//! The read-only Git mirror (hub spec §14): the default bookmark exported

//! with oxy's own `git export` into `<data>/mirrors/<owner>/<name>.git`

//! after every update, and served over Git's smart HTTP by `git

//! http-backend` behind the hub's access checks. Pushing to it is refused.

use crate::auth::{self, Access};

use crate::db::{self, repos::RepoRow};

use crate::repos::RepoName;

use crate::Shared;

use axum::body::Bytes;

use axum::extract::{Path, RawQuery, State};

use axum::http::{header, HeaderMap, Method, StatusCode};

use axum::response::{IntoResponse, Response};

use std::path::PathBuf;

use tokio::io::AsyncWriteExt;

pub fn mirror_dir(app: &Shared, repo: &RepoName) -> PathBuf {

    app.config.data.join("mirrors").join(&repo.owner).join(format!("{}.git", repo.name))

}

/// Export the default bookmark into the mirror, if the mirror is on.

pub async fn refresh(app: &Shared, row: &RepoRow) {

    if !row.git_mirror {

        return;

    }

    let Some(repo) = RepoName::new(&row.owner, &row.name) else { return };

    let dir = mirror_dir(app, &repo);

    let bookmark = row.default_bookmark.clone();

    let result = app

        .repos

        .write(&repo, move |r, _| {

            let mut r = oxy_core::repo::Repo::open(r.root())?;

            r.config.bookmark = bookmark.clone();

            let report = r.git_export_as(&dir, &bookmark)?;

            // Point HEAD at the exported branch so clones check it out.

            std::fs::write(dir.join("HEAD"), format!("ref: refs/heads/{bookmark}\n"))?;

            let state = r.view()?.bookmarks.get(&bookmark).map(|s| s.to_hex()).unwrap_or_default();

            Ok((report.exported, state))

        })

        .await;

    match result {

        Ok((_, state)) => {

            db::repos::set_git_mirror_state(&app.db, row.id, &state).await.ok();

        }

        Err(e) => tracing::warn!("git mirror of {}: {e}", row.slug()),

    }

}

/// Who a Git client is: HTTP Basic with a personal access token as the

/// password (any user name), or anonymous.

async fn git_caller(app: &Shared, headers: &HeaderMap) -> Result<Option<db::accounts::Account>, StatusCode> {

    let Some(v) = headers.get(header::AUTHORIZATION).and_then(|v| v.to_str().ok()) else { return Ok(None) };

    let token = if let Some(b) = v.strip_prefix("Basic ") {

        let decoded = base64_decode(b.trim()).ok_or(StatusCode::UNAUTHORIZED)?;

        let s = String::from_utf8(decoded).map_err(|_| StatusCode::UNAUTHORIZED)?;

        s.split_once(':').map(|(_, p)| p.to_string()).ok_or(StatusCode::UNAUTHORIZED)?

    } else if let Some(t) = v.strip_prefix("Bearer ") {

        t.trim().to_string()

    } else {

        return Err(StatusCode::UNAUTHORIZED);

    };

    let tok = db::accounts::token_by_hash(&app.db, &auth::token_hash(&token)).await.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;

    match tok {

        Some(t) if !t.expired(db::now_ms()) && (t.has_scope("repo:read") || t.has_scope("repo:write") || t.has_scope("repo:admin")) => {

            db::accounts::account_by_id(&app.db, t.account_id).await.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)

        }

        _ => Err(StatusCode::UNAUTHORIZED),

    }

}

fn base64_decode(s: &str) -> Option<Vec<u8>> {

    const T: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

    let mut out = Vec::new();

    let mut buf = 0u32;

    let mut bits = 0;

    for c in s.bytes().filter(|c| *c != b'=') {

        let v = T.iter().position(|x| *x == c)? as u32;

        buf = (buf << 6) | v;

        bits += 6;

        if bits >= 8 {

            bits -= 8;

            out.push((buf >> bits) as u8);

            buf &= (1 << bits) - 1;

        }

    }

    Some(out)

}

fn challenge() -> Response {

    (StatusCode::UNAUTHORIZED, [(header::WWW_AUTHENTICATE, "Basic realm=\"OxygenHub\"")], "authentication required").into_response()

}

/// Every smart-HTTP path under `/{owner}/{name}.git/`.

pub async fn serve(

    State(app): State<Shared>,

    Path((owner, name_git, rest)): Path<(String, String, String)>,

    method: Method,

    RawQuery(query): RawQuery,

    headers: HeaderMap,

    body: Bytes,

) -> Response {

    let Some(name) = name_git.strip_suffix(".git") else { return StatusCode::NOT_FOUND.into_response() };

    let Some(repo) = RepoName::new(&owner, name) else { return StatusCode::NOT_FOUND.into_response() };

    let query = query.unwrap_or_default();

    if rest.contains("git-receive-pack") || query.contains("git-receive-pack") {

        return (StatusCode::FORBIDDEN, "This is a read-only Git mirror of an Oxygen repository; push with oxy instead.").into_response();

    }

    let row = match db::repos::get(&app.db, &owner, name).await {

        Ok(Some(r)) if r.git_mirror => r,

        _ => return StatusCode::NOT_FOUND.into_response(),

    };

    let account = match git_caller(&app, &headers).await {

        Ok(a) => a,

        Err(_) => return challenge(),

    };

    let role = auth::roles::role_for(&app.db, account.as_ref(), &row).await.ok().flatten();

    if !auth::roles::allows(role, Access::Read) {

        return if account.is_none() { challenge() } else { StatusCode::NOT_FOUND.into_response() };

    }

    let dir = mirror_dir(&app, &repo);

    if !dir.join("HEAD").exists() {

        refresh(&app, &row).await;

    }

    let root = app.config.data.join("mirrors");

    let git = std::env::var("OXYHUB_GIT").unwrap_or_else(|_| "git".into());

    let mut cmd = tokio::process::Command::new(git);

    cmd.arg("http-backend")

        .env_clear()

        .env("PATH", std::env::var("PATH").unwrap_or_default())

        .env("GIT_PROJECT_ROOT", &root)

        .env("GIT_HTTP_EXPORT_ALL", "1")

        .env("PATH_INFO", format!("/{owner}/{name_git}/{rest}"))

        .env("REQUEST_METHOD", method.as_str())

        .env("QUERY_STRING", &query)

        .env("CONTENT_TYPE", headers.get(header::CONTENT_TYPE).and_then(|v| v.to_str().ok()).unwrap_or(""))

        .env("CONTENT_LENGTH", body.len().to_string())

        .env("GIT_CONFIG_NOSYSTEM", "1")

        .env("HOME", &root)

        .stdin(std::process::Stdio::piped())

        .stdout(std::process::Stdio::piped())

        .stderr(std::process::Stdio::piped());

    if let Some(enc) = headers.get(header::CONTENT_ENCODING).and_then(|v| v.to_str().ok()) {

        cmd.env("HTTP_CONTENT_ENCODING", enc);

    }

    if let Some(p) = headers.get("git-protocol").and_then(|v| v.to_str().ok()) {

        cmd.env("GIT_PROTOCOL", p);

    }

    let mut child = match cmd.spawn() {

        Ok(c) => c,

        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, format!("git http-backend: {e}")).into_response(),

    };

    if let Some(mut stdin) = child.stdin.take() {

        let _ = stdin.write_all(&body).await;

    }

    let out = match child.wait_with_output().await {

        Ok(o) => o,

        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()).into_response(),

    };

    cgi_response(&out.stdout)

}

/// Turn CGI output (headers, blank line, body) into a response.

fn cgi_response(raw: &[u8]) -> Response {

    let split =

        raw.windows(4).position(|w| w == b"\r\n\r\n").map(|i| (i, 4)).or_else(|| raw.windows(2).position(|w| w == b"\n\n").map(|i| (i, 2)));

    let Some((at, sep)) = split else { return (StatusCode::BAD_GATEWAY, "malformed CGI output").into_response() };

    let head = String::from_utf8_lossy(&raw[..at]);

    let body = raw[at + sep..].to_vec();

    let mut status = StatusCode::OK;

    let mut builder = Response::builder();

    for line in head.lines() {

        let Some((k, v)) = line.split_once(':') else { continue };

        let (k, v) = (k.trim(), v.trim());

        if k.eq_ignore_ascii_case("status") {

            if let Some(code) = v.split_whitespace().next().and_then(|c| c.parse::<u16>().ok()) {

                status = StatusCode::from_u16(code).unwrap_or(StatusCode::OK);

            }

        } else {

            builder = builder.header(k, v);

        }

    }

    builder.status(status).body(axum::body::Body::from(body)).unwrap_or_else(|_| StatusCode::BAD_GATEWAY.into_response())

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn base64_and_cgi() {

        assert_eq!(base64_decode("dXNlcjpzM2NyZXQ=").unwrap(), b"user:s3cret");

        let r = cgi_response(b"Status: 404 Not Found\r\nContent-Type: text/plain\r\n\r\nnope");

        assert_eq!(r.status(), StatusCode::NOT_FOUND);

    }

}