//! Shared OpenSSH helpers.

use ssh_key::{

    Algorithm, LineEnding, PrivateKey, PublicKey, private::KeypairData, public::KeyData,

};

use tor_error::{internal, into_internal};

use tor_llcrypto::pk::{curve25519, ed25519, rsa};

use crate::{ErasedKey, Error, KeyType, Result};

/// The algorithm string for x25519 SSH keys.

///

/// See <https://spec.torproject.org/ssh-protocols.html>

pub(crate) const X25519_ALGORITHM_NAME: &str = "x25519@spec.torproject.org";

/// The algorithm string for expanded ed25519 SSH keys.

///

/// See <https://spec.torproject.org/ssh-protocols.html>

pub(crate) const ED25519_EXPANDED_ALGORITHM_NAME: &str = "ed25519-expanded@spec.torproject.org";

/// SSH key algorithms.

//

// Note: this contains all the types supported by ssh_key, plus variants representing

// x25519 and expanded ed25519 keys.

#[derive(Clone, Debug, PartialEq, derive_more::Display)]

#[non_exhaustive]

pub enum SshKeyAlgorithm {

    /// Digital Signature Algorithm

    Dsa,

    /// Elliptic Curve Digital Signature Algorithm

    Ecdsa,

    /// Ed25519

    Ed25519,

    /// Expanded Ed25519

    Ed25519Expanded,

    /// X25519

    X25519,

    /// RSA

    Rsa,

    /// FIDO/U2F key with ECDSA/NIST-P256 + SHA-256

    SkEcdsaSha2NistP256,

    /// FIDO/U2F key with Ed25519

    SkEd25519,

    /// An unrecognized [`ssh_key::Algorithm`].

    Unknown(ssh_key::Algorithm),

}

impl From<Algorithm> for SshKeyAlgorithm {

            },

            // Note: ssh_key::Algorithm is non_exhaustive, so we need this catch-all variant

        }

}

/// Convert ssh_key KeyData or KeypairData to one of our key types.

macro_rules! ssh_to_internal_erased {

    (PRIVATE $key:expr, $algo:expr) => {{

        ssh_to_internal_erased!(

            $key,

            $algo,

            convert_ed25519_kp,

            convert_expanded_ed25519_kp,

            convert_x25519_kp,

            convert_rsa_kp,

            KeypairData

        )

    }};

    (PUBLIC $key:expr, $algo:expr) => {{

        ssh_to_internal_erased!(

            $key,

            $algo,

            convert_ed25519_pk,

            convert_expanded_ed25519_pk,

            convert_x25519_pk,

            convert_rsa_pk,

            KeyData

        )

    }};

    ($key:expr, $algo:expr, $ed25519_fn:path, $expanded_ed25519_fn:path, $x25519_fn:path, $rsa_fn:path, $key_data_ty:tt) => {{

        let key = $key;

        let algo = SshKeyAlgorithm::from($algo);

        // Build the expected key type (i.e. convert ssh_key key types to the key types

        // we're using internally).

        match key {

            $key_data_ty::Ed25519(key) => Ok($ed25519_fn(&key).map(Box::new)?),

            $key_data_ty::Rsa(key) => Ok($rsa_fn(&key).map(Box::new)?),

            $key_data_ty::Other(other) => match algo {

                SshKeyAlgorithm::X25519 => Ok($x25519_fn(&other).map(Box::new)?),

                SshKeyAlgorithm::Ed25519Expanded => Ok($expanded_ed25519_fn(&other).map(Box::new)?),

                _ => Err(Error::UnsupportedKeyAlgorithm(algo)),

            },

            _ => Err(Error::UnsupportedKeyAlgorithm(algo)),

        }

    }};

}

/// Try to convert an [`Ed25519Keypair`](ssh_key::private::Ed25519Keypair) to an [`ed25519::Keypair`].

// TODO remove this allow?

// clippy wants this whole function to be infallible because

// nowadays ed25519::Keypair can be made infallibly from bytes,

// but is that really right?

#[allow(clippy::unnecessary_fallible_conversions)]

/// Try to convert an [`OpaqueKeypair`](ssh_key::private::OpaqueKeypair) to a [`curve25519::StaticKeypair`].

/// Try to convert an [`OpaqueKeypair`](ssh_key::private::OpaqueKeypair) to an [`ed25519::ExpandedKeypair`].

    )

/// Try to convert an [`RsaKeypair`](ssh_key::private::RsaKeypair) to a [`rsa::KeyPair`].

    // TODO #1598:

    //

    // Right now, this will always fail, because ssh-key doesn't support keys less than 2048 bits.

    //

    // However, this will be lowered in the future to allow the 1024-bit keys that we use:

    //

    // https://github.com/RustCrypto/SSH/issues/336

/// Try to convert an [`Ed25519PublicKey`](ssh_key::public::Ed25519PublicKey) to an [`ed25519::PublicKey`].

/// Try to convert an [`OpaquePublicKey`](ssh_key::public::OpaquePublicKey) to an [`ed25519::PublicKey`].

///

/// This function always returns an error because the custom `ed25519-expanded@spec.torproject.org`

/// SSH algorithm should not be used for ed25519 public keys (only for expanded ed25519 key

/// _pairs_). This function is needed for the [`ssh_to_internal_erased!`] macro.

/// Try to convert an [`OpaquePublicKey`](ssh_key::public::OpaquePublicKey) to a [`curve25519::PublicKey`].

/// Try to convert an [`RsaKeypair`](ssh_key::public::RsaPublicKey) to a [`rsa::PublicKey`].

/// A public key or a keypair.

#[derive(Clone, Debug)]

#[non_exhaustive]

pub struct SshKeyData(SshKeyDataInner);

/// The inner representation of a public key or a keypair.

#[derive(Clone, Debug)]

#[non_exhaustive]

enum SshKeyDataInner {

    /// The [`KeyData`] of a public key.

    Public(KeyData),

    /// The [`KeypairData`] of a private key.

    Private(KeypairData),

}

impl SshKeyData {

    /// Try to convert a [`KeyData`] to [`SshKeyData`].

    ///

    /// Returns an error if this type of [`KeyData`] is not supported.

            },

    /// Try to convert a [`KeypairData`] to [`SshKeyData`].

    ///

    /// Returns an error if this type of [`KeypairData`] is not supported.

        );

            },

    /// Encode this key as an OpenSSH-formatted key using the specified `comment`

            }

            }

        };

    /// Convert the key material into a known key type,

    /// and return the type-erased value.

    ///

    /// The caller is expected to downcast the value returned to the correct concrete type.

            }

            }

        }

    /// Return the [`KeyType`] of this OpenSSH key.

    ///

    /// Returns an error if the underlying key material is [`KeypairData::Encrypted`],

    /// or if its algorithm is unsupported.

        }

}