//! Signed updates from storebound.dev. The updater plugin checks `latest.json` of the chosen channel, downloads the
//! platform's bundle and refuses it unless its minisign signature matches the public key in tauri.conf.json (the
//! private key never leaves the release machine, ~/.storebound-keys). Nothing installs without the owner's click in
//! a native dialog (commands::update_install). Pure parts here so tests can pin them.
use url::Url;

/// `latest.json` of each channel (static files on storebound.dev, published by tools/desktop-release.ts).
pub const STABLE: &str = "https://storebound.dev/desktop/latest.json";
pub const BETA: &str = "https://storebound.dev/desktop/beta/latest.json";

/// The endpoint of a channel (Settings > Updates); anything unknown is the stable channel.
pub fn endpoint(channel: &str) -> &'static str {
    if channel == "beta" {
        BETA
    } else {
        STABLE
    }
}

/// Only storebound.dev over HTTPS, without port or user info, may serve updates.
pub fn endpoint_allowed(url: &Url) -> bool {
    url.scheme() == "https" && url.host_str() == Some("storebound.dev") && url.port().is_none() && url.username().is_empty() && url.password().is_none() && url.path().starts_with("/desktop/")
}

/// The updater's error in words the owner can act on.
pub fn error_text(e: &str) -> String {
    let l = e.to_lowercase();
    if l.contains("signature") {
        "the update's signature does not match this app's key: not installed".into()
    } else if l.contains("404") || l.contains("not found") {
        "no update information on storebound.dev yet".into()
    } else if l.contains("platform") {
        "no update for this system in the latest release yet".into()
    } else {
        format!("update check failed: {e}")
    }
}