# frozen_string_literal: true

class X509IssuerCrlCheckWorker
  include ApplicationWorker

  data_consistency :always

  include CronjobQueue

  feature_category :source_code_management
  urgency :low

  idempotent!
  worker_has_external_dependencies!

  attr_accessor :logger

  def perform
    @logger = Gitlab::GitLogger.build

    X509Issuer.all.find_each do |issuer|
      with_context(related_class: X509IssuerCrlCheckWorker) do
        update_certificates(issuer)
      end
    end
  end

  private

  def update_certificates(issuer)
    crl = download_crl(issuer)
    return unless crl

    serials = X509Certificate.serial_numbers(issuer)
    return if serials.empty?

    revoked_serials = serials & crl.revoked.map(&:serial).map(&:to_i)

    revoked_serials.each_slice(1000) do |batch|
      certs = issuer.x509_certificates.where(serial_number: batch, certificate_status: :good) # rubocop: disable CodeReuse/ActiveRecord

      certs.find_each do |cert|
        logger.info(
          message: "Certificate revoked",
          id: cert.id,
          email: cert.email,
          subject: cert.subject,
          serial_number: cert.serial_number,
          issuer: cert.x509_issuer.id,
          issuer_subject: cert.x509_issuer.subject,
          issuer_crl_url: cert.x509_issuer.crl_url
        )
      end

      certs.update_all(certificate_status: :revoked)
    end
  end

  def download_crl(issuer)
    response = Gitlab::HTTP.try_get(issuer.crl_url)

    if response&.code == 200
      OpenSSL::X509::CRL.new(response.body)
    else
      logger.warn(
        message: "Failed to download certificate revocation list",
        issuer: issuer.id,
        issuer_subject: issuer.subject,
        issuer_crl_url: issuer.crl_url
      )

      nil
    end

  rescue OpenSSL::X509::CRLError
    logger.warn(
      message: "Failed to parse certificate revocation list",
      issuer: issuer.id,
      issuer_subject: issuer.subject,
      issuer_crl_url: issuer.crl_url
    )

    nil
  end
end
