// This file is part of the happyDomain (R) project.
// Copyright (c) 2020-2026 happyDomain
// Authors: Pierre-Olivier Mercier, et al.
//
// This program is offered under a commercial and under the AGPL license.
// For commercial licensing, contact us at <contact@happydomain.org>.
//
// For AGPL licensing:
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <https://www.gnu.org/licenses/>.

package checker

import (
	"context"

	sdk "git.happydns.org/checker-sdk-go/checker"
)

// hostKeyStrengthRule flags host keys whose size is below what modern
// OpenSSH requires (currently < 2048-bit RSA).
type hostKeyStrengthRule struct{}

func (r *hostKeyStrengthRule) Name() string { return "ssh.host_key_strength" }
func (r *hostKeyStrengthRule) Description() string {
	return "Flags SSH host keys whose size is below the currently accepted minimum (e.g. RSA < 2048 bits)."
}

func (r *hostKeyStrengthRule) Evaluate(ctx context.Context, obs sdk.ObservationGetter, _ sdk.CheckerOptions) []sdk.CheckState {
	data, errSt := loadSSHData(ctx, obs)
	if errSt != nil {
		return []sdk.CheckState{*errSt}
	}
	var anyKey bool
	var issues []Issue
	for _, ep := range data.Endpoints {
		if len(ep.HostKeys) > 0 {
			anyKey = true
		}
		// Also flag endpoints that reached KEXINIT but failed to
		// produce any host key: the handshake didn't complete.
		if len(ep.KEX) > 0 {
			issues = append(issues, analyseHandshakeHostKey(ep.Address, true, ep.HostKeys)...)
		}
		issues = append(issues, analyseHostKeyStrength(ep.Address, ep.HostKeys)...)
	}
	if !anyKey && len(issues) == 0 {
		return []sdk.CheckState{notTestedState("ssh.host_key_strength.skipped", "No host key observed on any reachable endpoint.")}
	}
	if len(issues) == 0 {
		return []sdk.CheckState{passState("ssh.host_key_strength.ok", "Every observed host key meets the minimum accepted size.")}
	}
	return statesFromIssues(issues)
}