package workerruntime

import (
	"net/url"
	"strings"
)

// SPIFFEIdentity returns the ID from an exact workload SPIFFE URI SAN. The
// control plane accepts no URI decorations so certificate parsing and server
// authorization use the same identity boundary.
func SPIFFEIdentity(uri *url.URL, trustDomain, environment, role string) (string, bool) {
	if uri == nil || trustDomain == "" || environment == "" || (role != "worker" && role != "checker") ||
		uri.Scheme != "spiffe" || uri.Host != trustDomain || uri.User != nil || uri.Port() != "" ||
		uri.Opaque != "" || uri.RawPath != "" || uri.RawQuery != "" || uri.ForceQuery || uri.Fragment != "" {
		return "", false
	}
	segments := strings.Split(uri.Path, "/")
	if len(segments) != 4 || segments[0] != "" || segments[1] != environment || segments[2] != role || !ValidIdentifier(segments[3]) {
		return "", false
	}
	return segments[3], true
}

// SingleSPIFFEIdentity validates the X.509-SVID requirement that a workload
// certificate carries exactly one URI SAN before extracting its identity.
func SingleSPIFFEIdentity(uris []*url.URL, trustDomain, environment, role string) (string, bool) {
	if len(uris) != 1 {
		return "", false
	}
	return SPIFFEIdentity(uris[0], trustDomain, environment, role)
}