//! The builtin image store: pulls OCI images, unpacks them into rootfs directories and garbage
//! collects them. Everything lives under one root directory:
//!
//! - `blobs/sha256/<hex>`: verified layer blobs, as pulled (compressed)
//! - `rootfs/<hex>/`: the unpacked rootfs for one manifest digest
//! - `meta/<hex>.json`: env, working dir, user and layer digests for that rootfs
//! - `tags/<encoded ref>`: the digest that a reference last resolved to
//! - `locks/<hex>.lock`: held while an image is pulled or unpacked
//! - `last_used/<hex>`: a stamp file, touched on every use, for garbage collection

mod helper;
mod pull;
mod store;
pub mod unpack;

use std::fmt;
use std::path::PathBuf;

pub use helper::unpack_helper_main;
pub use store::{GcStats, ImageStore};
pub use unpack::{Ownership, UnpackError, UnpackStats};

/// Errors from pulling, verifying, unpacking or collecting images.
#[derive(Debug, thiserror::Error)]
pub enum ImageError {
    #[error("invalid image reference {image}: {reason}")]
    InvalidReference { image: String, reason: String },
    #[error("registry error for {image}: {source}")]
    Registry {
        image: String,
        #[source]
        source: oci_client::errors::OciDistributionError,
    },
    #[error("unsupported or malformed digest {0}, only sha256:<hex> is supported")]
    UnsupportedDigest(String),
    #[error("blob digest mismatch: expected {expected}, got {actual}")]
    DigestMismatch { expected: String, actual: String },
    #[error("image config or metadata is not valid JSON: {0}")]
    Json(#[from] serde_json::Error),
    #[error("{0}")]
    Unpack(#[from] UnpackError),
    #[error("I/O error: {0}")]
    Io(#[from] std::io::Error),
    #[error("background task failed: {0}")]
    Task(#[from] tokio::task::JoinError),
}

/// Basic-auth credentials for a registry. The password is never printed.
#[derive(Clone)]
pub struct RegistryAuth {
    pub username: String,
    pub password: String,
}

impl fmt::Debug for RegistryAuth {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.debug_struct("RegistryAuth")
            .field("username", &self.username)
            .field("password", &"<redacted>")
            .finish()
    }
}

/// An image ready to run: its rootfs directory and the settings from its config.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct PreparedImage {
    pub rootfs: PathBuf,
    /// The manifest digest, `sha256:<hex>`.
    pub digest: String,
    /// The image config `Env` list, as `NAME=value` strings. Empty when the image sets none.
    pub env: Vec<String>,
    pub working_dir: Option<String>,
    pub user: Option<String>,
}