// Package certpaths centralizes the on-disk locations of the CA and
// server cert/key files. The CLI layer, the security layer, and the
// doctor layer all need to agree on these paths, so they're factored
// into their own package to avoid import cycles (cli <-> doctor).
package certpaths

import (
	"os"
	"path/filepath"
)

const (
	defaultCADir   = ".orca"
	caCertFilename = "ca.crt"
	caKeyFilename  = "ca.key"
)

// Dir returns the directory the local CA lives in. Honors $ORCA_HOME
// for testability; otherwise defaults to ~/.orca.
func Dir() string {
	if p := os.Getenv("ORCA_HOME"); p != "" {
		return p
	}
	home, _ := os.UserHomeDir()
	return filepath.Join(home, defaultCADir)
}

// CACertPath returns the path to ca.crt.
func CACertPath() string { return filepath.Join(Dir(), caCertFilename) }

// CAKeyPath returns the path to ca.key.
func CAKeyPath() string { return filepath.Join(Dir(), caKeyFilename) }

// ServerCertPath returns the path to server.crt.
func ServerCertPath() string { return filepath.Join(Dir(), "server.crt") }

// ServerKeyPath returns the path to server.key.
func ServerKeyPath() string { return filepath.Join(Dir(), "server.key") }

// DBPath returns the path to the orca SQLite database. Honors $ORCA_DB
// for testability and explicit override; otherwise defaults to
// ~/.orca/orca.db under the same Dir() as the cert files.
func DBPath() string {
	if p := os.Getenv("ORCA_DB"); p != "" {
		return p
	}
	return filepath.Join(Dir(), "orca.db")
}

// SSHKeyPath returns the path to the orca SSH private key (Ed25519,
// D-037). Used by `orca node join --type proxmox` to authenticate
// to remote Proxmox hosts after the initial password-based bootstrap.
// File mode 0600 (enforced by security.WriteKey).
func SSHKeyPath() string { return filepath.Join(Dir(), "orca_ssh_key") }

// SSHPubPath returns the path to the orca SSH public key (authorized_keys
// format). Deployed to remote Proxmox hosts during `orca node join`.
// File mode 0644 (enforced by security.WriteCert).
func SSHPubPath() string { return filepath.Join(Dir(), "orca_ssh_key.pub") }

// KnownHostsPath returns the path to the SSH known_hosts file used for
// TOFU host-key pinning (D-035). Captured on first connect, verified
// on all subsequent connects via golang.org/x/crypto/ssh/knownhosts.
func KnownHostsPath() string { return filepath.Join(Dir(), "known_hosts") }