//! Caller authentication helpers for service-shaped Lyquids.

//!

//! Service Lyquids expose state-changing methods to two distinct categories of caller:

//!

//! 1. **Lyquid orchestrator** — another Lyquid (the caller in a UPC chain) is allowed to

//!    submit intents. Authenticate with [`assert_authorized_lyquid_caller`], passing a

//!    `RequiredLyquid` field from the service's state.

//! 2. **EOA driver** — an off-chain runtime holding an EVM key records plans and drives

//!    operations. Authenticate with [`assert_authorized_eoa_caller`], passing an

//!    `Address` field.

//!

//! Both helpers reject the zero/default address; services should refuse state mutation

//! until init explicitly seats the authorized identity. The `role` argument shows up in

//! the error message ("expected authorized orchestrator") for grep-friendly debugging.

//!

//! These are deliberately plain functions rather than macros — trust boundaries should

//! be visible at the call site in code review, not hidden inside an attribute.

use lyquor_primitives::{Address, LyquidID, RequiredLyquid};

/// Returns `Ok(())` iff `caller` matches the Lyquid pinned in `expected`. Rejects an

/// uninitialized (`RequiredLyquid::default()`) `expected` so a service refuses caller-

/// gated methods until init has explicitly seated the orchestrator.

pub fn assert_authorized_lyquid_caller(caller: Address, expected: &RequiredLyquid, role: &str) -> Result<(), String> {

    if expected.0 == LyquidID::default() {

        return Err(format!("{role} not initialized"));

    }

    let expected_addr = Address::from(expected.0);

    if caller != expected_addr {

        return Err(format!(

            "unauthorized caller {caller}; expected authorized {role} {expected_addr}"

        ));

    }

    Ok(())

}

/// Returns `Ok(())` iff `caller == expected`. Rejects `Address::default()` so a service

/// refuses caller-gated methods until init has explicitly seated the EOA.

pub fn assert_authorized_eoa_caller(caller: Address, expected: Address, role: &str) -> Result<(), String> {

    if expected == Address::default() {

        return Err(format!("{role} not initialized"));

    }

    if caller != expected {

        return Err(format!(

            "unauthorized caller {caller}; expected authorized {role} {expected}"

        ));

    }

    Ok(())

}

/// Returns `Ok(())` iff `caller == deployer`. Used to gate admin-style ABIs

/// (`set_self_dispatch_enabled`, `set_authorized_orchestrator`, etc.) so only the

/// account that constructed the Lyquid can flip them. `action` shows up in the error

/// message ("only deployer can configure self dispatch") for grep-friendly debugging.

pub fn assert_deployer_caller(caller: Address, deployer: Address, action: &str) -> Result<(), String> {

    if caller != deployer {

        return Err(format!(

            "only deployer can {action}; caller={caller}, deployer={deployer}"

        ));

    }

    Ok(())

}

#[cfg(test)]

mod tests {

    use super::*;

    fn lyquid(b: u8) -> RequiredLyquid {

        RequiredLyquid(LyquidID([b; 20]))

    }

    fn addr_from_byte(b: u8) -> Address {

        Address::from(LyquidID([b; 20]))

    }

    #[test]

    fn lyquid_caller_rejects_uninitialized() {

        let caller = addr_from_byte(0x11);

        let err = assert_authorized_lyquid_caller(caller, &RequiredLyquid::default(), "orchestrator")

            .expect_err("default expected must be rejected");

        assert!(err.contains("orchestrator not initialized"), "got: {err}");

    }

    #[test]

    fn lyquid_caller_rejects_mismatch() {

        let expected = lyquid(0xaa);

        let wrong = addr_from_byte(0xbb);

        let err =

            assert_authorized_lyquid_caller(wrong, &expected, "orchestrator").expect_err("mismatch must be rejected");

        assert!(err.contains("unauthorized caller"), "got: {err}");

        assert!(err.contains("orchestrator"), "role missing from error: {err}");

    }

    #[test]

    fn lyquid_caller_accepts_match() {

        let expected = lyquid(0xcc);

        let matching = Address::from(expected.0);

        assert_authorized_lyquid_caller(matching, &expected, "orchestrator").expect("match must accept");

    }

    #[test]

    fn eoa_caller_rejects_uninitialized() {

        let caller = addr_from_byte(0x11);

        let err = assert_authorized_eoa_caller(caller, Address::default(), "driver")

            .expect_err("default expected must be rejected");

        assert!(err.contains("driver not initialized"), "got: {err}");

    }

    #[test]

    fn eoa_caller_rejects_mismatch() {

        let expected = addr_from_byte(0x11);

        let wrong = addr_from_byte(0x22);

        let err = assert_authorized_eoa_caller(wrong, expected, "driver").expect_err("mismatch must be rejected");

        assert!(err.contains("unauthorized caller"), "got: {err}");

        assert!(err.contains("driver"), "role missing from error: {err}");

    }

    #[test]

    fn eoa_caller_accepts_match() {

        let expected = addr_from_byte(0x33);

        assert_authorized_eoa_caller(expected, expected, "driver").expect("match must accept");

    }

    #[test]

    fn deployer_caller_rejects_mismatch() {

        let deployer = addr_from_byte(0x44);

        let wrong = addr_from_byte(0x55);

        let err =

            assert_deployer_caller(wrong, deployer, "configure self dispatch").expect_err("mismatch must be rejected");

        assert!(err.contains("only deployer can configure self dispatch"), "got: {err}");

        assert!(err.contains("caller="), "caller missing from error: {err}");

    }

    #[test]

    fn deployer_caller_accepts_match() {

        let deployer = addr_from_byte(0x66);

        assert_deployer_caller(deployer, deployer, "configure").expect("match must accept");

    }

}