credentials.rs

//! Exchange API credentials editing — schemas, `.env` IO, secret masking.
//!
//! Backend for the `/credentials` web UI page. Stores credentials in the
//! same `.env` file that [`crate::main::dotenv_if_exists`] reads at
//! startup — there is no second source of truth. Applying new credentials
//! requires a full bot restart via `/api/restart` (same path operators
//! already use for config changes that need a restart).
//!
//! Safety model:
//!   - GET endpoints never return full secret values — only last-4 preview.
//!   - Writes are atomic (tmp file + rename) with `chmod 600`.
//!   - A timestamped backup of the previous `.env` is kept in the repo root
//!     (`.env.bak.<unix_ts>`), last 5 retained.
//!   - POST validates candidate credentials via the exchange's own
//!     `fetch_taker_fee` before touching disk; a failing test blocks the save.
//!   - Field name allowlist enforced from the hardcoded schemas so the
//!     endpoint can never inject arbitrary env vars.

use std::collections::HashMap;
use std::future::Future;
use std::io::Write;
use std::path::{Path, PathBuf};
use std::pin::Pin;

use serde::Serialize;

/// Where the `.env` file lives relative to the bot's working directory.
/// Matches `dotenv_if_exists()` in [`main.rs`].
pub const ENV_FILE: &str = ".env";

#[derive(Debug, Clone, Copy, Serialize, PartialEq, Eq)]
#[serde(rename_all = "lowercase")]
pub enum FieldKind {
    /// Plain text — shown verbatim in GET responses.
    Text,
    /// Integer — shown verbatim in GET responses.
    Number,
    /// Secret — only last-4 preview is returned by GET; full value only
    /// ever flows in from POST body.
    Secret,
}

#[derive(Debug, Clone, Serialize)]
pub struct CredentialField {
    /// Suffix after the exchange prefix — e.g. `"PRIVATE_KEY"` for
    /// `LIGHTER_PRIVATE_KEY`. Matches `ExchangeSecrets::require`.
    pub key: String,
    /// Full env var name as it appears in `.env` (for display + write).
    pub env_name: String,
    pub label: &'static str,
    pub kind: FieldKind,
    pub required: bool,
}

#[derive(Debug, Clone, Serialize)]
pub struct ExchangeCredentialSchema {
    pub exchange_id: &'static str,
    pub display_name: &'static str,
    pub fields: Vec<CredentialField>,
}

impl ExchangeCredentialSchema {
    pub fn find_field(&self, key: &str) -> Option<&CredentialField> {
        self.fields.iter().find(|f| f.key == key)
    }
}

fn f(key: &str, env_name: &str, label: &'static str, kind: FieldKind, required: bool) -> CredentialField {
    CredentialField { key: key.to_string(), env_name: env_name.to_string(), label, kind, required }
}

// ─── Per-exchange credentials (trait-based dispatch) ────────────────────────
//
// Adding a new exchange means:
//   1. Define a zero-sized struct (e.g. `struct NewexCredentials;`).
//   2. Implement `ExchangeCredentials` for it — `schema()` returns the field
//      list, `validate()` does the real auth check.
//   3. Register the struct in `registry()` below.
//
// Everything else (`schemas()`, `schema_for()`, `validate_credentials()`,
// the web routes) reads from the registry, so there is no dispatch match
// arm to keep in sync. The `schemas_cover_all_configured_factories` test
// still guards against forgetting the registry entry itself.

/// Validation entry for a single exchange. Implementations are zero-sized
/// and live right below in this file — keeping schema + validate together
/// means adding an exchange is a single-struct edit.
trait ExchangeCredentials: Send + Sync {
    fn schema(&self) -> ExchangeCredentialSchema;

    /// Owned `env_path` + `'static` future so the dispatcher can iterate
    /// `Vec<Box<dyn ExchangeCredentials>>` without lifetime gymnastics —
    /// the implementations are zero-sized, the Box allocates nothing.
    fn validate(
        &self,
        env_path: PathBuf,
        overrides: HashMap<String, String>,
    ) -> Pin<Box<dyn Future<Output = Result<ValidationOk, ValidationError>> + Send + 'static>>;
}

struct LighterCredentials;
struct ExtendedCredentials;
struct Zero1Credentials;
struct HyperliquidCredentials;
struct BybitCredentials;

impl ExchangeCredentials for LighterCredentials {
    fn schema(&self) -> ExchangeCredentialSchema {
        ExchangeCredentialSchema {
            exchange_id: "lighter",
            display_name: "Lighter",
            fields: vec![
                f("ACCOUNT_INDEX", "LIGHTER_ACCOUNT_INDEX", "Account Index", FieldKind::Number, true),
                f("API_KEY_INDEX", "LIGHTER_API_KEY_INDEX", "API Key Index", FieldKind::Number, true),
                f("PRIVATE_KEY",   "LIGHTER_PRIVATE_KEY",   "Private Key (hex)", FieldKind::Secret, true),
            ],
        }
    }
    fn validate(
        &self,
        env_path: PathBuf,
        overrides: HashMap<String, String>,
    ) -> Pin<Box<dyn Future<Output = Result<ValidationOk, ValidationError>> + Send + 'static>> {
        Box::pin(async move { validate_lighter(&env_path, overrides).await })
    }
}

impl ExchangeCredentials for ExtendedCredentials {
    fn schema(&self) -> ExchangeCredentialSchema {
        ExchangeCredentialSchema {
            exchange_id: "extended",
            display_name: "Extended",
            fields: vec![
                f("API_KEY",            "EXTENDED_API_KEY",            "API Key",            FieldKind::Secret, true),
                f("STARK_PRIVATE_KEY",  "EXTENDED_STARK_PRIVATE_KEY",  "Stark Private Key",  FieldKind::Secret, true),
                f("STARK_PUBLIC_KEY",   "EXTENDED_STARK_PUBLIC_KEY",   "Stark Public Key",   FieldKind::Text,   false),
                f("VAULT_ID",           "EXTENDED_VAULT_ID",           "Vault ID",           FieldKind::Text,   false),
            ],
        }
    }
    fn validate(
        &self,
        env_path: PathBuf,
        overrides: HashMap<String, String>,
    ) -> Pin<Box<dyn Future<Output = Result<ValidationOk, ValidationError>> + Send + 'static>> {
        Box::pin(async move { validate_extended(&env_path, overrides).await })
    }
}

impl ExchangeCredentials for Zero1Credentials {
    fn schema(&self) -> ExchangeCredentialSchema {
        ExchangeCredentialSchema {
            exchange_id: "zero1",
            display_name: "01 (Zero1)",
            fields: vec![
                f("KEYPAIR_B58", "ZERO1_KEYPAIR_B58", "Keypair (base58)",      FieldKind::Secret, true),
                f("ACCOUNT_ID",  "ZERO1_ACCOUNT_ID",  "Account ID",            FieldKind::Number, false),
            ],
        }
    }
    fn validate(
        &self,
        env_path: PathBuf,
        overrides: HashMap<String, String>,
    ) -> Pin<Box<dyn Future<Output = Result<ValidationOk, ValidationError>> + Send + 'static>> {
        Box::pin(async move { validate_zero1(&env_path, overrides).await })
    }
}

impl ExchangeCredentials for HyperliquidCredentials {
    fn schema(&self) -> ExchangeCredentialSchema {
        ExchangeCredentialSchema {
            exchange_id: "hyperliquid",
            display_name: "Hyperliquid",
            fields: vec![
                f("API_PRIVATE_KEY",     "HYPERLIQUID_API_PRIVATE_KEY",     "API Wallet Private Key (hex, 0x…)", FieldKind::Secret, true),
                f("API_WALLET_ADDRESS", "HYPERLIQUID_API_WALLET_ADDRESS", "API Wallet Address (0x…)",          FieldKind::Text,   false),
                f("ACCOUNT_ADDRESS",    "HYPERLIQUID_ACCOUNT_ADDRESS",    "Account Address (0x…)",             FieldKind::Text,   true),
            ],
        }
    }
    fn validate(
        &self,
        env_path: PathBuf,
        overrides: HashMap<String, String>,
    ) -> Pin<Box<dyn Future<Output = Result<ValidationOk, ValidationError>> + Send + 'static>> {
        Box::pin(async move { validate_hyperliquid(&env_path, overrides).await })
    }
}

impl ExchangeCredentials for BybitCredentials {
    fn schema(&self) -> ExchangeCredentialSchema {
        ExchangeCredentialSchema {
            exchange_id: "bybit",
            display_name: "Bybit",
            fields: vec![
                f("API_KEY",    "BYBIT_API_KEY",    "API Key",    FieldKind::Secret, true),
                f("API_SECRET", "BYBIT_API_SECRET", "API Secret", FieldKind::Secret, true),
            ],
        }
    }
    fn validate(
        &self,
        env_path: PathBuf,
        overrides: HashMap<String, String>,
    ) -> Pin<Box<dyn Future<Output = Result<ValidationOk, ValidationError>> + Send + 'static>> {
        Box::pin(async move { validate_bybit(&env_path, overrides).await })
    }
}

/// All registered exchanges, in stable iteration order matching the web UI
/// layout. Adding a new exchange = add one `Box::new(...)` line.
fn registry() -> Vec<Box<dyn ExchangeCredentials>> {
    vec![
        Box::new(LighterCredentials),
        Box::new(ExtendedCredentials),
        Box::new(Zero1Credentials),
        Box::new(HyperliquidCredentials),
        Box::new(BybitCredentials),
    ]
}

/// Schemas for every registered exchange. Keys map 1:1 to the field names
/// used in [`crate::config::ExchangeSecrets::require`] inside
/// `Config::lighter()` / `extended()` / `zero1()`.
pub fn schemas() -> Vec<ExchangeCredentialSchema> {
    registry().iter().map(|c| c.schema()).collect()
}

pub fn schema_for(exchange_id: &str) -> Option<ExchangeCredentialSchema> {
    schemas().into_iter().find(|s| s.exchange_id == exchange_id)
}

/// Mask a secret for display: all but the last 4 chars replaced with `•`.
/// Empty → "(unset)". ≤4 chars → all dots.
pub fn mask_secret(value: &str) -> String {
    if value.is_empty() {
        return "(unset)".to_string();
    }
    if value.len() <= 4 {
        return "••••".to_string();
    }
    let last4: String = value.chars().rev().take(4).collect::<Vec<_>>().into_iter().rev().collect();
    format!("••••{last4}")
}

// ─── .env IO ────────────────────────────────────────────────────────────────

/// Parse a `.env` file into a `(key, value)` map. Comments and blank lines
/// are ignored, values are stripped of surrounding single/double quotes —
/// same rules as `dotenv_if_exists()` in main.rs.
pub fn read_env_file(path: &Path) -> std::io::Result<HashMap<String, String>> {
    let content = std::fs::read_to_string(path)?;
    let mut map = HashMap::new();
    for line in content.lines() {
        let line = line.trim();
        if line.is_empty() || line.starts_with('#') { continue; }
        if let Some((k, v)) = line.split_once('=') {
            let key = k.trim().to_string();
            let val = v.trim().trim_matches('"').trim_matches('\'').to_string();
            map.insert(key, val);
        }
    }
    Ok(map)
}

/// Apply a set of key→value updates to the on-disk `.env`.
///
/// Behavior:
///   - Existing lines with one of the updated keys are replaced in place
///     (preserving file order and comments above them).
///   - New keys are appended at the end of the file.
///   - Empty override values are IGNORED by the caller before this fn runs —
///     this fn applies whatever you pass verbatim.
///   - Before writing, a backup copy is saved as `.env.bak.<unix_ts>`
///     with mode 600; oldest backups are trimmed so only 5 remain.
///   - The new file is written to `.env.tmp`, `chmod 600`, then `rename`d
///     into place.
pub fn write_env_file(path: &Path, updates: &HashMap<String, String>) -> std::io::Result<()> {
    let original = std::fs::read_to_string(path).unwrap_or_default();

    // Backup first (best effort; a backup failure should not block the write).
    if !original.is_empty()
        && let Err(e) = backup_env(path, &original) {
            tracing::warn!(error = %e, "Failed to back up .env before rewrite");
        }

    let mut seen: std::collections::HashSet<String> = std::collections::HashSet::new();
    let mut out = String::new();
    for line in original.lines() {
        let trimmed = line.trim_start();
        if trimmed.is_empty() || trimmed.starts_with('#') {
            out.push_str(line);
            out.push('\n');
            continue;
        }
        if let Some((k, _)) = line.split_once('=') {
            let key = k.trim().to_string();
            if let Some(new_val) = updates.get(&key) {
                out.push_str(&format!("{key}={new_val}\n"));
                seen.insert(key);
                continue;
            }
        }
        out.push_str(line);
        out.push('\n');
    }
    // Append any keys we didn't find in the file.
    for (k, v) in updates {
        if !seen.contains(k) {
            out.push_str(&format!("{k}={v}\n"));
        }
    }

    atomic_write_600(path, out.as_bytes())
}

fn backup_env(path: &Path, content: &str) -> std::io::Result<()> {
    let ts = std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .map(|d| d.as_secs())
        .unwrap_or(0);
    let parent = path.parent().unwrap_or_else(|| Path::new("."));
    let backup = parent.join(format!(".env.bak.{ts}"));
    atomic_write_600(&backup, content.as_bytes())?;
    trim_old_backups(path, 5)?;
    Ok(())
}

fn trim_old_backups(env_path: &Path, keep: usize) -> std::io::Result<()> {
    let parent = env_path.parent().unwrap_or_else(|| Path::new("."));
    let mut entries: Vec<(u64, PathBuf)> = Vec::new();
    for entry in std::fs::read_dir(parent)? {
        let Ok(entry) = entry else { continue };
        let name = entry.file_name().to_string_lossy().to_string();
        if let Some(rest) = name.strip_prefix(".env.bak.")
            && let Ok(ts) = rest.parse::<u64>() {
                entries.push((ts, entry.path()));
            }
    }
    if entries.len() <= keep { return Ok(()); }
    entries.sort_by_key(|(ts, _)| *ts);
    let to_remove = entries.len() - keep;
    for (_, p) in entries.into_iter().take(to_remove) {
        let _ = std::fs::remove_file(p);
    }
    Ok(())
}

fn atomic_write_600(path: &Path, bytes: &[u8]) -> std::io::Result<()> {
    let parent = path.parent().unwrap_or_else(|| Path::new("."));
    let fname = path.file_name().map(|s| s.to_string_lossy().to_string()).unwrap_or_else(|| "env".to_string());
    let tmp = parent.join(format!("{fname}.tmp.{}", std::process::id()));
    {
        let mut f = std::fs::OpenOptions::new()
            .write(true)
            .create(true)
            .truncate(true)
            .open(&tmp)?;
        f.write_all(bytes)?;
        f.sync_all()?;
    }
    set_mode_600(&tmp)?;
    std::fs::rename(&tmp, path)?;
    // Belt-and-braces: ensure final file is 600 even if rename preserved
    // a wider mask from a pre-existing file.
    set_mode_600(path)?;
    Ok(())
}

#[cfg(unix)]
fn set_mode_600(path: &Path) -> std::io::Result<()> {
    use std::os::unix::fs::PermissionsExt;
    let perms = std::fs::Permissions::from_mode(0o600);
    std::fs::set_permissions(path, perms)
}

#[cfg(not(unix))]
fn set_mode_600(_path: &Path) -> std::io::Result<()> { Ok(()) }

// ─── `.env`-backed secret reader ────────────────────────────────────────────

/// Read `.env` and return an `ExchangeSecrets` for the given exchange.
/// Unlike `Config::load()`, this does NOT touch `std::env::vars()` — so
/// the credentials UI always sees the on-disk file, not a process env
/// that may have been frozen at bot-start time.
pub fn read_env_secrets_from_file(
    env_path: &Path,
    exchange_id: &str,
) -> crate::config::ExchangeSecrets {
    let file = read_env_file(env_path).unwrap_or_default();
    let prefix = format!("{}_", exchange_id.to_uppercase());
    let stripped: HashMap<String, String> = file
        .into_iter()
        .filter_map(|(k, v)| k.strip_prefix(&prefix).map(|suf| (suf.to_string(), v)))
        .collect();
    crate::config::ExchangeSecrets::from_map(stripped)
}

/// Apply overrides on top of on-disk `.env` secrets. Empty overrides are
/// ignored (= "leave as-is").
pub fn read_env_secrets_with_overrides(
    env_path: &Path,
    exchange_id: &str,
    overrides: &HashMap<String, String>,
) -> crate::config::ExchangeSecrets {
    let mut file = read_env_file(env_path).unwrap_or_default();
    let prefix = format!("{}_", exchange_id.to_uppercase());
    let mut stripped: HashMap<String, String> = file
        .drain()
        .filter_map(|(k, v)| k.strip_prefix(&prefix).map(|suf| (suf.to_string(), v)))
        .collect();
    for (k, v) in overrides {
        if v.is_empty() { continue; }
        stripped.insert(k.clone(), v.clone());
    }
    crate::config::ExchangeSecrets::from_map(stripped)
}

// ─── Credential validation (read-only, per exchange) ───────────────────────

/// Sanitized validation outcome — safe to return verbatim to the client.
#[derive(Debug, Default)]
pub struct ValidationOk {
    /// Human-readable summary for the UI (e.g. "taker fee 0.0004").
    pub summary: String,
    /// Fields auto-resolved during validation (e.g. Extended derives
    /// STARK_PUBLIC_KEY from the private key and fetches VAULT_ID from
    /// `/user/account/info`). Keys are schema field names (not env names).
    /// The server merges these into the .env write so the user sees them
    /// filled in after restart without having to type anything.
    pub resolved: HashMap<String, String>,
}

/// Validation error with an internal (full) message and an external
/// (sanitized) message. Caller logs the internal one; the client sees
/// only the external one.
#[derive(Debug)]
pub struct ValidationError {
    pub external: String,
    pub internal: String,
}

impl ValidationError {
    fn new(external: impl Into<String>, internal: impl Into<String>) -> Self {
        Self { external: external.into(), internal: internal.into() }
    }
    fn same(msg: impl Into<String>) -> Self {
        let s: String = msg.into();
        Self { external: s.clone(), internal: s }
    }
}

/// Validate candidate credentials for a given exchange WITHOUT writing to
/// disk. Each branch does a real read-only auth check scoped to the keys
/// that will actually be used at runtime.
///
///   - Lighter: authenticated REST call via `fetch_taker_fee` (covers
///     private_key + account_index + api_key_index).
///   - Extended: two-step — (1) authenticated `x-api-key` REST call via
///     `fetch_taker_fee`; (2) Stark keypair pair-check (private → derived
///     pub must equal configured pub). Vault id numeric format check.
///   - Zero1: construct `Zero1UserSigner` from the configured keypair,
///     then `rest.user(pubkey)` and assert that `account_ids` contains
///     the configured `account_id`. Catches the `account_id=0` case that
///     `fetch_taker_fee` silently falls back through.
///
/// Returns `Ok(ValidationOk)` on success. `ValidationError::external`
/// is intended for the API response; `internal` should be logged.
pub async fn validate_credentials(
    env_path: &Path,
    exchange_id: &str,
    overrides: HashMap<String, String>,
) -> Result<ValidationOk, ValidationError> {
    let reg = registry();
    if let Some(c) = reg.iter().find(|c| c.schema().exchange_id == exchange_id) {
        return c.validate(env_path.to_path_buf(), overrides).await;
    }
    Err(ValidationError::same(format!("unknown exchange: {exchange_id}")))
}

async fn validate_lighter(
    env_path: &Path,
    overrides: HashMap<String, String>,
) -> Result<ValidationOk, ValidationError> {
    let secrets = read_env_secrets_with_overrides(env_path, "lighter", &overrides);

    // Pre-flight: reject obvious bad shapes BEFORE we bother the exchange.
    let Some(pk_hex) = secrets.peek("PRIVATE_KEY") else {
        return Err(ValidationError::same("missing LIGHTER_PRIVATE_KEY"));
    };
    if pk_hex.is_empty() {
        return Err(ValidationError::same("LIGHTER_PRIVATE_KEY is empty"));
    }
    if hex::decode(pk_hex).is_err() {
        return Err(ValidationError::same("LIGHTER_PRIVATE_KEY is not valid hex"));
    }

    let Some(acct_idx) = secrets.peek("ACCOUNT_INDEX") else {
        return Err(ValidationError::same("missing LIGHTER_ACCOUNT_INDEX"));
    };
    if acct_idx.parse::<u64>().is_err() {
        return Err(ValidationError::same("LIGHTER_ACCOUNT_INDEX must be a non-negative integer"));
    }

    // Lighter reserves low api_key_index slots (typically 0–2) for system use —
    // user keys live at higher indices. A silent default of 0 would point at a
    // reserved slot and produce "invalid signature" at runtime, so the index
    // must be set explicitly and match the slot where the private key was registered.
    let Some(key_idx) = secrets.peek("API_KEY_INDEX") else {
        return Err(ValidationError::same(
            "missing LIGHTER_API_KEY_INDEX (the slot on Lighter where this private key is registered — see API management page)",
        ));
    };
    if key_idx.parse::<u64>().is_err() {
        return Err(ValidationError::same("LIGHTER_API_KEY_INDEX must be a non-negative integer"));
    }

    // Build a throw-away Config with the overridden secrets and call the
    // existing authenticated pre-flight.
    let mut config = crate::config::Config::load(arb_common::constants::CONFIG_DEFAULT_PATH)
        .map_err(|e| ValidationError::new("failed to load bot config", format!("load config: {e:#}")))?;
    config.secrets.insert("lighter".to_string(), secrets);

    let factory = crate::exchange::lighter::LighterFactory::from_config(&config).map_err(|e| {
        let full = format!("LighterFactory::from_config: {e:#}");
        ValidationError::new(sanitize_err(&full, "lighter credentials rejected"), full)
    })?;
    use crate::exchange::factory::ExchangeFactory;
    match ExchangeFactory::fetch_taker_fee(&factory).await {
        Ok(fee) => Ok(ValidationOk { summary: format!("taker fee {fee}"), resolved: HashMap::new() }),
        Err(e) => {
            let full = format!("Lighter fetch_taker_fee: {e:#}");
            Err(ValidationError::new(sanitize_err(&full, "authenticated call to Lighter failed"), full))
        }
    }
}

async fn validate_extended(
    env_path: &Path,
    overrides: HashMap<String, String>,
) -> Result<ValidationOk, ValidationError> {
    use starknet_crypto::Felt;

    let secrets = read_env_secrets_with_overrides(env_path, "extended", &overrides);
    let mut resolved: HashMap<String, String> = HashMap::new();

    // ── Step 1: STARK_PRIVATE_KEY required, valid hex ────────────────────
    let Some(stark_priv) = secrets.peek("STARK_PRIVATE_KEY") else {
        return Err(ValidationError::same("missing EXTENDED_STARK_PRIVATE_KEY"));
    };
    if stark_priv.is_empty() {
        return Err(ValidationError::same("EXTENDED_STARK_PRIVATE_KEY is empty"));
    }
    let priv_felt = Felt::from_hex(stark_priv)
        .map_err(|e| ValidationError::new(
            "EXTENDED_STARK_PRIVATE_KEY has invalid hex format",
            format!("Felt::from_hex private: {e:?}"),
        ))?;

    // ── Step 2: API_KEY required ─────────────────────────────────────────
    let Some(api_key) = secrets.peek("API_KEY") else {
        return Err(ValidationError::same("missing EXTENDED_API_KEY"));
    };
    if api_key.is_empty() {
        return Err(ValidationError::same("EXTENDED_API_KEY is empty"));
    }
    let api_key = api_key.to_string();

    // ── Step 3: derive public key locally from private ───────────────────
    let derived_pub = starknet_crypto::get_public_key(&priv_felt);
    let derived_pub_hex = format!("{derived_pub:#x}");

    // If user supplied STARK_PUBLIC_KEY, cross-check it matches the derived
    // value — catches copy/paste errors where the private and public keys
    // belong to different keypairs. Otherwise auto-fill it from derived.
    let user_pub_opt = secrets.peek("STARK_PUBLIC_KEY").filter(|s| !s.is_empty());
    if let Some(stark_pub) = user_pub_opt {
        let pub_felt = Felt::from_hex(stark_pub)
            .map_err(|e| ValidationError::new(
                "EXTENDED_STARK_PUBLIC_KEY has invalid hex format",
                format!("Felt::from_hex public: {e:?}"),
            ))?;
        if derived_pub != pub_felt {
            return Err(ValidationError::same(
                "EXTENDED_STARK_PRIVATE_KEY and STARK_PUBLIC_KEY do not form a valid pair",
            ));
        }
    } else {
        resolved.insert("STARK_PUBLIC_KEY".to_string(), derived_pub_hex.clone());
    }

    // ── Step 4: fetch /user/account/info by API key — gives us l2Vault + l2Key ─
    // REST URL is a compile-time constant (see `common/src/constants.rs`).
    // Still need a throw-away bot Config for Step 7's ExtendedFactory.
    let mut config = crate::config::Config::load(arb_common::constants::CONFIG_DEFAULT_PATH)
        .map_err(|e| ValidationError::new("failed to load bot config", format!("load config: {e:#}")))?;
    let rest_url = arb_common::constants::EXTENDED_REST_URL;
    let (l2_vault, l2_key) = crate::exchange::extended::client::ExtendedClient::fetch_account_info(
        rest_url, &api_key,
    ).await.map_err(|e| {
        let full = format!("Extended fetch_account_info: {e:#}");
        ValidationError::new(
            sanitize_err(&full, "authenticated call to Extended failed (check API_KEY)"),
            full,
        )
    })?;

    // Cross-check: the stark public key Extended has on file for this API key
    // must match the one derived from STARK_PRIVATE_KEY. If not, the API_KEY
    // belongs to a different sub-account than the Stark keypair.
    let l2_key_felt = Felt::from_hex(&l2_key).map_err(|e| ValidationError::new(
        "Extended returned malformed l2Key",
        format!("Felt::from_hex l2Key={l2_key}: {e:?}"),
    ))?;
    if derived_pub != l2_key_felt {
        return Err(ValidationError::same(
            "EXTENDED_API_KEY and STARK_PRIVATE_KEY belong to different Extended sub-accounts",
        ));
    }

    // ── Step 6: VAULT_ID — cross-check or auto-fill from API ─────────────
    let user_vault_opt = secrets.peek("VAULT_ID").filter(|s| !s.is_empty());
    if let Some(vault) = user_vault_opt {
        if vault.parse::<u64>().is_err() {
            return Err(ValidationError::same("EXTENDED_VAULT_ID is not a non-negative integer"));
        }
        if vault != l2_vault {
            return Err(ValidationError::same(format!(
                "EXTENDED_VAULT_ID ({vault}) does not match Extended account ({l2_vault})"
            )));
        }
    } else {
        resolved.insert("VAULT_ID".to_string(), l2_vault.clone());
    }

    // ── Step 7: inject resolved values into the throw-away config and
    //            run the final authenticated check via fetch_taker_fee ──
    let mut merged = secrets;
    if let Some(v) = resolved.get("STARK_PUBLIC_KEY") {
        merged.set("STARK_PUBLIC_KEY", v.clone());
    }
    if let Some(v) = resolved.get("VAULT_ID") {
        merged.set("VAULT_ID", v.clone());
    }
    config.secrets.insert("extended".to_string(), merged);

    let factory = crate::exchange::extended::ExtendedFactory::from_config(&config).map_err(|e| {
        let full = format!("ExtendedFactory::from_config: {e:#}");
        ValidationError::new(sanitize_err(&full, "extended credentials rejected"), full)
    })?;
    use crate::exchange::factory::ExchangeFactory;
    match ExchangeFactory::fetch_taker_fee(&factory).await {
        Ok(fee) => Ok(ValidationOk {
            summary: format!(
                "stark keypair OK, vault {l2_vault}, taker fee {fee}"
            ),
            resolved,
        }),
        Err(e) => {
            let full = format!("Extended fetch_taker_fee: {e:#}");
            Err(ValidationError::new(
                sanitize_err(&full, "authenticated call to Extended failed (check API_KEY)"),
                full,
            ))
        }
    }
}

async fn validate_zero1(
    env_path: &Path,
    overrides: HashMap<String, String>,
) -> Result<ValidationOk, ValidationError> {
    let secrets = read_env_secrets_with_overrides(env_path, "zero1", &overrides);
    let mut resolved: HashMap<String, String> = HashMap::new();

    // ── Step 1: build the signer from either base58 or JSON keypair ──────
    let keypair_b58 = secrets.peek("KEYPAIR_B58").unwrap_or("");
    let keypair_path = secrets.peek("KEYPAIR_PATH").unwrap_or("");
    let signer = if !keypair_b58.is_empty() {
        crate::signing::zero1::Zero1UserSigner::from_base58(keypair_b58).map_err(|e| {
            ValidationError::new(
                "ZERO1_KEYPAIR_B58 is not a valid base58 Solana secret",
                format!("from_base58: {e:#}"),
            )
        })?
    } else if !keypair_path.is_empty() {
        let bytes = std::fs::read(keypair_path).map_err(|e| {
            ValidationError::new(
                format!("cannot read ZERO1_KEYPAIR_PATH ({keypair_path})"),
                format!("read keypair file: {e:#}"),
            )
        })?;
        crate::signing::zero1::Zero1UserSigner::from_solana_json(&bytes).map_err(|e| {
            ValidationError::new(
                "ZERO1_KEYPAIR_PATH is not a Solana JSON keypair",
                format!("from_solana_json: {e:#}"),
            )
        })?
    } else {
        return Err(ValidationError::same(
            "missing ZERO1_KEYPAIR_B58 or ZERO1_KEYPAIR_PATH",
        ));
    };
    let pubkey_b58 = bs58::encode(signer.pubkey()).into_string();

    // ── Step 2: REST lookup /user/{pubkey} → list of account_ids ─────────
    // REST URL is a compile-time constant (see `common/src/constants.rs`).
    let rest = crate::exchange::zero1::rest::Zero1RestClient::new(
        arb_common::constants::ZERO1_REST_URL,
    )
    .map_err(|e| ValidationError::new("cannot build Zero1 REST client", format!("rest: {e:#}")))?;

    let user = rest.user(&pubkey_b58).await.map_err(|e| {
        let full = format!("zero1 rest.user({pubkey_b58}): {e:#}");
        ValidationError::new(
            "Zero1 /user lookup failed — did you deposit yet?",
            full,
        )
    })?;

    if user.account_ids.is_empty() {
        return Err(ValidationError::same(
            "Zero1 wallet has no registered accounts — deposit first to create one",
        ));
    }

    // ── Step 3: ACCOUNT_ID — cross-check if user provided one, else auto-resolve ─
    let user_id_opt = secrets.peek("ACCOUNT_ID")
        .filter(|s| !s.is_empty() && *s != "0");
    let account_id: u32 = if let Some(s) = user_id_opt {
        let id: u32 = s.parse()
            .map_err(|_| ValidationError::same("ZERO1_ACCOUNT_ID must be a u32"))?;
        if !user.account_ids.contains(&id) {
            return Err(ValidationError::new(
                format!(
                    "ZERO1_ACCOUNT_ID={id} not in wallet's account_ids ({:?}) — keypair / account mismatch",
                    user.account_ids
                ),
                format!("account_id mismatch: configured={id} registered={:?}", user.account_ids),
            ));
        }
        id
    } else if user.account_ids.len() == 1 {
        let id = user.account_ids[0];
        resolved.insert("ACCOUNT_ID".to_string(), id.to_string());
        id
    } else {
        // Wallet has multiple sub-accounts and user didn't pick one —
        // can't guess which one to trade from.
        return Err(ValidationError::same(format!(
            "Zero1 wallet has multiple accounts ({:?}) — set ZERO1_ACCOUNT_ID explicitly",
            user.account_ids
        )));
    };

    Ok(ValidationOk {
        summary: format!("keypair OK, account_id {account_id} registered for pubkey {pubkey_b58}"),
        resolved,
    })
}

async fn validate_hyperliquid(
    env_path: &Path,
    overrides: HashMap<String, String>,
) -> Result<ValidationOk, ValidationError> {
    let secrets = read_env_secrets_with_overrides(env_path, "hyperliquid", &overrides);
    let resolved: HashMap<String, String> = HashMap::new();

    let pk_hex = secrets.peek("API_PRIVATE_KEY").unwrap_or("");
    if pk_hex.is_empty() {
        return Err(ValidationError::same("missing HYPERLIQUID_API_PRIVATE_KEY"));
    }

    let signer = crate::signing::hyperliquid::HyperliquidSigner::from_hex(pk_hex).map_err(|e| {
        ValidationError::new(
            "HYPERLIQUID_API_PRIVATE_KEY is not a valid hex private key",
            format!("from_hex: {e:#}"),
        )
    })?;
    let agent_address = signer.address_hex();

    let account_address = secrets.peek("ACCOUNT_ADDRESS").unwrap_or("").to_lowercase();
    if account_address.is_empty() {
        return Err(ValidationError::same("missing HYPERLIQUID_ACCOUNT_ADDRESS"));
    }

    // Verify by fetching fees for the account address
    let rest = crate::exchange::hyperliquid::rest::HyperliquidRestClient::new(
        arb_common::constants::HYPERLIQUID_REST_URL,
    )
    .map_err(|e| ValidationError::new("cannot build Hyperliquid REST client", format!("{e:#}")))?;

    let fees = rest.user_fees(&account_address).await.map_err(|e| {
        let raw = format!("{e:#}");
        ValidationError::new(sanitize_err(&raw, "Hyperliquid fee lookup failed"), raw)
    })?;

    let taker_str = fees.user_cross_rate.as_deref().unwrap_or("unknown");
    Ok(ValidationOk {
        summary: format!("agent {agent_address}, account {account_address}, taker rate {taker_str}"),
        resolved,
    })
}

async fn validate_bybit(
    env_path: &Path,
    overrides: HashMap<String, String>,
) -> Result<ValidationOk, ValidationError> {
    let secrets = read_env_secrets_with_overrides(env_path, "bybit", &overrides);

    if secrets.peek("API_KEY").unwrap_or("").is_empty() {
        return Err(ValidationError::same("missing BYBIT_API_KEY"));
    }
    if secrets.peek("API_SECRET").unwrap_or("").is_empty() {
        return Err(ValidationError::same("missing BYBIT_API_SECRET"));
    }

    let mut config = crate::config::Config::load(arb_common::constants::CONFIG_DEFAULT_PATH)
        .map_err(|e| ValidationError::new("failed to load bot config", format!("load config: {e:#}")))?;
    config.secrets.insert("bybit".to_string(), secrets);

    let factory = crate::exchange::bybit::factory::BybitFactory::from_config(&config).map_err(|e| {
        let full = format!("BybitFactory::from_config: {e:#}");
        ValidationError::new(sanitize_err(&full, "bybit credentials rejected"), full)
    })?;
    use crate::exchange::factory::ExchangeFactory;
    match ExchangeFactory::fetch_taker_fee(&factory).await {
        Ok(fee) => Ok(ValidationOk {
            summary: format!("BTCUSDT taker fee {fee}"),
            resolved: HashMap::new(),
        }),
        Err(e) => {
            let full = format!("Bybit fetch_taker_fee: {e:#}");
            Err(ValidationError::new(
                sanitize_err(&full, "authenticated call to Bybit failed (check API_KEY / API_SECRET)"),
                full,
            ))
        }
    }
}

/// Classify a raw error string into a short, operator-friendly message
/// that does not echo secret-looking substrings. The raw error is always
/// logged separately via `tracing`, so the sanitized output is strictly
/// for the UI.
fn sanitize_err(full: &str, fallback: &str) -> String {
    let low = full.to_ascii_lowercase();
    if low.contains("401") || low.contains("unauthorized") || low.contains("unauthenticated") {
        "HTTP 401 — unauthorized (check API key / signature)".to_string()
    } else if low.contains("403") || low.contains("forbidden") {
        "HTTP 403 — forbidden".to_string()
    } else if low.contains("404") || low.contains("not found") {
        "HTTP 404 — endpoint or account not found".to_string()
    } else if low.contains("invalid") && low.contains("hex") {
        "invalid hex encoding in one of the key fields".to_string()
    } else if low.contains("timed out") || low.contains("timeout") {
        "network timeout".to_string()
    } else if low.contains("connect") || low.contains("dns") {
        "network error — could not reach exchange".to_string()
    } else {
        fallback.to_string()
    }
}

// ─── Tests ──────────────────────────────────────────────────────────────────

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn mask_hides_all_but_last_four() {
        assert_eq!(mask_secret(""), "(unset)");
        assert_eq!(mask_secret("a"), "••••");
        assert_eq!(mask_secret("abcd"), "••••");
        assert_eq!(mask_secret("abcdefgh"), "••••efgh");
        assert_eq!(mask_secret("0x1234567890abcdef"), "••••cdef");
    }

    #[test]
    fn sanitize_err_maps_common_http_patterns() {
        assert!(sanitize_err("HTTP 401 ...", "x").contains("401"));
        assert!(sanitize_err("HTTP 403 Forbidden", "x").contains("403"));
        assert!(sanitize_err("HTTP 404 not found", "x").contains("404"));
        assert!(sanitize_err("timed out", "x").contains("timeout"));
        assert_eq!(sanitize_err("some random error", "fallback msg"), "fallback msg");
    }

    #[test]
    fn read_env_secrets_strips_prefix_and_filters_by_exchange() {
        let dir = test_tmpdir();
        let env = dir.join(".env");
        std::fs::write(&env, "LIGHTER_PRIVATE_KEY=abc\nLIGHTER_ACCOUNT_INDEX=7\nEXTENDED_API_KEY=xyz\nOTHER=ignored\n").unwrap();

        let l = read_env_secrets_from_file(&env, "lighter");
        assert_eq!(l.peek("PRIVATE_KEY"), Some("abc"));
        assert_eq!(l.peek("ACCOUNT_INDEX"), Some("7"));
        assert_eq!(l.peek("API_KEY"), None);

        let e = read_env_secrets_from_file(&env, "extended");
        assert_eq!(e.peek("API_KEY"), Some("xyz"));
        assert_eq!(e.peek("PRIVATE_KEY"), None);
    }

    #[test]
    fn read_env_secrets_with_overrides_merges() {
        let dir = test_tmpdir();
        let env = dir.join(".env");
        std::fs::write(&env, "LIGHTER_PRIVATE_KEY=old\nLIGHTER_ACCOUNT_INDEX=7\n").unwrap();

        let mut overrides = HashMap::new();
        overrides.insert("PRIVATE_KEY".to_string(), "new".to_string());
        overrides.insert("API_KEY_INDEX".to_string(), "".to_string()); // empty → ignored
        let merged = read_env_secrets_with_overrides(&env, "lighter", &overrides);
        assert_eq!(merged.peek("PRIVATE_KEY"), Some("new"));
        assert_eq!(merged.peek("ACCOUNT_INDEX"), Some("7")); // preserved
        assert_eq!(merged.peek("API_KEY_INDEX"), None); // empty override dropped
    }

    #[test]
    fn schemas_cover_all_configured_factories() {
        // F20 guard: if somebody adds a new exchange to `build_factories`
        // but forgets to add a credentials schema, this test fires. We read
        // the default config to discover exchange names and assert every
        // name has a matching schema.
        //
        // Cargo runs unit tests with CWD = crate dir (`bot/`), but the config
        // file lives at the repo root. Walk up until we find it — no-op if
        // we can't locate it (e.g. sandbox without the repo layout).
        let mut candidate = std::path::PathBuf::from(arb_common::constants::CONFIG_DEFAULT_PATH);
        if !candidate.exists() {
            let here = std::env::current_dir().unwrap_or_default();
            for ancestor in here.ancestors() {
                let c = ancestor.join(arb_common::constants::CONFIG_DEFAULT_PATH);
                if c.exists() { candidate = c; break; }
            }
        }
        if !candidate.exists() {
            eprintln!("schemas_cover_all_configured_factories: config not found, skipping");
            return;
        }
        let cfg = crate::config::Config::load(&candidate).expect("load default config");
        let schema_ids: std::collections::HashSet<&str> =
            schemas().iter().map(|s| s.exchange_id).collect();
        for name in cfg.exchanges.keys() {
            assert!(
                schema_ids.contains(name.as_str()),
                "exchange '{name}' is in config but has no credentials schema — add one in credentials.rs::schemas()",
            );
        }
    }

    #[test]
    fn schemas_are_stable_and_contain_expected_fields() {
        let s = schemas();
        assert_eq!(s.len(), 5);
        let lighter = schema_for("lighter").unwrap();
        assert!(lighter.find_field("PRIVATE_KEY").is_some());
        assert_eq!(lighter.find_field("PRIVATE_KEY").unwrap().kind, FieldKind::Secret);
        assert_eq!(lighter.find_field("ACCOUNT_INDEX").unwrap().kind, FieldKind::Number);
        let ext = schema_for("extended").unwrap();
        assert_eq!(ext.fields.len(), 4);
        let z1 = schema_for("zero1").unwrap();
        assert!(z1.find_field("KEYPAIR_B58").unwrap().kind == FieldKind::Secret);
        let bb = schema_for("bybit").unwrap();
        assert_eq!(bb.find_field("API_KEY").unwrap().kind, FieldKind::Secret);
        assert_eq!(bb.find_field("API_SECRET").unwrap().kind, FieldKind::Secret);
    }

    #[test]
    fn env_roundtrip_preserves_comments_and_replaces_keys() {
        let dir = test_tmpdir();
        let env = dir.join(".env");
        {
            let mut f = std::fs::File::create(&env).unwrap();
            writeln!(f, "# header comment").unwrap();
            writeln!(f, "OTHER=keep_me").unwrap();
            writeln!(f, "LIGHTER_PRIVATE_KEY=oldvalue").unwrap();
            writeln!(f, "# trailing comment").unwrap();
        }

        let mut updates = HashMap::new();
        updates.insert("LIGHTER_PRIVATE_KEY".to_string(), "newvalue".to_string());
        updates.insert("LIGHTER_ACCOUNT_INDEX".to_string(), "42".to_string());
        write_env_file(&env, &updates).unwrap();

        let content = std::fs::read_to_string(&env).unwrap();
        assert!(content.contains("# header comment"));
        assert!(content.contains("OTHER=keep_me"));
        assert!(content.contains("LIGHTER_PRIVATE_KEY=newvalue"));
        assert!(!content.contains("oldvalue"));
        assert!(content.contains("LIGHTER_ACCOUNT_INDEX=42"));
        assert!(content.contains("# trailing comment"));

        let parsed = read_env_file(&env).unwrap();
        assert_eq!(parsed.get("LIGHTER_PRIVATE_KEY").map(String::as_str), Some("newvalue"));
        assert_eq!(parsed.get("OTHER").map(String::as_str), Some("keep_me"));
        assert_eq!(parsed.get("LIGHTER_ACCOUNT_INDEX").map(String::as_str), Some("42"));
    }

    #[test]
    fn write_creates_file_if_missing() {
        let dir = test_tmpdir();
        let env = dir.join(".env");
        let mut updates = HashMap::new();
        updates.insert("K".to_string(), "v".to_string());
        write_env_file(&env, &updates).unwrap();
        let content = std::fs::read_to_string(&env).unwrap();
        assert!(content.contains("K=v"));
    }

    #[test]
    fn write_creates_backup() {
        let dir = test_tmpdir();
        let env = dir.join(".env");
        std::fs::write(&env, "A=1\n").unwrap();

        let mut updates = HashMap::new();
        updates.insert("A".to_string(), "2".to_string());
        write_env_file(&env, &updates).unwrap();

        let mut found_backup = false;
        for entry in std::fs::read_dir(&dir).unwrap() {
            let name = entry.unwrap().file_name().to_string_lossy().to_string();
            if name.starts_with(".env.bak.") { found_backup = true; }
        }
        assert!(found_backup, "expected a .env.bak.<ts> backup file");
    }

    fn test_tmpdir() -> PathBuf {
        let mut base = std::env::temp_dir();
        let unique = format!(
            "arb_bot_credtest_{}_{}",
            std::process::id(),
            std::time::SystemTime::now()
                .duration_since(std::time::UNIX_EPOCH)
                .map(|d| d.as_nanos())
                .unwrap_or(0),
        );
        base.push(unique);
        std::fs::create_dir_all(&base).unwrap();
        base
    }

    #[test]
    #[cfg(unix)]
    fn write_sets_mode_600() {
        use std::os::unix::fs::PermissionsExt;
        let dir = test_tmpdir();
        let env = dir.join(".env");
        let mut updates = HashMap::new();
        updates.insert("K".to_string(), "v".to_string());
        write_env_file(&env, &updates).unwrap();
        let meta = std::fs::metadata(&env).unwrap();
        assert_eq!(meta.permissions().mode() & 0o777, 0o600);
    }
}