// Package certpaths is the v0.8 path shim. It returns v0.8 flat-layout
// paths for backward compatibility during the v0.9 dual-write window
// (REQ-090). The v0.9 paths package (internal/paths) returns the new
// multi-namespace layout (R-002).
//
// certpaths will be deleted after the v0.10-P14 migration. New code
// should use internal/paths, NOT certpaths.
//
// Migration notes (per v0.10-P14):
//   - CA cert/key, server cert/key, SSH key/pub, known_hosts currently
//     live at the flat Root() location. The v0.9 internal/paths package
//     returns the new ClusterDir()/... locations; certpaths keeps the
//     v0.8 flat locations until the CA migration moves them.
//   - DBPath keeps returning Root()/orca.db (v0.8 location). The new
//     paths.NSDb("_defaults") returns Root()/_defaults/db/orca.db; the DB
//     moves in v0.10-P14.
package certpaths

import (
	"os"
	"path/filepath"

	"git.cloudinit.dev/coreci/orca/internal/paths"
)

// Dir returns the v0.8 flat root directory. Delegates to paths.Root()
// (which honors $ORCA_HOME, else ~/.orca). v0.8 callers expect the CA
// and DB to live directly under this directory; that does not change
// until the v0.10-P14 migration.
func Dir() string { return paths.Root() }

// CACertPath returns the v0.8 CA cert path: Dir()/ca.crt.
// The v0.9 location is paths.CACertPath() = ClusterDir()/ca.crt; certpaths
// keeps the v0.8 flat location until the CA migration in v0.10-P14.
func CACertPath() string { return filepath.Join(paths.Root(), "ca.crt") }

// CAKeyPath returns the v0.8 CA key path: Dir()/ca.key.
// See CACertPath for migration notes.
func CAKeyPath() string { return filepath.Join(paths.Root(), "ca.key") }

// ServerCertPath returns the v0.8 server cert path: Dir()/server.crt.
// See CACertPath for migration notes.
func ServerCertPath() string { return filepath.Join(paths.Root(), "server.crt") }

// ServerKeyPath returns the v0.8 server key path: Dir()/server.key.
// See CACertPath for migration notes.
func ServerKeyPath() string { return filepath.Join(paths.Root(), "server.key") }

// DBPath returns the path to the orca SQLite database. Honors $ORCA_DB
// for testability and explicit override; otherwise defaults to the v0.8
// flat location Dir()/orca.db. The v0.9 location is
// paths.NSDb(paths.DefaultNamespace()) = Root()/_defaults/db/orca.db;
// certpaths keeps the v0.8 flat location until the DB move in v0.10-P14.
func DBPath() string {
	if p := os.Getenv("ORCA_DB"); p != "" {
		return p
	}
	return filepath.Join(paths.Root(), "orca.db")
}

// SSHKeyPath returns the v0.8 SSH private key path: Dir()/orca_ssh_key.
// The v0.9 location is paths.SSHKeyPath() = ClusterDir()/orca_ssh_key;
// certpaths keeps the v0.8 flat location until the migration.
func SSHKeyPath() string { return filepath.Join(paths.Root(), "orca_ssh_key") }

// SSHPubPath returns the v0.8 SSH public key path: Dir()/orca_ssh_key.pub.
// See SSHKeyPath for migration notes.
func SSHPubPath() string { return filepath.Join(paths.Root(), "orca_ssh_key.pub") }

// KnownHostsPath returns the v0.8 known_hosts path: Dir()/known_hosts.
// The v0.9 location is paths.KnownHostsPath() = ClusterDir()/known_hosts;
// certpaths keeps the v0.8 flat location until the migration.
func KnownHostsPath() string { return filepath.Join(paths.Root(), "known_hosts") }