//! Per-user credentials for hubs: one sign-in serves every repository on a

//! hub, and nothing secret is written into a checkout.

//!

//! The store is `credentials.toml` in the user's oxy directory (see

//! [`crate::repo::default_home`]), one section per hub:

//!

//! ```text

//! [https://oxygenhub.io]

//! account = "andymccall"

//! token = "oxyhub_…"

//! ```

//!

//! A hub is a scheme, host and port: a token is only ever sent to the hub

//! it was stored for. The file is written readable by its owner only, and

//! is ignored with a warning when anyone else can read it. With

//! `auth.helper` set in the user's `config.toml`, tokens go to that helper

//! instead (Git's credential-helper protocol, so `libsecret`,

//! `osxkeychain` and `manager` keep them in the system keyring) and the

//! file keeps only what is not secret.

//!

//! A token is sent over `https`, or over plain `http` to this machine only

//! ([`token_allowed`]); hub transports drop it on any redirect.

use crate::protocol::RemoteOptions;

use std::collections::{BTreeMap, HashMap};

use std::io::Write;

use std::path::{Path, PathBuf};

use std::process::{Command, Stdio};

use std::sync::{Mutex, OnceLock};

/// The user name oxy's tokens are stored under in a credential helper, so

/// they stay apart from Git credentials for the same host.

const HELPER_USER: &str = "oxy-token";

/// The hub of a URL: `scheme://host[:port]`, lower case, for `http` and

/// `https` URLs only.

pub fn hub_of(url: &str) -> Option<String> {

    let (scheme, rest) = url.split_once("://")?;

    let scheme = scheme.to_ascii_lowercase();

    if scheme != "http" && scheme != "https" {

        return None;

    }

    let host = rest.split(['/', '?', '#']).next()?;

    // Never key a hub on credentials embedded in the URL.

    let host = host.rsplit('@').next()?;

    if host.is_empty() {

        return None;

    }

    Some(format!("{scheme}://{}", host.to_ascii_lowercase()))

}

/// Whether a token may be sent to `url`: always over `https`, and over

/// plain `http` only to this machine (a hub under test, or a runner's own).

pub fn token_allowed(url: &str) -> bool {

    let Some(hub) = hub_of(url) else {

        return true;

    };

    match hub.split_once("://") {

        Some(("https", _)) => true,

        Some((_, host)) => {

            let name = match host.strip_prefix('[') {

                Some(v6) => v6.split(']').next().unwrap_or(""),

                None => host.rsplit_once(':').map_or(host, |(h, _)| h),

            };

            name == "localhost"

                || name == "::1"

                || name

                    .parse::<std::net::Ipv4Addr>()

                    .is_ok_and(|a| a.is_loopback())

        }

        None => false,

    }

}

/// What the store holds for one hub.

#[derive(Clone, Debug, Default, PartialEq, Eq)]

pub struct HubEntry {

    /// `scheme://host[:port]`.

    pub hub: String,

    /// The account the token signs in as, recorded at sign-in.

    pub account: Option<String>,

    /// The token, when it is in the file (not with a helper).

    pub token: Option<String>,

    /// Extra roots to trust for this hub (a self-signed hub).

    pub ca: Option<PathBuf>,

    /// An agent's grant token for keyless signing (oxygenhub#241), when it

    /// is in the file (not with a helper).

    pub grant: Option<String>,

}

/// Where a saved token went.

#[derive(Clone, Debug, PartialEq, Eq)]

pub enum Stored {

    /// The credentials file, owner-only.

    File(PathBuf),

    /// A credential helper, by its `auth.helper` value.

    Helper(String),

}

/// The credential store of one oxy home directory.

#[derive(Clone, Debug)]

pub struct Credentials {

    home: PathBuf,

}

impl Credentials {

    /// The store in `home` (an oxy home directory).

    pub fn at(home: impl Into<PathBuf>) -> Credentials {

        Credentials { home: home.into() }

    }

    /// The store in the user's oxy home directory.

    pub fn user() -> Credentials {

        Credentials::at(crate::repo::default_home())

    }

    /// `credentials.toml` in the home directory.

    pub fn path(&self) -> PathBuf {

        self.home.join("credentials.toml")

    }

    /// The configured credential helper (`auth.helper` in the user file).

    pub fn helper(&self) -> Option<String> {

        crate::repo::read_config_file(&self.home.join("config.toml"))

            .ok()?

            .remove("auth.helper")

            .filter(|h| !h.trim().is_empty())

    }

    /// Every hub in the file, tokens as stored there (none with a helper).

    pub fn entries(&self) -> Result<Vec<HubEntry>, String> {

        Ok(self.read()?.into_values().collect())

    }

    /// Whether the file can be read by anyone but its owner, in which case

    /// lookups ignore it.

    pub fn too_open(&self) -> bool {

        #[cfg(unix)]

        {

            use std::os::unix::fs::PermissionsExt;

            if let Ok(m) = std::fs::metadata(self.path()) {

                return m.permissions().mode() & 0o077 != 0;

            }

        }

        false

    }

    /// The entry for `hub`, its token fetched from the helper if one is set.

    pub fn get(&self, hub: &str) -> Result<Option<HubEntry>, String> {

        let entry = self.read()?.remove(hub);

        let helper = self.helper();

        let mut entry = match (entry, &helper) {

            (Some(e), _) => e,

            // A helper may hold a token stored before the file was cleared.

            (None, Some(_)) => HubEntry {

                hub: hub.to_string(),

                ..HubEntry::default()

            },

            (None, None) => return Ok(None),

        };

        if entry.token.is_none() {

            if let Some(h) = &helper {

                entry.token = run_helper(h, "get", hub, None)?;

            }

        }

        if entry.token.is_none()

            && entry.account.is_none()

            && entry.ca.is_none()

            && entry.grant.is_none()

        {

            return Ok(None);

        }

        Ok(Some(entry))

    }

    /// Save a token (and what is known about it) for `hub`.

    pub fn save(

        &self,

        hub: &str,

        token: &str,

        account: Option<&str>,

        ca: Option<&Path>,

    ) -> Result<Stored, String> {

        let mut all = self.read()?;

        let helper = self.helper();

        let entry = all.entry(hub.to_string()).or_insert_with(|| HubEntry {

            hub: hub.to_string(),

            ..HubEntry::default()

        });

        entry.account = account.map(String::from).or(entry.account.take());

        if let Some(ca) = ca {

            entry.ca = Some(ca.to_path_buf());

        }

        let stored = match &helper {

            Some(h) => {

                run_helper(h, "store", hub, Some(token))?;

                entry.token = None;

                Stored::Helper(h.clone())

            }

            None => {

                entry.token = Some(token.to_string());

                Stored::File(self.path())

            }

        };

        self.write(&all)?;

        forget_cached();

        Ok(stored)

    }

    /// Save an agent's grant token for `hub` (keyless signing, spec §14.7):

    /// in the file, or the helper under its own user name.

    pub fn save_grant(&self, hub: &str, token: &str) -> Result<Stored, String> {

        let mut all = self.read()?;

        let entry = all.entry(hub.to_string()).or_insert_with(|| HubEntry {

            hub: hub.to_string(),

            ..HubEntry::default()

        });

        let stored = match self.helper() {

            Some(h) => {

                run_helper_as(&h, "store", hub, GRANT_USER, Some(token))?;

                entry.grant = None;

                Stored::Helper(h)

            }

            None => {

                entry.grant = Some(token.to_string());

                Stored::File(self.path())

            }

        };

        self.write(&all)?;

        Ok(stored)

    }

    /// The agent grant token kept for `hub`, if any.

    pub fn grant(&self, hub: &str) -> Result<Option<String>, String> {

        if let Some(g) = self.read()?.get(hub).and_then(|e| e.grant.clone()) {

            return Ok(Some(g));

        }

        match self.helper() {

            Some(h) => run_helper_as(&h, "get", hub, GRANT_USER, None),

            None => Ok(None),

        }

    }

    /// Remove `hub` from the file and the helper; returns what it held,

    /// with the token, so the caller can revoke it.

    pub fn remove(&self, hub: &str) -> Result<Option<HubEntry>, String> {

        let found = self.get(hub)?;

        let mut all = self.read()?;

        if all.remove(hub).is_some() {

            self.write(&all)?;

        }

        if let Some(h) = self.helper() {

            run_helper(&h, "erase", hub, None)?;

        }

        forget_cached();

        Ok(found)

    }

    fn read(&self) -> Result<BTreeMap<String, HubEntry>, String> {

        let path = self.path();

        let text = match std::fs::read_to_string(&path) {

            Ok(t) => t,

            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(BTreeMap::new()),

            Err(e) => return Err(format!("reading {}: {e}", path.display())),

        };

        let mut out = BTreeMap::new();

        let mut current: Option<HubEntry> = None;

        for (n, line) in text.lines().enumerate() {

            let line = line.trim();

            if line.is_empty() || line.starts_with('#') {

                continue;

            }

            if let Some(hub) = line.strip_prefix('[').and_then(|l| l.strip_suffix(']')) {

                if let Some(e) = current.take() {

                    out.insert(e.hub.clone(), e);

                }

                current = Some(HubEntry {

                    hub: hub.trim().to_string(),

                    ..HubEntry::default()

                });

                continue;

            }

            let bad = || {

                format!(

                    "{} line {}: expected key = \"value\"",

                    path.display(),

                    n + 1

                )

            };

            let (k, v) = line.split_once('=').ok_or_else(bad)?;

            let v = unquote(v.trim()).ok_or_else(bad)?;

            let Some(e) = current.as_mut() else {

                return Err(format!(

                    "{} line {}: a key before any [hub] section",

                    path.display(),

                    n + 1

                ));

            };

            match k.trim() {

                "account" => e.account = Some(v),

                "token" => e.token = Some(v),

                "ca" => e.ca = Some(PathBuf::from(v)),

                "grant" => e.grant = Some(v),

                // Unknown keys are kept out of lookups, not fatal.

                _ => {}

            }

        }

        if let Some(e) = current {

            out.insert(e.hub.clone(), e);

        }

        Ok(out)

    }

    fn write(&self, all: &BTreeMap<String, HubEntry>) -> Result<(), String> {

        let mut text =

            String::from("# oxy credentials: a token for each hub. Keep this file private.\n");

        for e in all.values() {

            text.push_str(&format!("\n[{}]\n", e.hub));

            if let Some(a) = &e.account {

                text.push_str(&format!("account = {}\n", quote(a)));

            }

            if let Some(t) = &e.token {

                text.push_str(&format!("token = {}\n", quote(t)));

            }

            if let Some(c) = &e.ca {

                text.push_str(&format!("ca = {}\n", quote(&c.to_string_lossy())));

            }

            if let Some(g) = &e.grant {

                text.push_str(&format!("grant = {}\n", quote(g)));

            }

        }

        let path = self.path();

        std::fs::create_dir_all(&self.home)

            .map_err(|e| format!("creating {}: {e}", self.home.display()))?;

        crate::durable::write_atomic_private(&path, text.as_bytes())

            .map_err(|e| format!("writing {}: {e}", path.display()))

    }

    /// The stored token and CA for `url`'s hub, if any: memoized, so a

    /// helper runs once per hub in a process. A file anyone else can read

    /// is ignored, with a warning.

    pub fn lookup(&self, url: &str) -> (Option<String>, Option<PathBuf>) {

        let Some(hub) = hub_of(url) else {

            return (None, None);

        };

        let key = (self.home.clone(), hub.clone());

        if let Some(hit) = cache().lock().unwrap().get(&key) {

            return hit.clone();

        }

        let found = if self.too_open() {

            warn_once(&format!(

                "warning: {} can be read by other users, so oxy ignores it; run chmod 600 on it",

                self.path().display()

            ));

            (None, None)

        } else {

            match self.get(&hub) {

                // An agent's grant token serves when the home holds no

                // other: the hub takes it for the owner's repositories

                // (keyless agents, oxygenhub#241).

                Ok(Some(e)) => (

                    e.token

                        .or(e.grant)

                        .or_else(|| self.grant(&hub).ok().flatten()),

                    e.ca,

                ),

                Ok(None) => (None, None),

                Err(e) => {

                    warn_once(&format!("warning: credentials for {hub}: {e}"));

                    (None, None)

                }

            }

        };

        cache().lock().unwrap().insert(key, found.clone());

        found

    }

    /// Options for reaching `url` without a configured remote: `$OXY_TOKEN`

    /// and `$OXY_CA`, else what this store holds for its hub.

    pub fn options_for(&self, url: &str) -> RemoteOptions {

        let env_token = std::env::var("OXY_TOKEN").ok().filter(|t| !t.is_empty());

        let env_ca = std::env::var("OXY_CA").ok().map(PathBuf::from);

        let (token, ca) = match (&env_token, &env_ca) {

            (Some(_), Some(_)) => (None, None),

            _ => self.lookup(url),

        };

        RemoteOptions {

            token: env_token.or(token),

            ca: env_ca.or(ca),

            ..RemoteOptions::default()

        }

    }

}

type Cache = Mutex<HashMap<(PathBuf, String), (Option<String>, Option<PathBuf>)>>;

fn cache() -> &'static Cache {

    static CACHE: OnceLock<Cache> = OnceLock::new();

    CACHE.get_or_init(Default::default)

}

fn forget_cached() {

    cache().lock().unwrap().clear();

}

pub(crate) fn warn_once(message: &str) {

    static SEEN: OnceLock<Mutex<std::collections::HashSet<String>>> = OnceLock::new();

    if SEEN

        .get_or_init(Default::default)

        .lock()

        .unwrap()

        .insert(message.to_string())

    {

        eprintln!("{message}");

    }

}

fn quote(v: &str) -> String {

    let mut out = String::from('"');

    for c in v.chars() {

        match c {

            '"' => out.push_str("\\\""),

            '\\' => out.push_str("\\\\"),

            '\n' => out.push_str("\\n"),

            c => out.push(c),

        }

    }

    out.push('"');

    out

}

fn unquote(v: &str) -> Option<String> {

    let inner = v.strip_prefix('"')?.strip_suffix('"')?;

    let mut out = String::new();

    let mut chars = inner.chars();

    while let Some(c) = chars.next() {

        if c == '\\' {

            match chars.next()? {

                'n' => out.push('\n'),

                c => out.push(c),

            }

        } else {

            out.push(c);

        }

    }

    Some(out)

}

/// Run a credential helper (Git's protocol): `get`, `store` or `erase` for

/// `hub`. `get` returns the password the helper answered with.

///

/// `auth.helper` is a helper name (run as `git credential-NAME`), an

/// absolute path, or a shell command after `!`, as in Git.

fn run_helper(

    helper: &str,

    action: &str,

    hub: &str,

    token: Option<&str>,

) -> Result<Option<String>, String> {

    run_helper_as(helper, action, hub, HELPER_USER, token)

}

/// The helper's user name for an agent's grant token, beside the hub's

/// own token.

const GRANT_USER: &str = "oxy-agent-grant";

fn run_helper_as(

    helper: &str,

    action: &str,

    hub: &str,

    user: &str,

    token: Option<&str>,

) -> Result<Option<String>, String> {

    let (protocol, host) = hub

        .split_once("://")

        .ok_or_else(|| format!("{hub} is not a hub URL"))?;