(crate) enrollment: Option<NodeEnrollmentPlan>,
}

#[derive(Clone, Debug, PartialEq, Serialize)]
pub(crate) struct NodeAttachReport {
    pub(crate) command: String,
    pub(crate) node: String,
    pub(crate) plan: NodeAttachPlan,
    pub(crate) grant_disclosures: Vec<CapabilityGrantDisclosure>,
    pub(crate) boundary: NodeAttachBoundaryEvidence,
    pub(crate) coordinator_response: Value,
    pub(crate) heartbeat_response: Value,
    pub(crate) capability_response: Value,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
pub(crate) struct NodeAttachBoundaryEvidence {
    pub(crate) cli_contacted_coordinator: bool,
    pub(crate) coordinator_address: String,
    pub(crate) used_enrollment_exchange: bool,
    pub(crate) coordinator_session_requests: u64,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
pub(crate) struct CapabilityGrantDisclosure {
    pub(crate) capability: Capability,
    pub(crate) grant: String,
    pub(crate) description: String,
    pub(crate) risk: String,
    pub(crate) coordinator_policy_limited: bool,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
pub(crate) struct NodeAttachDetectionEvidence {
    pub(crate) auto_detected: bool,
    pub(crate) os: clusterflux_core::Os,
    pub(crate) arch: String,
    pub(crate) command_backend: String,
    pub(crate) command_backend_available: bool,
    pub(crate) container_backend: Option<String>,
    pub(crate) container_backend_reported: bool,
    pub(crate) container_backend_available: bool,
    pub(crate) source_provider_backends: Vec<SourceProviderBackendStatus>,
    pub(crate) manual_capability_overrides_allowed: bool,
    pub(crate) manual_capability_overrides: Vec<String>,
    pub(crate) recognized_capability_overrides: Vec<Capability>,
    pub(crate) unrecognized_capability_overrides: Vec<String>,
    pub(crate) os_arch_capabilities_require_manual_flags: bool,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
pub(crate) struct SourceProviderBackendStatus {
    pub(crate) provider: String,
    pub(crate) detected: bool,
    pub(crate) available: bool,
    pub(crate) reason: String,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
pub(crate) struct NodeEnrollmentPlan {
    pub(crate) grant: String,
    pub(crate) public_key_fingerprint: Digest,
    pub(crate) exchanges_short_lived_grant_for_long_lived_node_identity: bool,
}

#[derive(Clone, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
struct StoredNodeCredential {
    kind: String,
    node: String,
    private_key: String,
    public_key: String,
    credential_scope: String,
}

pub(crate) fn node_enroll_report(args: NodeEnrollArgs, cwd: PathBuf) -> Result<Value> {
    let stored_session = read_cli_session(&cwd)?;
    let coordinator = args.scope.coordinator.clone().or_else(|| {
        stored_session
            .as_ref()
            .map(|session| session.coordinator.clone())
    });
    if let Some(coordinator) = &coordinator {
        let tenant = session_or_effective_scope_value(
            stored_session.as_ref(),
            &args.scope.tenant,
            |session| session.tenant.as_str(),
            "tenant",
        );
        let project = session_or_effective_scope_value(
            stored_session.as_ref(),
            &args.scope.project,
            |session| session.project.as_str(),
            "project",
        );
        let user = session_or_effective_scope_value(
            stored_session.as_ref(),
            &args.scope.user,
            |session| session.user.as_str(),
            "user",
        );
        let ttl_seconds = args.ttl_seconds;
        let mut session = JsonLineSession::connect(coordinator)?;
        let request = authenticated_or_local_trusted_request(
            coordinator,
            stored_session.as_ref(),
            json!({
                "type": "create_node_enrollment_grant",
                "ttl_seconds": ttl_seconds,
            }),
            json!({
                "type": "create_node_enrollment_grant",
                "tenant": tenant.clone(),
                "project": project.clone(),
                "actor_user": user.clone(),
                "ttl_seconds": ttl_seconds,
            }),
        )?;
        let response = session.request(request)?;
        let enrollment_grant =
            node_enrollment_grant_summary(&response, &tenant, &project, &user, ttl_seconds)?;
        return Ok(json!({
            "command": "node enroll",
            "status": "created",
            "coordinator": coordinator,
            "tenant": tenant,
            "project": project,
            "user": user,
            "private_website_required": false,
            "enrollment_grant": enrollment_grant,
            "response": response,
            "coordinator_session_requests": session.requests(),
        }));
    }
    Ok(json!({
        "command": "node enroll",
        "status": "requires_coordinator",
        "private_website_required": false,
        "requested_ttl_seconds": args.ttl_seconds,
        "enrollment_grant": null,
        "reason": "enrollment grants are generated by the coordinator and cannot be planned client-side",
    }))
}

fn node_enrollment_grant_summary(
    response: &Value,
    tenant: &str,
    project: &str,
    user: &str,
    ttl_seconds: u64,
) -> Result<Value> {
    let grant = response
        .get("grant")
        .and_then(Value::as_str)
        .context("coordinator did not return its generated enrollment grant")?;
    Ok(json!({
        "grant": grant,
        "tenant": response
            .get("tenant")
            .cloned()
            .unwrap_or_else(|| json!(tenant)),
        "project": response
            .get("project")
            .cloned()
            .unwrap_or_else(|| json!(project)),
        "user": user,
        "scope": response
            .get("scope")
            .cloned()
            .unwrap_or_else(|| json!("node:attach")),
        "ttl_seconds": ttl_seconds,
        "expires_at_epoch_seconds": response
            .get("expires_at_epoch_seconds")
            .cloned()
            .unwrap_or(Value::Null),
        "short_lived": true,
        "exchange_for_persistent_node_identity": true,
        "node_credentials_separate_from_user_session": true,
    }))
}

pub(crate) fn node_list_report(args: NodeListArgs, cwd: PathBuf) -> Result<Value> {
    node_descriptors_report("node list", args.scope, None, cwd)
}

pub(crate) fn node_status_report(args: NodeStatusArgs, cwd: PathBuf) -> Result<Value> {
    node_descriptors_report("node status", args.scope, args.node, cwd)
}

fn node_descriptors_report(
    command: &str,
    scope: CliScopeArgs,
    node: Option<String>,
    cwd: PathBuf,
) -> Result<Value> {
    let stored_session = read_cli_session(&cwd)?;
    let coordinator = scope.coordinator.clone().or_else(|| {
        stored_session
            .as_ref()
            .map(|session| session.coordinator.clone())
    });
    if let Some(coordinator) = &coordinator {
        let tenant = session_or_effective_scope_value(
            stored_session.as_ref(),
            &scope.tenant,
            |session| session.tenant.as_str(),
            "tenant",
        );
        let project = session_or_effective_scope_value(
            stored_session.as_ref(),
            &scope.project,
            |session| session.project.as_str(),
            "project",
        );
        let user = session_or_effective_scope_value(
            stored_session.as_ref(),
            &scope.user,
            |session| session.user.as_str(),
            "user",
        );
        let mut session = JsonLineSession::connect(coordinator)?;
        let request = authenticated_or_local_trusted_request(
            coordinator,
            stored_session.as_ref(),
            json!({
                "type": "list_node_descriptors",
            }),
            json!({
                "type": "list_node_descriptors",
                "tenant": tenant.clone(),
                "project": project.clone(),
                "actor_user": user.clone(),
            }),
        )?;
        let response = session.request(request)?;
        return Ok(json!({
            "command": command,
            "coordinator": coordinator,
            "node": node,
            "response": response,
            "coordinator_session_requests": session.requests(),
        }));
    }
    Ok(json!({
        "command": command,
        "status": "local_capability_snapshot",
        "node": node.unwrap_or_else(default_node_id),
        "capabilities": NodeCapabilities::detect_current(),
    }))
}

pub(crate) fn node_revoke_report(args: NodeRevokeArgs, cwd: PathBuf) -> Result<Value> {
    if !args.yes {
        return Ok(confirmation_required_report(
            "node revoke",
            "revoke_node_credential",
            json!({
                "coordinator": args.scope.coordinator,
                "tenant": args.scope.tenant,
                "project": args.scope.project,
                "user": args.scope.user,
                "node": args.node,
            }),
            format!("clusterflux node revoke --node {} --yes", args.node),
        ));
    }
    let stored_session = read_cli_session(&cwd)?;
    let coordinator = args.scope.coordinator.clone().or_else(|| {
        stored_session
            .as_ref()
            .map(|session| session.coordinator.clone())
    });
    if let Some(coordinator) = &coordinator {
        let tenant = session_or_effective_scope_value(
            stored_session.as_ref(),
            &args.scope.tenant,
            |session| session.tenant.as_str(),
            "tenant",
        );
        let project = session_or_effective_scope_value(
            stored_session.as_ref(),
            &args.scope.project,
            |session| session.project.as_str(),
            "project",
        );
        let user = session_or_effective_scope_value(
            stored_session.as_ref(),
            &args.scope.user,
            |session| session.user.as_str(),
            "user",
        );
        let node = args.node.clone();
        let mut session = JsonLineSession::connect(coordinator)?;
        let request = authenticated_or_local_trusted_request(
            coordinator,
            stored_session.as_ref(),
            json!({
                "type": "revoke_node_credential",
                "node": node.clone(),
            }),
            json!({
                "type": "revoke_node_credential",
                "tenant": tenant.clone(),
                "project": project.clone(),
                "actor_user": user.clone(),
                "node": node.clone(),
            }),
        )?;
        let response = session.request(request)?;
        return Ok(json!({
            "command": "node revoke",
            "coordinator": coordinator,
            "requires_confirmation": !args.yes,
            "tenant": tenant,
            "project": project,
            "user": user,
            "node": node,
            "credential_revoked": response.get("type").and_then(Value::as_str) == Some("node_credential_revoked"),
            "descriptor_removed": response
                .get("descriptor_removed")
                .cloned()
                .unwrap_or(json!(false)),
            "queued_assignments_removed": response
                .get("queued_assignments_removed")
                .cloned()
                .unwrap_or_else(|| json!(0)),
            "node_credentials_separate_from_user_session": true,
            "response": response,
            "coordinator_session_requests": session.requests(),
        }));
    }
    Ok(json!({
        "command": "node revoke",
        "status": "requires_coordinator",
        "requires_confirmation": !args.yes,
        "node": args.node,
    }))
}

fn session_or_effective_scope_value(
    stored_session: Option<&StoredCliSession>,
    cli_value: &str,
    session_value: impl FnOnce(&StoredCliSession) -> &str,
    default_value: &str,
) -> String {
    if let Some(session) = stored_session.filter(|session| session.session_secret.is_some()) {
        session_value(session).to_owned()
    } else {
        effective_scope_value(cli_value, stored_session.map(session_value), default_value)
    }
}

pub(crate) fn attach_plan(args: AttachArgs) -> NodeAttachPlan {
    let mut capabilities = NodeCapabilities::detect_current();
    let mut recognized_capability_overrides = Vec::new();
    let mut unrecognized_capability_overrides = Vec::new();
    for cap in &args.caps {
        if let Some(parsed) = parse_capability(cap) {
            recognized_capability_overrides.push(parsed.clone());
            capabilities.capabilities.insert(parsed);
        } else {
            unrecognized_capability_overrides.push(cap.clone());
        }
    }
    recognized_capability_overrides.sort();
    recognized_capability_overrides.dedup();
    let node = args.node.unwrap_or_else(default_node_id);
    let public_key = args
        .public_key
        .unwrap_or_else(|| default_node_public_key_for_plan(&node));
    let enrollment = args.enrollment_grant.map(|grant| NodeEnrollmentPlan {
        grant,
        public_key_fingerprint: Digest::sha256(public_key),
        exchanges_short_lived_grant_for_long_lived_node_identity: true,
    });
    let detection = node_attach_detection_evidence(
        &capabilities,
        args.caps,
        recognized_capability_overrides,
        unrecognized_capability_overrides,
    );
    let grant_disclosures = capability_grant_disclosures(&capabilities);

    NodeAttachPlan {
        node,
        coordinator: args.coordinator,
        capabilities,
        detection,
        grant_disclosures,
        enrollment,
    }
}

fn node_attach_detection_evidence(
    capabilities: &NodeCapabilities,
    manual_capability_overrides: Vec<String>,
    recognized_capability_overrides: Vec<Capability>,
    unrecognized_capability_overrides: Vec<String>,
) -> NodeAttachDetectionEvidence {
    let command_backend_available = capabilities.capabilities.contains(&Capability::Command);
    let container_backend_reported = capabilities
        .environment_backends
        .contains(&EnvironmentBackend::Container);
    let container_backend = container_backend_reported.then(|| "rootless-podman".to_owned());
    let container_backend_available = container_backend_reported
        && capabilities
            .capabilities
            .contains(&Capability::RootlessPodman)
        && command_available("podman");

    NodeAttachDetectionEvidence {
        auto_detected: true,
        os: capabilities.os.clone(),
        arch: capabilities.arch.clone(),
        command_backend: if command_backend_available {
            "native-command".to_owned()
        } else {
            "unavailable".to_owned()
        },
        command_backend_available,
        container_backend,
        container_backend_reported,
        container_backend_available,
        source_provider_backends: source_provider_backend_statuses(capabilities),
        manual_capability_overrides_allowed: true,
        manual_capability_overrides,
        recognized_capability_overrides,
        unrecognized_capability_overrides,
        os_arch_capabilities_require_manual_flags: false,
    }
}

fn source_provider_backend_statuses(
    capabilities: &NodeCapabilities,
) -> Vec<SourceProviderBackendStatus> {
    let mut statuses = BTreeMap::new();
    for provider in &capabilities.source_providers {
        let available = match provider.as_str() {
            "filesystem" => capabilities
                .capabilities
                .contains(&Capability::SourceFilesystem),
            "git" => command_available("git"),
            _ => true,
        };
        statuses.insert(
            provider.clone(),
            SourceProviderBackendStatus {
                provider: provider.clone(),
                detected: true,
                available,
                reason: if available {
                    "detected by local node capability probe".to_owned()
                } else {
                    format!(
                        "source provider `{provider}` was detected but its local helper is missing"
                    )
                },
            },
        );
    }
    statuses.into_values().collect()
}

fn capability_grant_disclosures(capabilities: &NodeCapabilities) -> Vec<CapabilityGrantDisclosure> {
    let mut disclosures = Vec::new();
    let mut push = |capability: Capability, grant: &str, description: &str, risk: &str| {
        if capabilities.capabilities.contains(&capability) {
            disclosures.push(CapabilityGrantDisclosure {
                capability,
                grant: grant.to_owned(),
                description: description.to_owned(),
                risk: risk.to_owned(),
                coordinator_policy_limited: true,
            });
        }
    };

    push(
        Capability::Command,
        "native_command_execution",
        "placed tasks may run native commands on this node",
        "local process execution under the node account",
    );
    push(
        Capability::WindowsCommandDev,
        "native_command_execution",
        "placed tasks may run Windows developer commands on this node",
        "local process execution under the node account",
    );
    push(
        Capability::SourceFilesystem,
        "source_access",
        "placed tasks may read the local project/source checkout exposed by this node",
        "broad local source visibility",
    );
    push(
        Capability::SourceGit,
        "source_access",
        "placed tasks may use Git-backed source access exposed by this node",
        "source-provider visibility",
    );
    push(
        Capability::Network,
        "network_access",
        "placed tasks may use outbound network access from this node",
        "network egress from the node environment",
    );
    push(
        Capability::HostFilesystem,
        "host_filesystem_access",
        "placed tasks may access configured host filesystem mounts",
        "host file visibility outside the project checkout",
    );
    push(
        Capability::Secrets,
        "secret_access",
        "placed tasks may receive configured secret material",
        "secret exposure to authorized task code",
    );
    push(
        Capability::InboundPorts,
        "inbound_ports",
        "placed tasks may expose inbound ports from this node",
        "network service exposure from the node environment",
    );
    push(
        Capability::ArbitrarySyscalls,
        "arbitrary_syscalls",
        "placed tasks may use broader host syscall surface",
        "reduced host isolation",
    );

    disclosures.sort_by(|left, right| {
        left.grant
            .cmp(&right.grant)
            .then_with(|| left.capability.cmp(&right.capability))
    });
    disclosures
}

pub(crate) fn execute_node_attach(args: AttachArgs) -> Result<NodeAttachReport> {
    let coordinator = args
        .coordinator
        .clone()
        .context("node attach execution requires --coordinator")?;
    let tenant = args.tenant.clone();
    let project = args.project.clone();
    let node = args.node.clone().unwrap_or_else(default_node_id);
    let node_private_key = node_private_key_for_attach(&node)?;
    let derived_public_key =
        node_ed25519_public_key_from_private_key(&node_private_key).map_err(anyhow::Error::msg)?;
    let public_key = args
        .public_key
        .clone()
        .unwrap_or(derived_public_key.clone());
    if public_key != derived_public_key {
        anyhow::bail!(
            "node attach --public-key must match CLUSTERFLUX_NODE_PRIVATE_KEY or the stored local node credential"
        );
    }
    let mut plan = attach_plan(args);
    if let Some(enrollment) = &mut plan.enrollment {
        enrollment.public_key_fingerprint = Digest::sha256(&public_key);
    }

    let mut session = JsonLineSession::connect(&coordinator)?;
    let used_enrollment_exchange = plan.enrollment.is_some();
    let coordinator_response = if let Some(enrollment) = &plan.enrollment {
        session.request(json!({
            "type": "exchange_node_enrollment_grant",
            "tenant": &tenant,
            "project": &project,
            "node": &node,
            "public_key": &public_key,
            "enrollment_grant": enrollment.grant,
        }))?
    } else {
        session.request(json!({
            "type": "attach_node",
            "tenant": &tenant,
            "project": &project,
            "node": &node,
            "public_key": &public_key,
        }))?
    };
    let heartbeat_request = json!({
        "type": "node_heartbeat",
        "node": &plan.node,
    });
    let heartbeat_signature = sign_node_request(
        &node_private_key,
        &NodeId::from(plan.node.as_str()),
        "node_heartbeat",
        &signed_request_payload_digest(&heartbeat_request),
        command_nonce("node-heartbeat"),
        unix_timestamp_seconds(),
    )
    .map_err(anyhow::Error::msg)?;
    let mut heartbeat_request = heartbeat_request;
    heartbeat_request["node_signature"] = json!(heartbeat_signature);
    let heartbeat_response = session.request(heartbeat_request)?;
    let capability_response = session.request(signed_node_request_json(
        &node_private_key,
        &plan.node,
        "report_node_capabilities",
        json!({
        "type": "report_node_capabilities",
        "tenant": &tenant,
        "project": &project,
        "node": &plan.node,
        "capabilities": &plan.capabilities,
        "cached_environment_digests": [],
        "dependency_cache_digests": [],
        "source_snapshots": [],
        "artifact_locations": [],
        "direct_connectivity": true,
        "online": false,
        }),
    )?)?;

    Ok(NodeAttachReport {
        command: "node attach".to_owned(),
        node: plan.node.clone(),
        grant_disclosures: plan.grant_disclosures.clone(),
        plan,
        boundary: NodeAttachBoundaryEvidence {
            cli_contacted_coordinator: true,
            coordinator_address: coordinator,
            used_enrollment_exchange,
            coordinator_session_requests: session.requests(),
        },
        coordinator_response,
        heartbeat_response,
        capability_response,
    })
}

fn node_private_key_for_attach(node: &str) -> Result<String> {
    if let Ok(private_key) = std::env::var("CLUSTERFLUX_NODE_PRIVATE_KEY") {
        return Ok(private_key);
    }
    load_or_create_local_node_credential(&std::env::current_dir()?, node)
}

pub(crate) fn load_or_create_local_node_credential(project: &Path, node: &str) -> Result<String> {
    let file = local_node_credential_file(project, node);
    if credential_file_exists_without_symlink(&file)? {
        let bytes =
            std::fs::read(&file).with_context(|| format!("failed to read {}", file.display()))?;
        let credential: StoredNodeCredential = serde_json::from_slice(&bytes)
            .with_context(|| format!("failed to parse {}", file.display()))?;
        if credential.node != node {
            anyhow::bail!(
                "stored node credential {} belongs to node `{}` instead of `{}`",
                file.display(),
                credential.node,
                node
            );
        }
        let public_key = node_ed25519_public_key_from_private_key(&credential.private_key)
            .map_err(anyhow::Error::msg)?;
        if public_key != credential.public_key {
            anyhow::bail!(
                "stored node credential {} has a public key that does not match its private key",
                file.display()
            );
        }
        return Ok(credential.private_key);
    }

    let private_key = generate_ed25519_private_key().map_err(anyhow::Error::msg)?;
    let public_key =
        node_ed25519_public_key_from_private_key(&private_key).map_err(anyhow::Error::msg)?;
    let credential = StoredNodeCredential {
        kind: "clusterflux_node_credential".to_owned(),
        node: node.to_owned(),
        private_key: private_key.clone(),
        public_key,
        credential_scope: "local_project_node_identity".to_owned(),
    };
    persist_node_credential(&file, &credential)?;
    Ok(private_key)
}

fn credential_file_exists_without_symlink(file: &Path) -> Result<bool> {
    match std::fs::symlink_metadata(file) {
        Ok(metadata) if metadata.file_type().is_symlink() => anyhow::bail!(
            "refusing to read node credential through symbolic link {}",
            file.display()
        ),
        Ok(metadata) if !metadata.is_file() => anyhow::bail!(
            "node credential path {} is not a regular file",
            file.display()
        ),
        Ok(_) => Ok(true),
        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(false),
        Err(error) => Err(error).with_context(|| format!("failed to inspect {}", file.display())),
    }
}

fn persist_node_credential(file: &Path, credential: &StoredNodeCredential) -> Result<()> {
    use std::io::Write;

    let parent = file
        .parent()
        .with_context(|| format!("node credential path {} has no parent", file.display()))?;
    std::fs::create_dir_all(parent)
        .with_context(|| format!("failed to create {}", parent.display()))?;
    if std::fs::symlink_metadata(parent)?.file_type().is_symlink() {
        anyhow::bail!(
            "refusing to store node credential through symbolic-link directory {}",
            parent.display()
        );
    }
    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt;
        std::fs::set_permissions(parent, std::fs::Permissions::from_mode(0o700))
            .with_context(|| format!("failed to secure {}", parent.display()))?;
    }

    let mut temporary = tempfile::NamedTempFile::new_in(parent).with_context(|| {
        format!(
            "failed to create temporary credential in {}",
            parent.display()
        )
    })?;
    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt;
        temporary
            .as_file()
            .set_permissions(std::fs::Permissions::from_mode(0o600))?;
    }
    temporary.write_all(&serde_json::to_vec_pretty(credential)?)?;
    temporary.as_file().sync_all()?;
    temporary.persist_noclobber(file).map_err(|error| {
        anyhow::anyhow!(
            "refusing to overwrite node credential {}: {}",
            file.display(),
            error.error
        )
    })?;
    Ok(())
}

pub(crate) fn local_node_credential_file(project: &Path, node: &str) -> PathBuf {
    let digest = Digest::sha256(node);
    let file_stem = digest.as_str().trim_start_matches("sha256:");
    project
        .join(".clusterflux")
        .join("nodes")
        .join(format!("{file_stem}.json"))
}

fn default_node_public_key_for_plan(node: &str) -> String {
    let private_key = generate_ed25519_private_key()
        .unwrap_or_else(|_| format!("unavailable-random-node-plan-key:{node}"));
    node_ed25519_public_key_from_private_key(&private_key)
        .unwrap_or_else(|_| format!("{node}-public-key"))
}

fn signed_node_request_json(
    node_private_key: &str,
    node: &str,
    request_kind: &str,
    request: Value,
) -> Result<Value> {
    let payload_digest = signed_request_payload_digest(&request);
    let node_signature = sign_node_request(
        node_private_key,
        &NodeId::from(node),
        request_kind,
        &payload_digest,
        command_nonce(request_kind),
        unix_timestamp_seconds(),
    )
    .map_err(anyhow::Error::msg)?;
    Ok(json!({
        "type": "signed_node",
        "node": node,
        "node_signature": node_signature,
        "request": request,
    }))
}

pub(crate) fn default_node_id() -> String {
    std::env::var("CLUSTERFLUX_NODE_ID")
        .or_else(|_| std::env::var("HOSTNAME"))
        .or_else(|_| std::env::var("COMPUTERNAME"))
        .unwrap_or_else(|_| "node-local".to_owned())
}

fn parse_capability(cap: &str) -> Option<Capability> {
    match cap {
        "command" => Some(Capability::Command),
        "containers" => Some(Capability::Containers),
        "rootless-podman" => Some(Capability::RootlessPodman),
        "source-filesystem" => Some(Capability::SourceFilesystem),
        "source-git" => Some(Capability::SourceGit),
        "host-filesystem" => Some(Capability::HostFilesystem),
        "network" => Some(Capability::Network),
        "secrets" => Some(Capability::Secrets),
        "inbound-ports" => Some(Capability::InboundPorts),
        "arbitrary-syscalls" => Some(Capability::ArbitrarySyscalls),
        "vfs-artifacts" => Some(Capability::VfsArtifacts),
        "windows-command-dev" => Some(Capability::WindowsCommandDev),
        "quic-direct" => Some(Capability::QuicDirect),
        _ => None,
    }
}