-module(albedo_cached_fetch).
%% The one bounded fetch every url-backed cache shares: the models.dev
%% catalog and the cache-ttl table. https-or-loopback urls only, a background
%% refresh when the cache is stale (one registered process per cache, a
%% duplicate spawn killed), an explicit reload that reports failures, and the
%% rename-commit write a failed fetch never reaches.
%%
%% `What` labels every error so each caller keeps its wording. `Accept`
%% validates — and may trim — the body, enforcing its own size cap, before
%% anything is committed. `After` runs once the cache file has been replaced,
%% for the caller's own derived state (the models catalog drops its parse
%% index).

-export([safe_url/1, refresh/7, reload/5, commit/4, isolated/2]).

-define(FETCH_TIMEOUT_MS, 30000).

refresh(Cache0, Url0, MaxAgeMs, RefreshName, What, Accept, After) ->
    Cache = text(Cache0),
    Url = unicode:characters_to_binary(Url0),
    case albedo_credentials:stale(Cache, MaxAgeMs) andalso safe_url(Url) of
        false -> nil;
        true ->
            Pid = spawn(fun() -> fetch_commit(Cache, Url, What, Accept, After) end),
            try register(RefreshName, Pid) of
                true -> nil
            catch
                _:_ -> exit(Pid, kill), nil
            end
    end.

reload(Cache0, Url0, What, Accept, After) ->
    Cache = text(Cache0),
    Url = unicode:characters_to_binary(Url0),
    try
        case safe_url(Url) of
            true -> isolated(What, fun() -> fetch_commit(Cache, Url, What, Accept, After) end);
            false -> {error, <<What/binary, " URL must use https or loopback http">>}
        end
    catch
        _:_ -> {error, <<What/binary, " URL is invalid">>}
    end.

%% A partly written cache must never be readable, so the rename is the commit.
%% Exported for the models catalog's in-place retrim, which rewrites a cached
%% file the same way a fetch would.
commit(Cache0, Bytes, What, After) ->
    Cache = text(Cache0),
    case albedo_credentials:write(Cache, Bytes) of
        ok -> After(Cache), {ok, nil};
        {error, {rename, _}} -> {error, <<What/binary, " cache could not be replaced">>};
        _ -> {error, <<What/binary, " cache could not be written">>}
    end.

%% https anywhere; plain http only on loopback, which keeps tests local.
safe_url(Url) ->
    Parsed = uri_string:parse(Url),
    Scheme = maps:get(scheme, Parsed, undefined),
    Host = string:lowercase(maps:get(host, Parsed, <<>>)),
    Scheme =:= <<"https">> orelse
        (Scheme =:= <<"http">> andalso
         lists:member(Host, [<<"localhost">>, <<"127.0.0.1">>, <<"::1">>])).

fetch_commit(Cache, Url, What, Accept, After) ->
    case fetch(Url, What, Accept) of
        {ok, Bytes} -> commit(Cache, Bytes, What, After);
        Error -> Error
    end.

fetch(Url, What, Accept) ->
    Headers = [{"user-agent", "albedo"}, {"accept", "application/json"}],
    case albedo_http:get(Url, Headers, ?FETCH_TIMEOUT_MS, 10000) of
        {ok, {200, _, Body}} -> Accept(Body);
        {ok, {Status, _, _}} ->
            {error, iolist_to_binary([What, io_lib:format(" returned HTTP ~B", [Status])])};
        {error, _} -> {error, <<What/binary, " request failed">>}
    end.

%% Runs Fun in a fresh process so a large decode's garbage dies with it
%% instead of growing the caller's heap for the rest of its life. Fun's result
%% crosses back as an exit reason, so it must be small. Exported because the
%% models catalog's parse path isolates its decode the same way.
isolated(What, Fun) ->
    {Pid, Ref} = spawn_monitor(fun() -> exit({done, Fun()}) end),
    receive
        {'DOWN', Ref, process, Pid, {done, Result}} -> Result;
        {'DOWN', Ref, process, Pid, _} -> {error, <<What/binary, " could not be read">>}
    end.

text(Value) -> unicode:characters_to_list(Value).