use anyhow::Result;

use sequoia_openpgp::cert;
use sequoia_openpgp::parse::Parse;
use sequoia_openpgp::types::RevocationStatus;

use crate::cli::cli_args::LocalsAddCommand;
use crate::config::HuskConfigContainer;
use crate::types::husk_context::HuskContext;
use crate::commands::CommandError;
use crate::common::crypto;

pub async fn dispatch(cmd: LocalsAddCommand, config: HuskConfigContainer) -> Result<()> {
    let context = HuskContext::new(&config.into())?;
    let policy = &context.policy;

    let c = cert::Cert::from_file(cmd.cert_file)?;
    let vc = c.with_policy(policy, None)?;

    // guards
    if vc.alive().is_err() {
        return Err(CommandError::CertNotAlive(vc.fingerprint()).into());
    }
    if matches!(vc.revocation_status(), RevocationStatus::Revoked(_)) {
        return Err(CommandError::CertRevoked(vc.fingerprint()).into());
    }
    if !crypto::can_encrypt(&vc) {
        return Err(CommandError::CertNotUsable(vc.fingerprint()).into());
    }
    if vc.fingerprint() == context.local_trust_root.fingerprint() {
        // XXX: find a better error
        return Err(CommandError::CertNotUsable(vc.fingerprint()).into());
    }

    crypto::authenticate(
        &context,
        &vc,
        crypto::Role::Local,
        true,
        None
    )
}