package com.peachpasswords.sync

/**
 * E7b: split a too-large padded sync frame across multiple Noise transport
 * messages and reassemble it on the other side. Mirror of peach-browser
 * `src/shared/sync-transport.ts`. Constants and the chunking protocol MUST
 * match the browser byte-for-byte.
 *
 * Why this exists: [SyncPadding.pad] can produce frames up to 24 MiB, but
 * Noise caps a single transport message at [MAX_NOISE_PLAINTEXT_BYTES]
 * plaintext (65519 — see crypto-core/src/lib.rs: 65535 ciphertext minus the
 * 16-byte Poly1305 auth tag). Until this layer existed, a payload above ~64 KiB
 * tripped the core's "Noise plaintext exceeds transport limit" on the sender
 * while the receiver sat waiting for a frame that never arrived.
 *
 * Wire shape for a multi-chunk frame:
 *
 *   Noise msg 1: [0x01][chunk 1 bytes ...]   <- 0x01 = [FRAME_CONTINUATION_MARKER]
 *   Noise msg 2: [0x01][chunk 2 bytes ...]
 *   ...
 *   Noise msg N: [chunk N bytes ...]         <- no marker on the last chunk
 *
 * Single-chunk frames go out as one Noise message with no marker, so the
 * common small-frame case is unchanged on the wire. The receiver recognises
 * the difference by the first byte of the decrypted plaintext: a marker
 * means "more chunks coming, do not unpad yet".
 *
 * The bucket ladder itself lives in [SyncPadding]. If [SyncPadding.bucket] or
 * this limit ever drifts, both sides change in lockstep — see the
 * cross-reference comment in [SyncPadding].
 */

/** Noise plaintext cap: 65535 ciphertext − 16-byte auth tag = 65519. */
const val MAX_NOISE_PLAINTEXT_BYTES: Int = 65519

/**
 * First byte of every non-last chunk of a chunked padded frame. The byte
 * `0x01` is unambiguous against a real padded frame: a 4-byte big-endian
 * length header whose payload is < 4 bytes can only start at byte 0 with a
 * zero, never `0x01`.
 */
const val FRAME_CONTINUATION_MARKER: Byte = 0x01

/**
 * Pad [plaintext], optionally chunk it across the Noise plaintext limit,
 * encrypt each chunk, and hand each ciphertext to [sendCiphertext].
 *
 * A padded frame that fits one Noise message goes out as one ciphertext,
 * no marker, no per-chunk overhead. Otherwise the padded frame is sliced
 * into 64 KiB chunks; the first N−1 carry the [FRAME_CONTINUATION_MARKER],
 * the last does not, and the receiver reassembles by stripping the byte.
 */
internal suspend fun sendSyncFrame(
    plaintext: ByteArray,
    encrypt: (ByteArray) -> ByteArray,
    sendCiphertext: suspend (ByteArray) -> Unit,
) {
    val padded = SyncPadding.pad(plaintext)
    if (padded.size <= MAX_NOISE_PLAINTEXT_BYTES) {
        sendCiphertext(encrypt(padded))
        return
    }
    val total = padded.size
    var offset = 0
    while (offset < total) {
        val remaining = total - offset
        // A non-last chunk must leave room for the one-byte marker under the
        // Noise plaintext cap; the last chunk carries no marker and can use
        // the full cap. This slicing is one byte shy of the browser's loop,
        // which slices at the cap and then prepends the marker — that path
        // produces [marker][MAX bytes] = MAX+1 bytes, which the crypto core
        // rejects. Wire shape ([0x01][data]) is unchanged across platforms.
        val cap = if (remaining <= MAX_NOISE_PLAINTEXT_BYTES) {
            MAX_NOISE_PLAINTEXT_BYTES
        } else {
            MAX_NOISE_PLAINTEXT_BYTES - 1
        }
        val end = minOf(offset + cap, total)
        val chunkBytes = end - offset
        val chunk = padded.copyOfRange(offset, end)
        val isLast = end == total
        val pt: ByteArray = if (isLast) {
            chunk
        } else {
            ByteArray(chunkBytes + 1).also {
                it[0] = FRAME_CONTINUATION_MARKER
                chunk.copyInto(it, 1)
            }
        }
        sendCiphertext(encrypt(pt))
        offset += chunkBytes
    }
}

/**
 * Inverse of [sendSyncFrame]: read Noise ciphertexts from
 * [receiveCiphertext], reassemble chunked padded frames, and return the
 * original payload. The first byte of every decrypted message tells the
 * loop whether more chunks are coming; the last chunk is unmarker and
 * triggers unpad.
 */
internal suspend fun receiveSyncFrame(
    receiveCiphertext: suspend () -> ByteArray,
    decrypt: (ByteArray) -> ByteArray,
): ByteArray {
    var buffered: ByteArray? = null
    while (true) {
        val pt = decrypt(receiveCiphertext())
        if (buffered == null) {
            // First chunk. Marked means "more chunks to come"; an unmarked
            // first chunk is the entire single-chunk frame, exactly as before
            // the chunking layer existed.
            if (pt.isNotEmpty() && pt[0] == FRAME_CONTINUATION_MARKER) {
                buffered = pt.copyOfRange(1, pt.size)
                continue
            }
            return SyncPadding.unpad(pt)
        }
        // Continuing the assembly. A marked chunk contributes bytes past
        // the marker; the final chunk is unmarker, so we concatenate it
        // whole and unpad.
        if (pt.isNotEmpty() && pt[0] == FRAME_CONTINUATION_MARKER) {
            val merged = ByteArray(buffered.size + pt.size - 1)
            buffered.copyInto(merged, 0)
            pt.copyInto(merged, buffered.size, 1)
            buffered = merged
            continue
        }
        val reassembled = ByteArray(buffered.size + pt.size)
        buffered.copyInto(reassembled, 0)
        pt.copyInto(reassembled, buffered.size)
        return SyncPadding.unpad(reassembled)
    }
}