//! Drops (oxygenhub#279): small snippets, each its own Oxygen repository

//! named `OWNER/drops/ID`. Made and edited in the browser and through the

//! API as signed changes by the hub as the owner's delegate; their files

//! rendered and raw; cloned and pushed with oxy; secret ones readable by

//! anyone with the address and listed nowhere; never among repositories;

//! changed and deleted only by their owner (or, deleting, a site admin);

//! push protection on their pushes and on what the hub commits for them.

//!

//! The fake credential is put together at run time, so this file is not

//! itself a finding.

use axum::body::Body;

use axum::http::{header, Request, StatusCode};

use http_body_util::BodyExt;

use oxy_core::repo::{IdentityScope, Repo};

use oxygenhub::auth::random_hex;

use oxygenhub::config::Config;

use oxygenhub::db;

use oxygenhub::repos::RepoName;

use oxygenhub::Shared;

use std::path::Path;

use tower::ServiceExt;

fn hermetic() {

    static ONCE: std::sync::Once = std::sync::Once::new();

    static DIR: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();

    ONCE.call_once(|| {

        let d = tempfile::tempdir().unwrap();

        std::env::set_var("OXY_HOME", d.path());

        DIR.set(d).ok();

    });

}

fn write(root: &Path, rel: &str, content: &[u8]) {

    let p = root.join(rel);

    std::fs::create_dir_all(p.parent().unwrap()).unwrap();

    std::fs::write(p, content).unwrap();

}

struct Hub {

    app: Shared,

    base: String,

    _dir: tempfile::TempDir,

}

async fn hub() -> Hub {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.registration.setup_code = "test-setup".into();

    config.registration.mode = "open".into();

    // Flow on for everything of andy's: a drop still never runs it.

    config.flow.repos = vec!["andy/*".into()];

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    config.server.base_url = format!("http://127.0.0.1:{port}");

    let app = oxygenhub::build(config).await.unwrap();

    let router = oxygenhub::router(app.clone());

    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });

    Hub { app, base: format!("http://127.0.0.1:{port}"), _dir: dir }

}

struct Res {

    status: StatusCode,

    body: String,

    cookie: Option<String>,

    location: Option<String>,

}

async fn send(app: &Shared, method: &str, path: &str, cookie: Option<&str>, token: Option<&str>, body: Option<(&str, String)>) -> Res {

    let mut req = Request::builder().method(method).uri(path);

    if let Some(c) = cookie {

        req = req.header(header::COOKIE, format!("oxyhub={c}"));

    }

    if let Some(t) = token {

        req = req.header(header::AUTHORIZATION, format!("Bearer {t}"));

    }

    let body = match body {

        Some((ct, b)) => {

            req = req.header(header::CONTENT_TYPE, ct);

            Body::from(b)

        }

        None => Body::empty(),

    };

    let res = oxygenhub::router(app.clone()).oneshot(req.body(body).unwrap()).await.unwrap();

    let status = res.status();

    let cookie = res

        .headers()

        .get(header::SET_COOKIE)

        .and_then(|v| v.to_str().ok())

        .and_then(|v| v.split(';').next())

        .and_then(|kv| kv.split_once('='))

        .map(|(_, v)| v.to_string());

    let location = res.headers().get(header::LOCATION).and_then(|v| v.to_str().ok()).map(String::from);

    let bytes = res.into_body().collect().await.unwrap().to_bytes();

    Res { status, body: String::from_utf8_lossy(&bytes).into_owned(), cookie, location }

}

async fn get(app: &Shared, path: &str, cookie: Option<&str>) -> Res {

    send(app, "GET", path, cookie, None, None).await

}

async fn post(app: &Shared, path: &str, cookie: Option<&str>, form: &str) -> Res {

    send(app, "POST", path, cookie, None, Some(("application/x-www-form-urlencoded", form.to_string()))).await

}

async fn api(app: &Shared, method: &str, path: &str, token: Option<&str>, json: Option<serde_json::Value>) -> Res {

    send(app, method, &format!("/api/v1{path}"), None, token, json.map(|j| ("application/json", j.to_string()))).await

}

async fn register(app: &Shared, user: &str) -> String {

    let r = post(

        app,

        "/register",

        None,

        &format!("username={user}&email={user}%40example.com&password=correct-horse-battery&setup=test-setup"),

    )

    .await;

    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

    r.cookie.unwrap()

}

async fn token(app: &Shared, user: &str) -> String {

    let me = db::accounts::account_by_name(&app.db, user).await.unwrap().unwrap();

    let (secret, hash) = oxygenhub::auth::new_token();

    db::accounts::create_token(&app.db, me.id, "laptop", &hash, "repo:read,repo:write", "", None).await.unwrap();

    secret

}

/// `user`'s identity, delegating to the hub's key and linked to the

/// account, as web edits need; the client checkout that holds it.

async fn delegate(app: &Shared, user: &str, work: &Path) -> Repo {

    let id = db::accounts::account_by_name(&app.db, user).await.unwrap().unwrap().id;

    let mut client = Repo::init(work).unwrap();

    client.create_identity(user, &format!("{user}@example.com"), IdentityScope::Repo).unwrap();

    client.delegate_add(app.hub_key.identity.clone(), oxy_core::identity::Scope::CHANGES | oxy_core::identity::Scope::REFS, None).unwrap();

    let key = client.config.author_key.unwrap();

    let ident = client.identity(&key).unwrap();

    db::accounts::link_identity(&app.db, id, &key.to_hex(), &ident.name, &ident.email, &ident.encode()).await.unwrap();

    client

}

fn csrf_of(page: &str) -> String {

    let i = page.find("name=\"_csrf\" value=\"").expect("csrf field") + "name=\"_csrf\" value=\"".len();

    page[i..].split('"').next().unwrap().to_string()

}

fn enc(s: &str) -> String {

    let mut out = String::new();

    for b in s.bytes() {

        match b {

            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => out.push(b as char),

            _ => out.push_str(&format!("%{b:02X}")),

        }

    }

    out

}

fn drop_id(location: &str) -> String {

    location.rsplit('/').next().unwrap().to_string()

}

const README: &str = "# Hello drops\n\nA *small* snippet.\n";

const MAIN_RS: &str = "fn main() {\n    println!(\"hi\");\n}\n";

#[tokio::test(flavor = "multi_thread")]

async fn drops_in_the_browser_the_api_and_oxy() {

    let h = hub().await;

    let app = &h.app;

    let andy = register(app, "andy").await;

    let bob = register(app, "bob").await;

    let andy_tok = token(app, "andy").await;

    let bob_tok = token(app, "bob").await;

    let work = tempfile::tempdir().unwrap();

    // `/drops` is your own Drops page; signed out, it asks you to sign in.

    let r = get(app, "/drops", Some(&andy)).await;

    assert_eq!(r.location.as_deref(), Some("/andy/drops"));

    assert!(get(app, "/drops", None).await.location.unwrap().starts_with("/login"));

    let page = get(app, "/andy/drops", Some(&andy)).await;

    assert_eq!(page.status, StatusCode::OK);

    assert!(page.body.contains("No drops yet") && page.body.contains("/drops/new"), "{}", page.body);

    // Before delegating to the hub's key, the form says so and nothing is made.

    let form = get(app, "/drops/new", Some(&andy)).await;

    assert!(form.body.contains("not delegated"), "{}", form.body);

    assert!(form.body.contains("data-drop-add") && form.body.contains("data-drop-files"));

    let csrf = csrf_of(&form.body);

    let fields = format!(

        "_csrf={csrf}&title=Hello&description={}&visibility=public&name=README.md&content={}&name=main.rs&content={}&name=&content=",

        enc("Two files"),

        enc(README),

        enc(MAIN_RS)

    );

    let r = post(app, "/drops/new", Some(&andy), &fields).await;

    assert_eq!(r.status, StatusCode::OK);

    assert!(r.body.contains("not delegated"), "{}", r.body);

    assert!(db::repos::drops_of(&app.db, "andy").await.unwrap().is_empty());

    // Created in the browser: a repository of its own, the files its first

    // change, authored by andy and signed by the hub as his delegate.

    let mut client = delegate(app, "andy", work.path()).await;

    let r = post(app, "/drops/new", Some(&andy), &fields).await;

    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

    let url = r.location.unwrap();

    let id = drop_id(&url);

    assert!(url.starts_with("/andy/drops/") && id.len() == 24 && id.bytes().all(|b| b.is_ascii_hexdigit()), "{url}");

    let row = db::repos::drop_by_id(&app.db, &id).await.unwrap().unwrap();

    assert!(row.is_drop() && row.title == "Hello" && row.description == "Two files" && row.visibility == "public");

    let name = RepoName::drop("andy", &id).unwrap();

    assert!(app.repos.exists(&name));

    // Its page renders the files: Markdown as a document, code highlighted.

    let page = get(app, &url, None).await;

    assert_eq!(page.status, StatusCode::OK);

    assert!(page.body.contains("<h1>Hello drops</h1>") || page.body.contains(">Hello drops</h1>"), "{}", page.body);

    assert!(page.body.contains("main.rs") && page.body.contains("println"), "{}", page.body);

    assert!(page.body.contains(&format!("oxy clone {}{url}", h.base)));

    assert!(!page.body.contains(">EDIT<"), "no edit for the signed out");

    assert!(get(app, &url, Some(&andy)).await.body.contains(">EDIT<"));

    // The raw file, and a change page's tree link.

    let raw = get(app, &format!("{url}/raw/main/main.rs"), None).await;

    assert_eq!(raw.status, StatusCode::OK);

    assert_eq!(raw.body, MAIN_RS);

    assert_eq!(get(app, &format!("{url}/tree/main"), None).await.status, StatusCode::OK);

    // An edit in the browser: a second signed change; the history shows two.

    let edit = get(app, &format!("{url}/edit"), Some(&andy)).await;

    assert_eq!(edit.status, StatusCode::OK);

    assert!(edit.body.contains("README.md") && edit.body.contains("println"), "{}", edit.body);

    let csrf = csrf_of(&edit.body);

    let changed = "fn main() {\n    println!(\"hello, drops\");\n}\n";

    let r = post(

        app,

        &format!("{url}/edit"),

        Some(&andy),

        &format!(

            "_csrf={csrf}&title=Hello&description={}&visibility=public&name=README.md&content={}&name=main.rs&content={}&message={}",

            enc("Two files"),

            enc(README),

            enc(changed),

            enc("Say hello")

        ),

    )

    .await;

    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

    let hist = get(app, &format!("{url}/changes/main"), None).await;

    assert_eq!(hist.status, StatusCode::OK);

    assert!(hist.body.contains("Say hello") && hist.body.contains("Create Hello"), "{}", hist.body);

    assert!(hist.body.contains("aria-label=\"Drop\""), "the drop's own bar");

    assert!(!hist.body.contains("/proposals\"") && !hist.body.contains("swimlanes"), "no repository tabs");

    let v = app.repos.read(&name, oxygenhub::repos::view::verification).await.unwrap();

    assert_eq!((v.total, v.signed, v.invalid.len()), (2, 2, 0), "{v:?}");

    // A change page with its diff, linked from the history.

    let change = hist.body.split(&format!("{url}/change/")).nth(1).unwrap().split('"').next().unwrap().to_string();

    let cp = get(app, &format!("{url}/change/{change}"), None).await;

    assert_eq!(cp.status, StatusCode::OK);

    assert!(cp.body.contains("hello, drops"), "{}", cp.body);

    assert_eq!(get(app, &format!("{url}/raw/main/main.rs"), None).await.body, changed);

    // The push log has both, as web edits; Flow never ran.

    let pushes = db::repos::pushes(&app.db, row.id, 10).await.unwrap();

    assert_eq!(pushes.iter().filter(|p| p.ok && p.reason == "web edit").count(), 2, "{pushes:?}");

    assert!(db::flow::runs(&app.db, row.id, 10, None).await.unwrap().is_empty());

    // A secret drop through the API.

    let r = api(

        app,

        "POST",

        "/drops",

        Some(&andy_tok),

        Some(serde_json::json!({ "title": "Hidden", "secret": true, "files": [{ "name": "notes.txt", "content": "secret plans\n" }] })),

    )

    .await;

    assert_eq!(r.status, StatusCode::CREATED, "{}", r.body);

    let secret: hub_api::Drop = serde_json::from_str(&r.body).unwrap();

    assert_eq!(secret.visibility, "secret");

    assert_eq!(secret.files[0].content.as_deref(), Some("secret plans\n"));

    let secret_url = format!("/andy/drops/{}", secret.id);

    assert_eq!(secret.url, format!("{}{secret_url}", h.base));

    // Anyone with the address reads it, signed in or not, on the web and the API.

    let page = get(app, &secret_url, None).await;

    assert_eq!(page.status, StatusCode::OK);

    assert!(page.body.contains("secret plans") && page.body.contains("listed nowhere"), "{}", page.body);

    assert_eq!(get(app, &format!("{secret_url}/raw/main/notes.txt"), Some(&bob)).await.body, "secret plans\n");

    let r = api(app, "GET", &format!("/drops/{}", secret.id), None, None).await;

    assert_eq!(r.status, StatusCode::OK, "{}", r.body);

    // But it is listed to andy only; the public one to everyone.

    let mine = get(app, "/andy/drops", Some(&andy)).await.body;

    assert!(mine.contains(&secret.id) && mine.contains(&id), "{mine}");

    for viewer in [Some(bob.as_str()), None] {

        let theirs = get(app, "/andy/drops", viewer).await.body;

        assert!(theirs.contains(&id) && theirs.contains("Hello"), "{theirs}");

        assert!(!theirs.contains(&secret.id) && !theirs.contains("Hidden"), "{theirs}");

    }

    let listed: Vec<hub_api::Drop> = serde_json::from_str(&api(app, "GET", "/drops", Some(&andy_tok), None).await.body).unwrap();

    assert_eq!(listed.len(), 2);

    let listed: Vec<hub_api::Drop> = serde_json::from_str(&api(app, "GET", "/users/andy/drops", Some(&bob_tok), None).await.body).unwrap();

    assert_eq!(listed.iter().map(|d| d.id.as_str()).collect::<Vec<_>>(), vec![id.as_str()]);

    assert!(listed[0].files.iter().all(|f| f.content.is_none()), "a list carries no content");

    let listed: Vec<hub_api::Drop> = serde_json::from_str(&api(app, "GET", "/users/andy/drops", None, None).await.body).unwrap();

    assert_eq!(listed.len(), 1);

    // Drops are never repositories: not on the profile, the dashboard,

    // explore, search, the API's repository list or under /repos.

    for (path, who) in [

        ("/andy", Some(&andy)),

        ("/andy", None),

        ("/", Some(&andy)),

        ("/explore", None),

        ("/explore", Some(&andy)),

        ("/search?q=drops", Some(&andy)),

    ] {

        let body = get(app, path, who.map(String::as_str)).await.body;

        assert!(!body.contains(&id) && !body.contains(&secret.id), "{path} lists a drop: {body}");

    }

    for q in ["Hello", "Hidden", id.as_str()] {

        let body = get(app, &format!("/search?q={q}"), Some(&andy)).await.body;

        assert!(!body.contains(&format!("/andy/drops/{id}")) && !body.contains(&secret_url), "search {q}: {body}");

    }

    for tok in [Some(andy_tok.as_str()), None] {

        let repos = api(app, "GET", "/repos", tok, None).await.body;

        assert!(!repos.contains("drops/"), "{repos}");

    }

    assert_eq!(api(app, "GET", &format!("/repos/andy/drops%2F{id}"), Some(&andy_tok), None).await.status, StatusCode::NOT_FOUND);

    assert!(db::repos::list(&app.db).await.unwrap().iter().all(|r| !r.is_drop()));

    assert!(db::repos::list_by_owner(&app.db, "andy").await.unwrap().is_empty());

    assert_eq!(db::repos::list_with_drops(&app.db).await.unwrap().len(), 2, "upkeep sees them");

    // `drops` is no repository's name.

    let csrf = csrf_of(&get(app, "/new", Some(&andy)).await.body);

    let r = post(app, "/new", Some(&andy), &format!("_csrf={csrf}&owner=andy&name=drops&visibility=public")).await;

    assert!(r.status == StatusCode::OK && r.body.contains("class=\"error\""), "{}", r.body);

    assert!(!app.repos.exists(&RepoName { owner: "andy".into(), name: "drops".into() }));

    // `oxy clone` of a drop, anonymously, even a secret one; the owner pushes back.

    let anon = tempfile::tempdir().unwrap();

    let (u, p) = (format!("{}{secret_url}", h.base), anon.path().join("c"));

    let cloned = tokio::task::spawn_blocking(move || Repo::clone(&u, &p)).await.unwrap().unwrap();

    assert_eq!(std::fs::read_to_string(cloned.root().join("notes.txt")).unwrap(), "secret plans\n");

    client.config.set("remote.origin.url", &format!("{}{url}", h.base)).unwrap();

    client.config.set("remote.origin.token", &andy_tok).unwrap();

    client.save_config().unwrap();

    let (u, p, t) = (format!("{}{url}", h.base), work.path().join("mine"), andy_tok.clone());

    let mut mine = tokio::task::spawn_blocking(move || {

        let mut r = Repo::clone(&u, &p).unwrap();

        r.config.set("remote.origin.token", &t).unwrap();

        r.save_config().unwrap();

        r

    })

    .await

    .unwrap();

    assert_eq!(std::fs::read_to_string(mine.root().join("main.rs")).unwrap(), changed);

    mine.create_identity("andy", "[email protected]", IdentityScope::Repo).unwrap();

    write(mine.root(), "extra.sh", b"echo pushed\n");

    mine.snapshot("t").unwrap();

    let pushed = mine.commit("Add a script", &[]).unwrap();

    assert!(mine.push("origin", false).unwrap().iter().all(|r| r.ok));

    assert!(app.repos.open(&name).unwrap().store().get_change(&pushed).is_ok());

    let page = get(app, &url, None).await.body;

    assert!(page.contains("extra.sh") && page.contains("> pushed<"), "{page}");

    // Someone else's token cannot push to it.

    mine.config.set("remote.origin.token", &bob_tok).unwrap();

    mine.save_config().unwrap();

    write(mine.root(), "bob.txt", b"bob\n");

    mine.snapshot("t").unwrap();

    let bobs = mine.commit("bob's", &[]).unwrap();

    let err = mine.push("origin", false).err().unwrap_or_else(|| panic!("bob may not push")).to_string();

    assert!(err.contains("403") || err.contains("write access"), "{err}");

    mine.abandon(&bobs).unwrap();

    mine.config.set("remote.origin.token", &andy_tok).unwrap();

    mine.save_config().unwrap();

    // Push protection refuses a drop push that adds a credential.

    let ghp = format!("{}_{}", "ghp", random_hex(18));

    write(mine.root(), "token.env", format!("GH_TOKEN={ghp}\n").as_bytes());

    mine.snapshot("t").unwrap();

    let leak = mine.commit("oops", &[]).unwrap();

    let err = mine.push("origin", false).err().unwrap_or_else(|| panic!("the push was accepted")).to_string();