package setupcmd

import (
	"bytes"
	"context"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"io"
	"os"
	"path/filepath"
	"runtime"
	"runtime/debug"
	"strconv"
	"strings"

	"github.com/nexuscrm/backend/pkg/serverruntime"
	database "github.com/nexuscrm/db"
	"golang.org/x/sys/unix"
)

const connectorRemoteIdentityRecoverySetupMainPath = "github.com/nexuscrm/backend/distributions/cmd/setup"
const connectorRemoteIdentityRecoveryCutoverLockName = ".nexuscrm-current-cutover.lock"

type connectorRemoteIdentityRecoveryReleaseAuthority struct {
	ReleaseTag            string
	ResolvedDownstreamRef string
	ResolvedUpstreamRef   string
	ResolvedOfficialRef   string
	FinalPackHash         string
	TagTargetCommit       string
	VersionRoot           string
}

type connectorRemoteIdentityRecoveryProcessIdentity struct {
	TargetPath  string
	SHA256      string
	VCSRevision string
	VCSModified bool
	FileInfo    os.FileInfo
}

func verifyConnectorRemoteIdentityRecoveryRuntime(
	ctx context.Context,
	conn *database.TiDBConnection,
	hooks serverruntime.ProductHooks,
	args connectorRemoteIdentityRecoveryArgs,
	manifest connectorRemoteIdentityRecoveryManifest,
) (connectorRemoteIdentityRecoveryRuntimeProof, error) {
	deployedTupleSHA256, err := hashConnectorRemoteIdentityRecoveryCanonicalJSON(connectorRemoteIdentityRecoveryTupleMap(manifest.DeployedTuple))
	if err != nil {
		return connectorRemoteIdentityRecoveryRuntimeProof{}, fmt.Errorf("%s: hash deployed tuple: %w", connectorRemoteIdentityRecoveryCommand, err)
	}
	runtimeBindingSHA256, err := hashConnectorRemoteIdentityRecoveryCanonicalJSON(map[string]any{
		"deployed_tuple": connectorRemoteIdentityRecoveryTupleMap(manifest.DeployedTuple),
		"runtime_binding": map[string]any{
			"release_json_sha256": manifest.RuntimeBinding.ReleaseJSONSHA256,
			"runtime_env_sha256":  manifest.RuntimeBinding.RuntimeEnvSHA256,
			"setup_binary_sha256": manifest.RuntimeBinding.SetupBinarySHA256,
		},
	})
	if err != nil {
		return connectorRemoteIdentityRecoveryRuntimeProof{}, fmt.Errorf("%s: hash runtime binding: %w", connectorRemoteIdentityRecoveryCommand, err)
	}
	// These values bind even a fail-closed preflight receipt to the requested
	// immutable authorities. The verifier returns before runner construction on
	// any live readback mismatch, so they never authorize an unverified mutation.
	proof := connectorRemoteIdentityRecoveryRuntimeProof{
		RuntimeBindingSHA256: runtimeBindingSHA256,
		ReleaseJSONSHA256:    manifest.RuntimeBinding.ReleaseJSONSHA256,
		RuntimeEnvSHA256:     manifest.RuntimeBinding.RuntimeEnvSHA256,
		SetupBinarySHA256:    manifest.RuntimeBinding.SetupBinarySHA256,
		DeployedTupleSHA256:  deployedTupleSHA256,
	}

	releaseBytes, releaseTarget, err := readConnectorRemoteIdentityRecoveryInheritedAuthority(args.releaseJSONPath)
	if err != nil {
		return proof, fmt.Errorf("%s: read active release.json authority: %w", connectorRemoteIdentityRecoveryCommand, err)
	}
	proof.ReleaseJSONSHA256, err = verifyConnectorRemoteIdentityRecoverySHA256("release.json", releaseBytes, args.releaseJSONSHA256)
	if err != nil {
		return proof, err
	}
	release, err := decodeConnectorRemoteIdentityRecoveryReleaseAuthority(releaseBytes)
	if err != nil {
		return proof, err
	}
	cutoverLock, err := acquireConnectorRemoteIdentityRecoveryCutoverLock(release.VersionRoot)
	if err != nil {
		return proof, err
	}
	lockTransferred := false
	defer func() {
		if !lockTransferred {
			releaseConnectorRemoteIdentityRecoveryCutoverLock(cutoverLock)
		}
	}()

	runtimeEnvBytes, runtimeEnvTarget, err := readConnectorRemoteIdentityRecoveryInheritedAuthority(args.runtimeEnvPath)
	if err != nil {
		return proof, fmt.Errorf("%s: read active runtime.env authority: %w", connectorRemoteIdentityRecoveryCommand, err)
	}
	proof.RuntimeEnvSHA256, err = verifyConnectorRemoteIdentityRecoverySHA256("runtime.env", runtimeEnvBytes, args.runtimeEnvSHA256)
	if err != nil {
		return proof, err
	}
	runtimeEnv, err := decodeConnectorRemoteIdentityRecoveryRuntimeEnv(runtimeEnvBytes)
	if err != nil {
		return proof, err
	}

	processIdentity, err := readConnectorRemoteIdentityRecoveryProcessIdentity()
	if err != nil {
		return proof, err
	}
	if processIdentity.SHA256 != args.setupBinarySHA256 {
		return proof, fmt.Errorf("%s: setup binary SHA-256 mismatch: got %s", connectorRemoteIdentityRecoveryCommand, processIdentity.SHA256)
	}
	proof.SetupBinarySHA256 = processIdentity.SHA256

	if err := validateConnectorRemoteIdentityRecoveryRuntimeAuthorities(
		manifest, release, releaseTarget, runtimeEnv, runtimeEnvTarget, processIdentity,
	); err != nil {
		return proof, err
	}
	if err := verifyProductDistributionComposition(ctx, conn, hooks); err != nil {
		return proof, fmt.Errorf("%s: %w", connectorRemoteIdentityRecoveryCommand, err)
	}
	if err := verifyConnectorRemoteIdentityRecoveryCompiledSourceLocks(hooks); err != nil {
		return proof, err
	}

	proof.cutoverLock = cutoverLock
	lockTransferred = true
	return proof, nil
}

func acquireConnectorRemoteIdentityRecoveryCutoverLock(versionRoot string) (*os.File, error) {
	resolvedVersionRoot, err := filepath.EvalSymlinks(strings.TrimSpace(versionRoot))
	if err != nil || !filepath.IsAbs(resolvedVersionRoot) {
		return nil, fmt.Errorf("%s: release version_root is not a live absolute directory", connectorRemoteIdentityRecoveryCommand)
	}
	releasesRoot := filepath.Dir(filepath.Clean(resolvedVersionRoot))
	if filepath.Base(releasesRoot) != "releases" {
		return nil, fmt.Errorf("%s: release version_root is not under the deployment releases directory", connectorRemoteIdentityRecoveryCommand)
	}
	lockPath := filepath.Join(filepath.Dir(releasesRoot), connectorRemoteIdentityRecoveryCutoverLockName)
	fd, err := unix.Open(lockPath, unix.O_CREAT|unix.O_RDWR|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0o600)
	if err != nil {
		return nil, fmt.Errorf("%s: open deployment cutover lock: %w", connectorRemoteIdentityRecoveryCommand, err)
	}
	lockFile := os.NewFile(uintptr(fd), lockPath)
	if lockFile == nil {
		_ = unix.Close(fd)
		return nil, fmt.Errorf("%s: open deployment cutover lock returned no file", connectorRemoteIdentityRecoveryCommand)
	}
	info, err := lockFile.Stat()
	if err != nil || !info.Mode().IsRegular() {
		_ = lockFile.Close()
		return nil, fmt.Errorf("%s: deployment cutover lock is not a regular file", connectorRemoteIdentityRecoveryCommand)
	}
	if err := unix.Flock(fd, unix.LOCK_SH); err != nil {
		_ = lockFile.Close()
		return nil, fmt.Errorf("%s: acquire deployment cutover lock: %w", connectorRemoteIdentityRecoveryCommand, err)
	}
	return lockFile, nil
}

func releaseConnectorRemoteIdentityRecoveryCutoverLock(lockFile *os.File) {
	if lockFile == nil {
		return
	}
	_ = unix.Flock(int(lockFile.Fd()), unix.LOCK_UN)
	_ = lockFile.Close()
}

func readConnectorRemoteIdentityRecoveryInheritedAuthority(path string) ([]byte, string, error) {
	path = strings.TrimSpace(path)
	if path == "" {
		return nil, "", fmt.Errorf("authority descriptor path is empty")
	}
	var target string
	if runtime.GOOS == "linux" {
		const prefix = "/proc/self/fd/"
		if !strings.HasPrefix(path, prefix) || strings.Contains(strings.TrimPrefix(path, prefix), "/") {
			return nil, "", fmt.Errorf("authority must be passed as an inherited /proc/self/fd descriptor")
		}
		if _, err := strconv.Atoi(strings.TrimPrefix(path, prefix)); err != nil {
			return nil, "", fmt.Errorf("authority descriptor is invalid")
		}
		linked, err := os.Readlink(path)
		if err != nil {
			return nil, "", err
		}
		if strings.HasSuffix(linked, " (deleted)") {
			return nil, "", fmt.Errorf("authority descriptor target was deleted")
		}
		target = linked
	} else {
		resolved, err := filepath.EvalSymlinks(path)
		if err != nil {
			return nil, "", err
		}
		target = resolved
	}
	if !filepath.IsAbs(target) {
		return nil, "", fmt.Errorf("authority descriptor target must be absolute")
	}

	file, err := os.Open(path)
	if err != nil {
		return nil, "", err
	}
	defer file.Close()
	info, err := file.Stat()
	if err != nil {
		return nil, "", err
	}
	if !info.Mode().IsRegular() {
		return nil, "", fmt.Errorf("authority descriptor target is not a regular file")
	}
	data, err := io.ReadAll(io.LimitReader(file, connectorRemoteIdentityRecoveryMaxInputBytes+1))
	if err != nil {
		return nil, "", err
	}
	if len(data) == 0 || len(data) > connectorRemoteIdentityRecoveryMaxInputBytes {
		return nil, "", fmt.Errorf("authority must contain between 1 and %d bytes", connectorRemoteIdentityRecoveryMaxInputBytes)
	}
	resolvedTarget, err := filepath.EvalSymlinks(target)
	if err != nil {
		return nil, "", err
	}
	targetInfo, err := os.Stat(resolvedTarget)
	if err != nil {
		return nil, "", err
	}
	if !os.SameFile(info, targetInfo) {
		return nil, "", fmt.Errorf("authority descriptor target was replaced during verification")
	}
	return data, filepath.Clean(resolvedTarget), nil
}

func readConnectorRemoteIdentityRecoveryProcessIdentity() (connectorRemoteIdentityRecoveryProcessIdentity, error) {
	path := "/proc/self/exe"
	if runtime.GOOS != "linux" {
		var err error
		path, err = os.Executable()
		if err != nil {
			return connectorRemoteIdentityRecoveryProcessIdentity{}, err
		}
	}
	file, err := os.Open(path)
	if err != nil {
		return connectorRemoteIdentityRecoveryProcessIdentity{}, fmt.Errorf("%s: open setup process image: %w", connectorRemoteIdentityRecoveryCommand, err)
	}
	defer file.Close()
	fileInfo, err := file.Stat()
	if err != nil || !fileInfo.Mode().IsRegular() {
		return connectorRemoteIdentityRecoveryProcessIdentity{}, fmt.Errorf("%s: setup process image is not a regular file", connectorRemoteIdentityRecoveryCommand)
	}
	target, err := filepath.EvalSymlinks(path)
	if err != nil {
		return connectorRemoteIdentityRecoveryProcessIdentity{}, fmt.Errorf("%s: resolve setup process image: %w", connectorRemoteIdentityRecoveryCommand, err)
	}
	if strings.HasSuffix(target, " (deleted)") {
		return connectorRemoteIdentityRecoveryProcessIdentity{}, fmt.Errorf("%s: setup process image was deleted after exec", connectorRemoteIdentityRecoveryCommand)
	}
	hasher := sha256.New()
	if _, err := io.Copy(hasher, file); err != nil {
		return connectorRemoteIdentityRecoveryProcessIdentity{}, fmt.Errorf("%s: hash setup process image: %w", connectorRemoteIdentityRecoveryCommand, err)
	}

	buildInfo, ok := debug.ReadBuildInfo()
	if !ok {
		return connectorRemoteIdentityRecoveryProcessIdentity{}, fmt.Errorf("%s: setup process has no Go build identity", connectorRemoteIdentityRecoveryCommand)
	}
	if strings.TrimSpace(buildInfo.Path) != connectorRemoteIdentityRecoverySetupMainPath {
		return connectorRemoteIdentityRecoveryProcessIdentity{}, fmt.Errorf("%s: process is not the CRM distribution setup binary", connectorRemoteIdentityRecoveryCommand)
	}
	settings := make(map[string]string, len(buildInfo.Settings))
	for _, setting := range buildInfo.Settings {
		settings[setting.Key] = setting.Value
	}
	revision := strings.TrimSpace(settings["vcs.revision"])
	if !isConnectorRemoteIdentityRecoveryGitSHA(revision) {
		return connectorRemoteIdentityRecoveryProcessIdentity{}, fmt.Errorf("%s: setup process lacks an exact vcs.revision", connectorRemoteIdentityRecoveryCommand)
	}
	modified := strings.EqualFold(strings.TrimSpace(settings["vcs.modified"]), "true")
	return connectorRemoteIdentityRecoveryProcessIdentity{
		TargetPath: filepath.Clean(target), SHA256: hex.EncodeToString(hasher.Sum(nil)),
		VCSRevision: revision, VCSModified: modified, FileInfo: fileInfo,
	}, nil
}

func decodeConnectorRemoteIdentityRecoveryReleaseAuthority(data []byte) (connectorRemoteIdentityRecoveryReleaseAuthority, error) {
	if err := rejectDuplicateJSONKeys(data); err != nil {
		return connectorRemoteIdentityRecoveryReleaseAuthority{}, fmt.Errorf("%s: decode release.json: %w", connectorRemoteIdentityRecoveryCommand, err)
	}
	var object map[string]json.RawMessage
	if err := json.Unmarshal(data, &object); err != nil {
		return connectorRemoteIdentityRecoveryReleaseAuthority{}, fmt.Errorf("%s: decode release.json: %w", connectorRemoteIdentityRecoveryCommand, err)
	}
	read := func(key string) (string, error) {
		raw, ok := object[key]
		if !ok {
			return "", fmt.Errorf("release.json field %s is required", key)
		}
		var value string
		if err := json.Unmarshal(raw, &value); err != nil || strings.TrimSpace(value) == "" || value != strings.TrimSpace(value) {
			return "", fmt.Errorf("release.json field %s must be a non-empty string", key)
		}
		return value, nil
	}
	keys := []string{"release_tag", "resolved_downstream_ref", "resolved_upstream_ref", "resolved_official_ref", "final_pack_hash", "tag_target_commit", "version_root"}
	values := make(map[string]string, len(keys))
	for _, key := range keys {
		value, err := read(key)
		if err != nil {
			return connectorRemoteIdentityRecoveryReleaseAuthority{}, fmt.Errorf("%s: %w", connectorRemoteIdentityRecoveryCommand, err)
		}
		values[key] = value
	}
	return connectorRemoteIdentityRecoveryReleaseAuthority{
		ReleaseTag: values["release_tag"], ResolvedDownstreamRef: values["resolved_downstream_ref"],
		ResolvedUpstreamRef: values["resolved_upstream_ref"], ResolvedOfficialRef: values["resolved_official_ref"],
		FinalPackHash: values["final_pack_hash"], TagTargetCommit: values["tag_target_commit"], VersionRoot: values["version_root"],
	}, nil
}

func decodeConnectorRemoteIdentityRecoveryRuntimeEnv(data []byte) (map[string]string, error) {
	result := map[string]string{}
	for lineNumber, line := range strings.Split(string(data), "\n") {
		line = strings.TrimSuffix(line, "\r")
		if strings.TrimSpace(line) == "" || strings.HasPrefix(strings.TrimSpace(line), "#") {
			continue
		}
		key, value, ok := strings.Cut(line, "=")
		if !ok || strings.TrimSpace(key) != key || key == "" {
			return nil, fmt.Errorf("%s: runtime.env line %d is invalid", connectorRemoteIdentityRecoveryCommand, lineNumber+1)
		}
		if _, duplicate := result[key]; duplicate {
			return nil, fmt.Errorf("%s: runtime.env has duplicate key %s", connectorRemoteIdentityRecoveryCommand, key)
		}
		result[key] = value
	}
	return result, nil
}

func validateConnectorRemoteIdentityRecoveryRuntimeAuthorities(
	manifest connectorRemoteIdentityRecoveryManifest,
	release connectorRemoteIdentityRecoveryReleaseAuthority,
	releaseTarget string,
	runtimeEnv map[string]string,
	runtimeEnvTarget string,
	process connectorRemoteIdentityRecoveryProcessIdentity,
) error {
	tuple := manifest.DeployedTuple
	requiredEnv := []string{"DEPLOY_ID", "RELEASE_TAG", "DOWNSTREAM_REF", "UPSTREAM_REF", "OFFICIAL_APP_PACKS_REF", "TAG_TARGET_COMMIT", "RELEASE_EXECUTOR_COMMIT", "ENV_ROOT", "NEXUSCRM_SETUP_BIN"}
	for _, key := range requiredEnv {
		if strings.TrimSpace(runtimeEnv[key]) == "" {
			return fmt.Errorf("%s: active runtime.env field %s is required", connectorRemoteIdentityRecoveryCommand, key)
		}
	}
	checks := []struct{ label, actual, expected string }{
		{"release release_tag", release.ReleaseTag, tuple.ReleaseTag},
		{"release resolved_downstream_ref", release.ResolvedDownstreamRef, tuple.DownstreamCommit},
		{"release tag_target_commit", release.TagTargetCommit, tuple.DownstreamCommit},
		{"release resolved_upstream_ref", release.ResolvedUpstreamRef, tuple.UpstreamCommit},
		{"release resolved_official_ref", release.ResolvedOfficialRef, tuple.OfficialAppPacksCommit},
		{"release final_pack_hash", release.FinalPackHash, tuple.FinalPackHash},
		{"runtime DEPLOY_ID", runtimeEnv["DEPLOY_ID"], tuple.DeploymentID},
		{"runtime RELEASE_TAG", runtimeEnv["RELEASE_TAG"], tuple.ReleaseTag},
		{"runtime DOWNSTREAM_REF", runtimeEnv["DOWNSTREAM_REF"], tuple.DownstreamCommit},
		{"runtime TAG_TARGET_COMMIT", runtimeEnv["TAG_TARGET_COMMIT"], tuple.DownstreamCommit},
		{"runtime RELEASE_EXECUTOR_COMMIT", runtimeEnv["RELEASE_EXECUTOR_COMMIT"], tuple.DownstreamCommit},
		{"runtime UPSTREAM_REF", runtimeEnv["UPSTREAM_REF"], tuple.UpstreamCommit},
		{"runtime OFFICIAL_APP_PACKS_REF", runtimeEnv["OFFICIAL_APP_PACKS_REF"], tuple.OfficialAppPacksCommit},
		{"setup vcs.revision", process.VCSRevision, tuple.UpstreamCommit},
	}
	for _, check := range checks {
		if check.actual != check.expected {
			return fmt.Errorf("%s: %s does not match the manifest deployed tuple", connectorRemoteIdentityRecoveryCommand, check.label)
		}
	}
	if process.VCSModified {
		return fmt.Errorf("%s: setup process was built from a modified upstream worktree", connectorRemoteIdentityRecoveryCommand)
	}
	versionRoot, err := filepath.EvalSymlinks(release.VersionRoot)
	if err != nil || !filepath.IsAbs(versionRoot) {
		return fmt.Errorf("%s: release version_root is not a live absolute directory", connectorRemoteIdentityRecoveryCommand)
	}
	versionRoot = filepath.Clean(versionRoot)
	if releaseTarget != filepath.Join(versionRoot, "release.json") {
		return fmt.Errorf("%s: release.json descriptor is outside its declared version_root", connectorRemoteIdentityRecoveryCommand)
	}
	if runtimeEnvTarget != filepath.Join(versionRoot, "env", "runtime.env") {
		return fmt.Errorf("%s: runtime.env descriptor is not the release-owned runtime.env", connectorRemoteIdentityRecoveryCommand)
	}
	if err := validateConnectorRemoteIdentityRecoveryActiveCurrent(versionRoot, runtimeEnvTarget); err != nil {
		return err
	}
	if !connectorRemoteIdentityRecoveryPathWithin(versionRoot, process.TargetPath) {
		return fmt.Errorf("%s: executing setup binary is outside the active version_root", connectorRemoteIdentityRecoveryCommand)
	}
	envRoot, err := filepath.EvalSymlinks(runtimeEnv["ENV_ROOT"])
	if err != nil || filepath.Clean(envRoot) != versionRoot {
		return fmt.Errorf("%s: runtime ENV_ROOT does not resolve to the active version_root", connectorRemoteIdentityRecoveryCommand)
	}
	configuredSetup, err := filepath.EvalSymlinks(runtimeEnv["NEXUSCRM_SETUP_BIN"])
	if err != nil || filepath.Clean(configuredSetup) != filepath.Clean(process.TargetPath) {
		return fmt.Errorf("%s: runtime NEXUSCRM_SETUP_BIN does not resolve to the executing setup binary", connectorRemoteIdentityRecoveryCommand)
	}
	configuredSetupInfo, err := os.Stat(configuredSetup)
	if err != nil || process.FileInfo == nil || !os.SameFile(process.FileInfo, configuredSetupInfo) {
		return fmt.Errorf("%s: runtime NEXUSCRM_SETUP_BIN inode does not match the executing setup binary", connectorRemoteIdentityRecoveryCommand)
	}
	return nil
}

func validateConnectorRemoteIdentityRecoveryActiveCurrent(versionRoot, runtimeEnvTarget string) error {
	versionRoot = filepath.Clean(versionRoot)
	releasesRoot := filepath.Dir(versionRoot)
	if filepath.Base(releasesRoot) != "releases" || filepath.Dir(releasesRoot) == releasesRoot {
		return fmt.Errorf("%s: release version_root is not under the deployment releases directory", connectorRemoteIdentityRecoveryCommand)
	}
	currentRoot := filepath.Join(filepath.Dir(releasesRoot), "current")
	currentRuntimeEnv := filepath.Join(currentRoot, "env", "runtime.env")
	if err := validateConnectorRemoteIdentityRecoveryActiveSymlink(
		"current runtime.env",
		currentRuntimeEnv,
		runtimeEnvTarget,
	); err != nil {
		return err
	}
	if err := validateConnectorRemoteIdentityRecoveryActiveSymlink(
		"current run_backend.sh",
		filepath.Join(currentRoot, "run_backend.sh"),
		filepath.Join(versionRoot, "run_backend.sh"),
	); err != nil {
		return err
	}
	return nil
}

func validateConnectorRemoteIdentityRecoveryActiveSymlink(label, linkPath, expectedTarget string) error {
	linkInfo, err := os.Lstat(linkPath)
	if err != nil || linkInfo.Mode()&os.ModeSymlink == 0 {
		return fmt.Errorf("%s: active %s must be a live symlink", connectorRemoteIdentityRecoveryCommand, label)
	}
	resolvedLink, err := filepath.EvalSymlinks(linkPath)
	if err != nil {
		return fmt.Errorf("%s: resolve active %s: %w", connectorRemoteIdentityRecoveryCommand, label, err)
	}
	resolvedExpected, err := filepath.EvalSymlinks(expectedTarget)
	if err != nil {
		return fmt.Errorf("%s: resolve release-owned %s: %w", connectorRemoteIdentityRecoveryCommand, label, err)
	}
	if filepath.Clean(resolvedLink) != filepath.Clean(resolvedExpected) {
		return fmt.Errorf("%s: active %s does not target the declared version_root", connectorRemoteIdentityRecoveryCommand, label)
	}
	linkTargetInfo, err := os.Stat(linkPath)
	if err != nil {
		return fmt.Errorf("%s: stat active %s: %w", connectorRemoteIdentityRecoveryCommand, label, err)
	}
	expectedInfo, err := os.Stat(resolvedExpected)
	if err != nil || !expectedInfo.Mode().IsRegular() || !os.SameFile(linkTargetInfo, expectedInfo) {
		return fmt.Errorf("%s: active %s inode does not match the declared version_root", connectorRemoteIdentityRecoveryCommand, label)
	}
	return nil
}

// verifyConnectorRemoteIdentityRecoveryCompiledSourceLocks validates the
// product-owned source-resolution locks compiled into this setup binary.
//
// These revisions are intentionally independent from both the release's L1
// repository checkout and each installed pack's source tuple. A release may
// check out a later L1 commit while the binary resolves a compatible
// per-product pack commit from that checkout, and an L2 final pack is installed
// from its release-scoped local_path revision. The release/runtime tuple is
// bound above, installed composition is checked by
// verifyProductDistributionComposition, and strict recovery later locks and
// validates the installed source revision plus payload hash. Conflating those
// three authorities makes every valid L2 final-pack deployment unverifiable.
func verifyConnectorRemoteIdentityRecoveryCompiledSourceLocks(hooks serverruntime.ProductHooks) error {
	registrations := hooks.Capabilities.OfficialRepoSourceRevisions
	if len(registrations) == 0 {
		return fmt.Errorf("%s: compiled product has no official app-pack source revisions", connectorRemoteIdentityRecoveryCommand)
	}
	seen := map[string]struct{}{}
	for _, registration := range registrations {
		name := strings.TrimSpace(registration.Name)
		revision := strings.TrimSpace(registration.Revision)
		if name == "" {
			return fmt.Errorf("%s: compiled official app-pack source lock has an empty name", connectorRemoteIdentityRecoveryCommand)
		}
		if !serverruntime.IsImmutableConnectorPushSourceRevision(revision) {
			return fmt.Errorf("%s: compiled official app-pack source lock %q is not an immutable 40-hex revision", connectorRemoteIdentityRecoveryCommand, name)
		}
		key := strings.ToLower(name)
		if _, duplicate := seen[key]; duplicate {
			return fmt.Errorf("%s: compiled official app-pack name %q is duplicated", connectorRemoteIdentityRecoveryCommand, name)
		}
		seen[key] = struct{}{}
	}
	return nil
}

func connectorRemoteIdentityRecoveryTupleMap(tuple connectorRemoteIdentityRecoveryDeployedTuple) map[string]any {
	return map[string]any{
		"deployment_id": tuple.DeploymentID, "release_tag": tuple.ReleaseTag,
		"downstream_commit": tuple.DownstreamCommit, "upstream_commit": tuple.UpstreamCommit,
		"official_app_packs_commit": tuple.OfficialAppPacksCommit, "final_pack_hash": tuple.FinalPackHash,
	}
}

func hashConnectorRemoteIdentityRecoveryCanonicalJSON(value any) (string, error) {
	var buffer bytes.Buffer
	encoder := json.NewEncoder(&buffer)
	encoder.SetEscapeHTML(false)
	if err := encoder.Encode(value); err != nil {
		return "", err
	}
	data := bytes.TrimSuffix(buffer.Bytes(), []byte("\n"))
	sum := sha256.Sum256(data)
	return hex.EncodeToString(sum[:]), nil
}

func connectorRemoteIdentityRecoveryPathWithin(root, target string) bool {
	relative, err := filepath.Rel(filepath.Clean(root), filepath.Clean(target))
	return err == nil && relative != "." && relative != ".." && !strings.HasPrefix(relative, ".."+string(filepath.Separator))
}