//! `oxy auth`: sign in to a hub once, for every repository on it.

use super::ui;

use anyhow::{bail, Context, Result};

use oxy_core::credentials::{hub_of, token_allowed, Credentials, Stored};

use oxy_core::protocol::{http_json, RemoteOptions};

use oxy_core::repo::Repo;

use serde_json::Value;

use std::io::BufRead;

use std::path::{Path, PathBuf};

use std::time::{Duration, Instant};

/// The scopes oxy asks for: read and push repositories, and name the

/// account it signed in as.

const SCOPES: [&str; 3] = ["repo:read", "repo:write", "user:read"];

/// The hub named on the command line (a hub, a host, or any URL on it), else

/// that of this checkout's `origin` (or its only remote).

fn resolve_hub(arg: Option<&str>) -> Result<String> {

    if let Some(a) = arg {

        let url = if a.contains("://") {

            a.to_string()

        } else {

            format!("https://{a}")

        };

        return hub_of(&url).with_context(|| format!("{a} is not a hub URL"));

    }

    if let Ok(repo) = Repo::open(Path::new(".")) {

        let remotes = &repo.config.remotes;

        let url = remotes.get("origin").or_else(|| {

            (remotes.len() == 1)

                .then(|| remotes.values().next())

                .flatten()

        });

        if let Some(hub) = url.and_then(|u| hub_of(u)) {

            return Ok(hub);

        }

    }

    bail!("name the hub, as in: oxy auth login https://oxygenhub.io")

}

/// The account a token signs in as, from the hub's `/api/v1/user`.

fn whoami(hub: &str, options: &RemoteOptions) -> Result<std::result::Result<String, String>> {

    let (code, body) = http_json("GET", &format!("{hub}/api/v1/user"), None, options)

        .map_err(|e| anyhow::anyhow!("{e}"))?;

    if code != 200 {

        return Ok(Err(format!("HTTP {code}")));

    }

    let v: Value = serde_json::from_str(&body).context("the hub's answer about the account")?;

    Ok(v["username"]

        .as_str()

        .map(String::from)

        .ok_or_else(|| "no account in the answer".to_string()))

}

fn device_client() -> String {

    let host = std::fs::read_to_string("/etc/hostname")

        .ok()

        .or_else(|| std::env::var("COMPUTERNAME").ok())

        .map(|h| h.trim().to_string())

        .filter(|h| !h.is_empty());

    match host {

        Some(h) => format!("oxy on {h}"),

        None => "oxy".to_string(),

    }

}

/// The device sign-in (RFC 8628): show a code, wait for its approval on

/// the hub's web site, and return the token it grants.

fn device_sign_in(hub: &str, options: &RemoteOptions) -> Result<String> {

    let request = serde_json::json!({ "client": device_client(), "scopes": SCOPES }).to_string();

    let (code, body) = http_json(

        "POST",

        &format!("{hub}/api/v1/device/code"),

        Some(&request),

        options,

    )

    .map_err(|e| anyhow::anyhow!("{e}"))?;

    let v: Value = serde_json::from_str(&body)

        .with_context(|| format!("{hub} did not answer a sign-in request (HTTP {code})"))?;

    if code != 200 {

        bail!(

            "{hub} cannot sign in a device: {}",

            v["error_description"]

                .as_str()

                .or(v["detail"].as_str())

                .unwrap_or(&body)

        );

    }

    let device = v["device_code"]

        .as_str()

        .context("no device code")?

        .to_string();

    let user_code = v["user_code"].as_str().unwrap_or("?");

    let url = v["verification_uri_complete"]

        .as_str()

        .or(v["verification_uri"].as_str())

        .unwrap_or(hub);

    let mut interval = v["interval"].as_u64().unwrap_or(5).max(1);

    let deadline = Instant::now() + Duration::from_secs(v["expires_in"].as_u64().unwrap_or(900));

    eprintln!(

        "Open {} and approve the code {}",

        ui::path(url),

        ui::subject(user_code)

    );

    eprintln!(

        "  {} {}",

        ui::note(),

        ui::dim("approve only a code you started yourself, just now")

    );

    let sp = ui::spinner("Waiting for approval (Ctrl-C to give up)…");

    let poll = serde_json::json!({ "device_code": device }).to_string();

    loop {

        std::thread::sleep(Duration::from_secs(interval));

        if Instant::now() > deadline {

            sp.clear();

            bail!("the code expired before it was approved; run oxy auth login again");

        }

        let (code, body) = http_json(

            "POST",

            &format!("{hub}/api/v1/device/token"),

            Some(&poll),

            options,

        )

        .map_err(|e| anyhow::anyhow!("{e}"))?;

        let v: Value = serde_json::from_str(&body).unwrap_or_default();

        if code == 200 {

            sp.clear();

            return v["access_token"]

                .as_str()

                .map(String::from)

                .context("no token in the hub's answer");

        }

        match v["error"].as_str() {

            Some("authorization_pending") => {}

            Some("slow_down") => interval += 5,

            Some("access_denied") => {

                sp.clear();

                bail!("the sign-in was denied on the hub");

            }

            Some("expired_token") => {

                sp.clear();

                bail!("the code expired before it was approved; run oxy auth login again");

            }

            _ => {

                sp.clear();

                bail!("signing in: HTTP {code}: {}", body.trim());

            }

        }

    }

}

fn where_stored(stored: &Stored) -> String {

    match stored {

        Stored::File(p) => format!("{} (yours only)", p.display()),

        Stored::Helper(h) => format!("credential helper {h}"),

    }

}

pub fn login(hub: Option<&str>, with_token: bool, ca: Option<PathBuf>) -> Result<i32> {

    let hub = resolve_hub(hub)?;

    if !token_allowed(&hub) {

        bail!("{hub} is plain http: a token would cross the network unencrypted; sign in to its https address");

    }

    let store = Credentials::user();

    let ca = ca

        .map(|c| std::fs::canonicalize(&c).unwrap_or(c))

        .or_else(|| store.get(&hub).ok().flatten().and_then(|e| e.ca))

        .or_else(|| std::env::var("OXY_CA").ok().map(PathBuf::from));

    let anonymous = RemoteOptions {

        token: None,

        ca: ca.clone(),

        ..RemoteOptions::default()

    };

    let token = if with_token {

        let mut line = String::new();

        std::io::stdin()

            .lock()

            .read_line(&mut line)

            .context("reading the token from standard input")?;

        let t = line.trim().to_string();

        if t.is_empty() {

            bail!("no token on standard input");

        }

        t

    } else {

        device_sign_in(&hub, &anonymous)?

    };

    let options = RemoteOptions {

        token: Some(token.clone()),

        ..anonymous

    };

    let account = match whoami(&hub, &options)? {

        Ok(a) => Some(a),

        Err(why) if with_token => bail!("{hub} did not accept the token ({why})"),

        // A token without user:read still serves repositories.

        Err(_) => None,

    };

    let stored = store

        .save(&hub, &token, account.as_deref(), ca.as_deref())

        .map_err(|e| anyhow::anyhow!("{e}"))?;

    let who = account

        .as_deref()

        .map(|a| format!(" as {}", ui::author(a)))

        .unwrap_or_default();

    println!("{} to {}{who}", ui::done("Signed in"), ui::path(&hub));

    println!(

        "  {} {}",

        ui::note(),

        ui::dim(format!("token in {}", where_stored(&stored)))

    );

    Ok(0)

}

/// `oxy auth grant`: keep an agent's grant token (oxygenhub#241) for

/// keyless signing, read from standard input.

pub fn grant(hub: Option<&str>) -> Result<i32> {

    use std::io::IsTerminal;

    let hub = resolve_hub(hub)?;

    if !token_allowed(&hub) {

        bail!("{hub} is plain http: a token would cross the network unencrypted; use its https address");

    }

    if std::io::stdin().is_terminal() {

        eprint!("Agent grant token for {hub}: ");

    }

    let mut line = String::new();

    std::io::stdin()

        .lock()

        .read_line(&mut line)

        .context("reading the token from standard input")?;

    let token = line.trim();

    if !token.starts_with("oxyagent_") {

        bail!("that is not an agent grant token (they start oxyagent_; `oh agent grant NAME` makes one)");

    }

    let stored = Credentials::user()

        .save_grant(&hub, token)

        .map_err(|e| anyhow::anyhow!("{e}"))?;

    println!(

        "{} for {}",

        ui::done("Kept the agent grant"),

        ui::path(&hub)

    );

    println!(

        "  {} {}",

        ui::note(),

        ui::dim(format!(

            "token in {}; sign with it: oxy config author.signer keyless",

            where_stored(&stored)

        ))

    );

    Ok(0)

}

/// The start of a token, enough to tell tokens apart and no more.

fn masked(token: &str) -> String {

    let shown: String = token.chars().take(10).collect();

    format!("{shown}…")

}

pub fn status() -> Result<i32> {

    let store = Credentials::user();

    let entries = store.entries().map_err(|e| anyhow::anyhow!("{e}"))?;

    if store.too_open() {

        println!(

            "{} {} {}",

            ui::caution(),

            ui::path(store.path().display()),

            ui::warn("can be read by other users, so oxy ignores it: run chmod 600 on it")

        );

    }

    if std::env::var("OXY_TOKEN").is_ok_and(|t| !t.is_empty()) {

        println!(

            "{} {}",

            ui::note(),

            ui::dim("OXY_TOKEN is set: it is used ahead of the tokens below, for every hub")

        );

    }

    if entries.is_empty() {

        println!(

            "{}",

            ui::dim("Not signed in to any hub: run oxy auth login HUB")

        );

        return Ok(0);

    }

    let helper = store.helper();

    let mut bad = false;

    for e in entries {

        let full = store.get(&e.hub).map_err(|e| anyhow::anyhow!("{e}"))?;

        let token = full.as_ref().and_then(|f| f.token.clone());

        println!("{}", ui::section(&e.hub));

        let Some(token) = token else {

            println!(

                "  {}",

                ui::warn("no token stored: run oxy auth login again")

            );

            bad = true;

            continue;

        };

        let options = RemoteOptions {

            token: Some(token.clone()),

            ca: e.ca.clone(),

            ..RemoteOptions::default()

        };

        let check = match whoami(&e.hub, &options) {

            Ok(Ok(a)) => ui::ok(format!("valid, signed in as {a}")),

            Ok(Err(why)) if why == "HTTP 401" => {

                bad = true;

                ui::err("rejected by the hub: expired or revoked; run oxy auth login again")

            }

            Ok(Err(why)) => ui::warn(format!("not checked ({why})")),

            Err(e) => ui::warn(format!("not checked ({e})")),

        };

        println!(

            "{}",

            ui::kv("token", format!("{} {}", masked(&token), check))

        );

        if let Some(a) = &e.account {

            println!("{}", ui::kv("account", ui::author(a)));

        }

        let place = match &helper {

            Some(h) => format!("credential helper {h}"),

            None => store.path().display().to_string(),

        };

        println!("{}", ui::kv("stored", ui::dim(place)));

        if let Some(ca) = &e.ca {

            println!("{}", ui::kv("ca", ui::path(ca.display())));

        }

    }

    Ok(if bad { 1 } else { 0 })

}

pub fn logout(hub: Option<&str>) -> Result<i32> {

    let store = Credentials::user();

    let hub = match hub {

        Some(_) => resolve_hub(hub)?,

        None => {

            let entries = store.entries().map_err(|e| anyhow::anyhow!("{e}"))?;

            match (entries.len(), resolve_hub(None)) {

                (_, Ok(h)) => h,

                (1, Err(_)) => entries[0].hub.clone(),

                _ => bail!("name the hub to sign out of (oxy auth status lists them)"),

            }

        }

    };

    let Some(entry) = store.remove(&hub).map_err(|e| anyhow::anyhow!("{e}"))? else {

        println!("{}", ui::dim(format!("Not signed in to {hub}")));

        return Ok(0);

    };

    // Revoke the token on the hub too, so a copy left anywhere is useless.

    let revoked = match &entry.token {

        Some(t) => {

            let options = RemoteOptions {

                token: Some(t.clone()),

                ca: entry.ca.clone(),

                ..RemoteOptions::default()

            };

            matches!(

                http_json(

                    "DELETE",

                    &format!("{hub}/api/v1/user/token"),

                    None,

                    &options

                ),

                Ok((200 | 204, _))

            )

        }

        None => false,

    };

    println!("{} of {}", ui::done("Signed out"), ui::path(&hub));

    if revoked {

        println!(

            "  {} {}",

            ui::note(),

            ui::dim("the token was revoked on the hub")

        );

    } else {

        println!(

            "  {} {}",

            ui::caution(),

            ui::warn("the hub did not revoke the token: revoke it under Settings → Tokens")

        );

    }

    Ok(0)

}