// Copyright 2018 (c) NSPCC
//
// Package tz implements general Tillich-Zemo
package tz

import (
	"errors"
	"hash"
	"math"
	"unsafe"

	"github.com/nspcc-dev/tzhash/gf127"
)

const (
	hashSize      = 64
	hashBlockSize = 128
)

type (
	digest struct {
		x [4]gf127.GF127
	}

	digest2 digest
)

// type assertions
var (
	_ hash.Hash = new(digest)
	_ hash.Hash = new(digest2)
)

var (
	minmax  = [2]gf127.GF127{{0, 0}, {math.MaxUint64, math.MaxUint64}}
	x127x63 = gf127.GF127{1 << 63, 1 << 63}
)

// New returns a new hash.Hash computing the Tillich-Zémor checksum.
func New() hash.Hash {
	d := new(digest)
	d.Reset()
	return d
}

func (d *digest) Sum(in []byte) []byte {
	// Make a copy of d so that caller can keep writing and summing.
	d0 := *d
	h := d0.checkSum()
	return append(in, h[:]...)
}

func (d *digest) checkSum() [hashSize]byte {
	return d.byteArray()
}

func (d *digest) byteArray() (b [hashSize]byte) {
	var t []byte
	for i := 0; i < 4; i++ {
		t = d.x[i].ByteArray()
		copy(b[i*16:], t)
	}
	return
}

func (d *digest) Reset() {
	d.x[0] = gf127.GF127{1, 0}
	d.x[1] = gf127.GF127{0, 0}
	d.x[2] = gf127.GF127{0, 0}
	d.x[3] = gf127.GF127{1, 0}
}

func (d *digest) Write(data []byte) (n int, err error) {
	n = len(data)
	for _, b := range data {
		mulBitRight(&d.x[0], &d.x[1], &d.x[2], &d.x[3], &minmax[(b>>7)&1])
		mulBitRight(&d.x[0], &d.x[1], &d.x[2], &d.x[3], &minmax[(b>>6)&1])
		mulBitRight(&d.x[0], &d.x[1], &d.x[2], &d.x[3], &minmax[(b>>5)&1])
		mulBitRight(&d.x[0], &d.x[1], &d.x[2], &d.x[3], &minmax[(b>>4)&1])
		mulBitRight(&d.x[0], &d.x[1], &d.x[2], &d.x[3], &minmax[(b>>3)&1])
		mulBitRight(&d.x[0], &d.x[1], &d.x[2], &d.x[3], &minmax[(b>>2)&1])
		mulBitRight(&d.x[0], &d.x[1], &d.x[2], &d.x[3], &minmax[(b>>1)&1])
		mulBitRight(&d.x[0], &d.x[1], &d.x[2], &d.x[3], &minmax[(b>>0)&1])
	}
	return
}

func (d *digest) Size() int {
	return hashSize
}

func (d *digest) BlockSize() int {
	return hashBlockSize
}

func (d *digest2) Write(data []byte) (n int, err error) {
	n = len(data)

	// We need to transpose matrix, because
	// mulBitRightx2 accepts matrix by columns, not rows
	a := d.x[1]
	d.x[1] = d.x[2]
	d.x[2] = a

	h1 := (*gf127.GF127x2)(unsafe.Pointer(&d.x[0]))
	h2 := (*gf127.GF127x2)(unsafe.Pointer(&d.x[2]))
	for _, b := range data {
		mulBitRightx2(h1, h2, &minmax[(b>>7)&1])
		mulBitRightx2(h1, h2, &minmax[(b>>6)&1])
		mulBitRightx2(h1, h2, &minmax[(b>>5)&1])
		mulBitRightx2(h1, h2, &minmax[(b>>4)&1])
		mulBitRightx2(h1, h2, &minmax[(b>>3)&1])
		mulBitRightx2(h1, h2, &minmax[(b>>2)&1])
		mulBitRightx2(h1, h2, &minmax[(b>>1)&1])
		mulBitRightx2(h1, h2, &minmax[(b>>0)&1])
	}

	// transpose matrix back
	a = d.x[1]
	d.x[1] = d.x[2]
	d.x[2] = a

	return
}
func (d *digest2) Sum(b []byte) []byte      { return (*digest)(d).Sum(b) }
func (d *digest2) Reset()                   { (*digest)(d).Reset() }
func (d *digest2) Size() int                { return (*digest)(d).Size() }
func (d *digest2) BlockSize() int           { return (*digest)(d).BlockSize() }
func (d *digest2) checkSum() [hashSize]byte { return (*digest)(d).checkSum() }

// Sum returnz Tillich-Zémor checksum of data
func Sum(data []byte) [hashSize]byte {
	d := new(digest2)
	d.Reset()
	d.Write(data)
	return d.checkSum()
}

// Concat performs combining of hashes based on homomorphic property.
func Concat(hs [][]byte) ([]byte, error) {
	var b, c sl2

	b = id
	for i := range hs {
		if err := c.UnmarshalBinary(hs[i]); err != nil {
			return nil, err
		}
		b.Mul(&b, &c)
	}
	return b.MarshalBinary()
}

// Validate checks if hashes in hs combined are equal to h.
func Validate(h []byte, hs [][]byte) (bool, error) {
	var (
		b             []byte
		got, expected [hashSize]byte
		err           error
	)

	if len(h) != hashSize {
		return false, errors.New("invalid hash")
	} else if len(hs) == 0 {
		return false, errors.New("empty slice")
	}

	copy(expected[:], h)

	b, err = Concat(hs)
	if err != nil {
		return false, errors.New("cant concatenate hashes")
	}

	copy(got[:], b)

	return expected == got, nil
}

// SubtractR returns hash a, such that Concat(a, b) == c
// This is possible, because Tillich-Zemor hash is actually a matrix
// which can be inversed.
func SubtractR(c, b []byte) (a []byte, err error) {
	var p1, p2, r sl2

	if err = r.UnmarshalBinary(c); err != nil {
		return nil, err
	}
	if err = p2.UnmarshalBinary(b); err != nil {
		return nil, err
	}

	p1 = *Inv(&p2)
	p1.Mul(&r, &p1)

	return p1.MarshalBinary()
}

// SubtractL returns hash b, such that Concat(a, b) == c
// This is possible, because Tillich-Zemor hash is actually a matrix
// which can be inversed.
func SubtractL(c, a []byte) (b []byte, err error) {
	var p1, p2, r sl2

	if err = r.UnmarshalBinary(c); err != nil {
		return nil, err
	}
	if err = p1.UnmarshalBinary(a); err != nil {
		return nil, err
	}

	p2 = *Inv(&p1)
	p2.Mul(&p2, &r)

	return p2.MarshalBinary()
}

func mulBitRight(c00, c01, c10, c11, e *gf127.GF127)
func mulBitRightx2(c00c01 *gf127.GF127x2, c10c11 *gf127.GF127x2, e *gf127.GF127)