#[cfg(feature = "async-std")]

use std::io;

use std::{

    path::{Path, PathBuf},

    sync::Arc,

};

#[cfg(feature = "async-std")]

use async_fs as fs;

#[cfg(feature = "async-std")]

use async_lock::{Mutex, RwLock};

#[cfg(feature = "async-std")]

use futures_lite::AsyncReadExt;

#[cfg(feature = "tokio")]

use tokio::{

    fs,

    io::{self, AsyncReadExt},

    sync::{Mutex, RwLock},

};

use super::{Error, LockedItem, UnlockedKeyring, api};

use crate::{Key, Secret};

/// A locked keyring that requires a secret to unlock.

#[derive(Debug)]

pub struct LockedKeyring {

    pub(super) keyring: Arc<RwLock<api::Keyring>>,

    pub(super) path: Option<PathBuf>,

    pub(super) mtime: Mutex<Option<std::time::SystemTime>>,

}

impl LockedKeyring {

    /// Validate that a secret can decrypt the items in this keyring.

    ///

    /// For empty keyrings, this always returns `true` since there are no items

    /// to validate against.

    ///

    /// # Arguments

    ///

    /// * `secret` - The secret to validate.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self, secret)))]

    }

    /// Validate that an already-derived key can decrypt at least one item in

    /// this keyring.

    ///

    /// Empty keyrings return `true` because they contain no item with which to

    /// authenticate the key. Callers that persist keys for empty keyrings must

    /// bind them to the exact keyring file separately.

    ///

    /// A partially corrupted keyring may return `true` here but still fail

    /// [`Self::unlock_with_key`] when broken items outnumber valid items.

    }

    }

    /// Return the associated file if any.

    }

    /// Get the modification timestamp

    }

    /// Retrieve the list of available [`LockedItem`]s without decrypting them.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self)))]

            .items

            })

    }

    /// Unlocks a keyring and validates it

    }

    /// Unlocks a keyring with an already-derived key and validates it.

    ///

    /// An exact-length [`Key::new`] value is treated as direct key material and

    /// may be used for subsequent writes. The caller is responsible for

    /// supplying a key with sufficient entropy.

    ///

    /// Empty keyrings cannot authenticate the key and therefore accept any key

    /// of the required length, matching [`Self::validate_key`].

        let validation = {

        };

        #[cfg(feature = "tracing")]

        Self::log_validation_error(&validation, false);

    }

    /// Unlocks a keyring without validating it

    ///

    /// # Safety

    ///

    /// This method skips validation and doesn't verify that the secret can

    /// decrypt all items in the keyring. Use only for recovery scenarios where

    /// you need to access a partially corrupted keyring. The keyring may

    /// contain items that cannot be decrypted with the provided secret.

    #[allow(unsafe_code)]

    }

        self,

        secret: Secret,

        validate_items: bool,

    ) -> Result<UnlockedKeyring, Error> {

            #[cfg(feature = "tracing")]

            Self::log_validation_error(&validation, true);

        } else {

        };

    }

    #[cfg(feature = "tracing")]

            }

            Err(Error::IncorrectSecret) => {

            }

                valid_items,

                broken_items,

            }) => {

                    "The file contains {broken_items} broken items and {valid_items} valid ones."

                );

                        "Please switch to `UnlockedKeyring::load_unchecked` to load the keyring without the secret validation.

                        `Keyring::delete_broken_items` can be used to remove them or alternatively with `oo7-cli --repair`."

                    );

                } else {

                        "Recover the keyring with its source secret; key-based unlock does not bypass validation."

                    );

                }

            }

            _ => {}

        }

    }

        UnlockedKeyring {

        }

    }

    /// Unlocks a keyring without a secret, for unencrypted keyrings.

    ///

    /// Validates that existing items (if any) can be read without

    /// encryption. Returns [`Error::IncorrectSecret`] if encrypted items

    /// are found.

            }

        }

    }

    /// Load a keyring from a file path.

                #[cfg(feature = "tracing")]

                tracing::debug!("Keyring file not found, creating a new one");

            }

                #[cfg(feature = "tracing")]

                tracing::debug!("Keyring file found, loading its content");

            }

        };

        })

    }

    /// Open a named keyring.

    }

    /// Open a locked keyring at a specific data directory.

    ///

    /// This is useful for tests and cases where you want explicit control over

    /// where keyrings are stored, avoiding the default XDG_DATA_HOME location.

    ///

    /// # Arguments

    ///

    /// * `data_dir` - Base data directory (keyrings stored in

    ///   `data_dir/keyrings/v1/`)

    /// * `name` - The name of the keyring.

    #[cfg_attr(feature = "tracing", tracing::instrument(fields(data_dir = ?data_dir.as_ref())))]

    }

}