//! The JSON API (hub spec §12.1) under `/api/v1`: bearer tokens, RFC 7807

//! problems, the same shapes as `oxy --json` where one exists. Reads need

//! `repo:read` (anonymous for public repositories); writes the scope named

//! on each handler.

use crate::auth::{self, Access, Role};

use crate::db::{self, accounts::Account};

use crate::repos::{view, RepoError, RepoName};

use crate::Shared;

use axum::extract::{Path, Query, State};

use axum::http::{HeaderMap, StatusCode};

use axum::response::{IntoResponse, Response};

use axum::routing::{get, post};

use axum::{Json, Router};

use hub_api::*;

use serde::Deserialize;

pub mod device;

mod projects;

/// Any other path under `/api/v1`: a problem document, not the site's page.

/// `GET /api/v1/version`: the hub's version and build, and the Oxygen and

/// OxygenFlow library versions it is built on.

async fn version() -> Json<serde_json::Value> {

    Json(crate::web::home::versions())

}

async fn no_route() -> ApiError {

    ApiError(StatusCode::NOT_FOUND, "no such API route".into())

}

/// The API, with release assets up to `asset_limit` bytes (the web form's

/// limit too; axum's default of 2 MiB refused ordinary builds).

pub fn router(asset_limit: usize) -> Router<Shared> {

    Router::new()

        .fallback(no_route)

        .route("/flow/claim", post(crate::flow::claim))

        .route("/flow/runners/register", post(crate::flow::register))

        .route("/flow/jobs/{id}/log", post(crate::flow::log))

        .route("/flow/jobs/{id}/finish", post(crate::flow::finish))

        .route(

            "/flow/jobs/{id}/artifacts/{name}",

            post(crate::flow::artifact).layer(axum::extract::DefaultBodyLimit::max(crate::flow::MAX_ARTIFACT_BYTES + (1 << 20))),

        )

        .route("/projects/{owner}", get(projects::list).post(projects::create))

        .route("/projects/{owner}/{number}", get(projects::board).patch(projects::edit))

        .route("/projects/{owner}/{number}/cards", post(projects::add_card))

        .route("/projects/{owner}/{number}/cards/{id}", axum::routing::patch(projects::move_card).delete(projects::remove_card))

        .route("/device/code", post(device::code))

        .route("/device/token", post(device::token))

        .route("/runners", get(runners))

        .route("/runners/queue", get(runner_queue))

        .route("/runners/{id}/jobs", get(runner_jobs))

        .route("/user", get(me))

        .route("/user/token", axum::routing::delete(revoke_own_token))

        .route("/version", get(version))

        .route("/notifications", get(notifications))

        .route("/notifications/read", post(notifications_read_all))

        .route("/notifications/{id}/read", post(notification_read))

        .route("/users/{name}", get(user))

        .route("/orgs/{name}", get(org))

        .route("/search", get(search))

        .route("/repos", get(list_repos).post(create_repo))

        .route("/repos/{owner}/{name}", get(get_repo))

        .route("/repos/{owner}/{name}/bookmarks", get(bookmarks))

        .route("/repos/{owner}/{name}/tags", get(tags))

        .route("/repos/{owner}/{name}/history/{r}", get(history))

        .route("/repos/{owner}/{name}/changes/{hash}", get(change))

        .route("/repos/{owner}/{name}/tree/{r}", get(tree_root))

        .route("/repos/{owner}/{name}/tree/{r}/{*path}", get(tree))

        .route("/repos/{owner}/{name}/file/{r}/{*path}", get(file))

        .route("/repos/{owner}/{name}/blame/{r}/{*path}", get(blame))

        .route("/repos/{owner}/{name}/conflicts", get(conflicts))

        .route("/repos/{owner}/{name}/trust", get(trust))

        .route("/repos/{owner}/{name}/releases/trust/{*tag}", get(release_trust))

        .route("/repos/{owner}/{name}/pushes", get(pushes))

        .route("/repos/{owner}/{name}/proposals", get(proposals).post(create_proposal))

        .route("/repos/{owner}/{name}/proposals/{number}", get(proposal).patch(edit_proposal))

        .route("/repos/{owner}/{name}/proposals/{number}/land", post(land_proposal))

        .route("/repos/{owner}/{name}/proposals/{number}/comments", get(proposal_comments).post(proposal_comment))

        .route("/repos/{owner}/{name}/proposals/{number}/reviews", get(proposal_reviews).post(proposal_review))

        .route("/repos/{owner}/{name}/proposals/{number}/checks", get(proposal_checks))

        .route("/repos/{owner}/{name}/proposals/{number}/files", get(proposal_files))

        .route("/repos/{owner}/{name}/proposals/{number}/content/{side}/{*path}", get(proposal_content))

        .route("/repos/{owner}/{name}/issues", get(issues).post(create_issue))

        .route("/repos/{owner}/{name}/issues/{number}", get(issue).post(issue_state).patch(issue_edit))

        .route("/repos/{owner}/{name}/issues/{number}/comments", get(issue_comments).post(issue_comment))

        .route("/repos/{owner}/{name}/labels", get(labels).post(create_label))

        .route("/repos/{owner}/{name}/labels/{label}", axum::routing::delete(delete_label))

        .route("/repos/{owner}/{name}/milestones", get(milestones))

        .route("/repos/{owner}/{name}/hooks", get(hooks).post(create_hook))

        .route("/repos/{owner}/{name}/hooks/{id}/delete", post(delete_hook))

        .route("/repos/{owner}/{name}/checks", post(post_check))

        .route("/repos/{owner}/{name}/flow/runs", get(flow_runs).post(start_flow_run))

        .route("/repos/{owner}/{name}/flow/runs/{number}", get(flow_run))

        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/log", get(flow_job_log))

        .route("/repos/{owner}/{name}/flow/runs/{number}/rerun", post(rerun_flow_run))

        .route("/repos/{owner}/{name}/checks/required", get(required_checks).put(set_required_checks))

        .route("/repos/{owner}/{name}/checks/{state}", get(checks_for_state))

        .route("/repos/{owner}/{name}/releases", get(releases).post(create_release))

        .route("/repos/{owner}/{name}/releases/{tag}", axum::routing::patch(edit_release))

        .route(

            "/repos/{owner}/{name}/releases/{tag}/assets",

            post(upload_asset).layer(axum::extract::DefaultBodyLimit::max(asset_limit + (1 << 20))),

        )

}

async fn releases(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name)): Path<(String, String)>,

) -> Result<Json<Vec<Release>>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;

    Ok(Json(crate::web::releases::api_views(&app, &repo, &row).await?))

}

async fn create_release(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name)): Path<(String, String)>,

    Json(body): Json<NewRelease>,

) -> Result<(StatusCode, Json<Release>), ApiError> {

    let c = caller(&app, &headers).await?;

    let me = c.require("repo:write")?.clone();

    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;

    crate::web::releases::create_release(&app, &repo, &row, &me, &body.tag, &body.title, body.notes, body.prerelease)

        .await

        .map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;

    let r = crate::web::releases::api_views(&app, &repo, &row)

        .await?

        .into_iter()

        .find(|r| r.tag == body.tag)

        .ok_or_else(|| not_found("no such release"))?;

    Ok((StatusCode::CREATED, Json(r)))

}

/// `PATCH …/releases/{tag}` (oxygenhub#72): change a release's title,

/// notes or prerelease flag, as the release page's Edit does.

async fn edit_release(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, tag)): Path<(String, String, String)>,

    Json(body): Json<ReleaseEdit>,

) -> Result<Json<Release>, ApiError> {

    let c = caller(&app, &headers).await?;

    let me = c.require("repo:write")?.clone();

    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;

    let r = db::releases::get(&app.db, row.id, &tag).await?.ok_or_else(|| not_found("no such release"))?;

    let title = body.title.as_deref().map(str::trim).filter(|t| !t.is_empty()).unwrap_or(&r.title);

    let notes = body.notes.as_deref().map(str::trim).unwrap_or(&r.notes);

    db::releases::edit(&app.db, r.id, title, notes, body.prerelease.unwrap_or(r.prerelease)).await?;

    db::accounts::audit(&app.db, Some(&me), "release.edited", &format!("{owner}/{name}@{tag}"), "").await.ok();

    let r = crate::web::releases::api_views(&app, &repo, &row)

        .await?

        .into_iter()

        .find(|r| r.tag == tag)

        .ok_or_else(|| not_found("no such release"))?;

    Ok(Json(r))

}

#[derive(Deserialize)]

struct AssetQuery {

    name: String,

}

/// `POST …/releases/{tag}/assets?name=file.tar.gz` with the file as the body.

async fn upload_asset(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, tag)): Path<(String, String, String)>,

    Query(q): Query<AssetQuery>,

    body: axum::body::Bytes,

) -> Result<(StatusCode, Json<Release>), ApiError> {

    let c = caller(&app, &headers).await?;

    c.require("repo:write")?;

    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;

    let r = db::releases::get(&app.db, row.id, &tag).await?.ok_or_else(|| not_found("no such release"))?;

    let ct = headers.get(axum::http::header::CONTENT_TYPE).and_then(|v| v.to_str().ok()).unwrap_or("application/octet-stream").to_string();

    crate::web::releases::store_asset(&app, r.id, &q.name, &ct, &body).await.map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;

    let r = crate::web::releases::api_views(&app, &repo, &row)

        .await?

        .into_iter()

        .find(|r| r.tag == tag)

        .ok_or_else(|| not_found("no such release"))?;

    Ok((StatusCode::CREATED, Json(r)))

}

pub struct ApiError(pub StatusCode, pub String);

impl IntoResponse for ApiError {

    fn into_response(self) -> Response {

        let body = Problem { status: self.0.as_u16(), title: self.0.canonical_reason().unwrap_or("error").into(), detail: self.1 };

        (self.0, [("content-type", "application/problem+json")], Json(body)).into_response()

    }

}

impl From<RepoError> for ApiError {

    fn from(e: RepoError) -> ApiError {

        match e {

            RepoError::NotFound => not_found("no such repository"),

            RepoError::Oxy(oxy_core::repo::RepoError::Msg(m)) => ApiError(StatusCode::NOT_FOUND, m),

            other => ApiError(StatusCode::INTERNAL_SERVER_ERROR, other.to_string()),

        }

    }

}

impl From<sqlx::Error> for ApiError {

    fn from(e: sqlx::Error) -> ApiError {

        ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string())

    }

}

pub(crate) fn not_found(what: &str) -> ApiError {

    ApiError(StatusCode::NOT_FOUND, what.into())

}

pub(crate) fn forbidden(what: &str) -> ApiError {

    ApiError(StatusCode::FORBIDDEN, what.into())

}

/// The address a request came from: the client's, as the proxy reports

/// it when the hub is behind one (`server.behind_proxy`), else the peer's.

/// Only an address's characters are kept, so it is safe to show.

pub fn client_addr(app: &Shared, headers: &HeaderMap, extensions: &axum::http::Extensions) -> String {

    let from_proxy = || {

        ["cf-connecting-ip", "x-forwarded-for", "x-real-ip"]

            .iter()

            .find_map(|h| headers.get(*h).and_then(|v| v.to_str().ok()).and_then(|v| v.split(',').next()).map(|v| v.trim().to_string()))

    };

    let addr = if app.config.server.behind_proxy {

        from_proxy()

    } else {

        extensions.get::<axum::extract::ConnectInfo<std::net::SocketAddr>>().map(|c| c.0.ip().to_string())

    };

    addr.map(|a| a.chars().filter(|c| c.is_ascii_hexdigit() || matches!(c, '.' | ':')).take(45).collect()).unwrap_or_default()

}

/// `DELETE /api/v1/user/token`: revoke the token this request is made

/// with, as `oxy auth logout` does.

async fn revoke_own_token(State(app): State<Shared>, headers: HeaderMap) -> Result<StatusCode, ApiError> {

    let c = caller(&app, &headers).await?;

    let (Some(account), Some(id)) = (c.account.as_ref(), c.token_id) else {

        return Err(ApiError(StatusCode::UNAUTHORIZED, "revoking needs the personal access token to revoke".into()));

    };

    db::accounts::delete_token(&app.db, account.id, id).await?;

    db::accounts::audit(&app.db, Some(account), "token.revoke", &c.token, "").await.ok();

    Ok(StatusCode::NO_CONTENT)

}

/// Who calls: the account behind a bearer token, with the token's scopes.

pub struct Caller {

    pub account: Option<Account>,

    pub scopes: Vec<String>,

    pub site: bool,

    /// The token's name, for records of what a call did.

    pub token: String,

    /// The personal access token's id, when one is used.

    pub token_id: Option<i64>,

}

impl Caller {

    fn has(&self, scope: &str) -> bool {

        self.site

            || self.scopes.iter().any(|s| {

                s == scope

                    || (scope == "repo:read" && (s == "repo:write" || s == "repo:admin"))

                    || (scope == "repo:write" && s == "repo:admin")

            })

    }

    fn require(&self, scope: &str) -> Result<&Account, ApiError> {

        if !self.has(scope) {

            return Err(forbidden(&format!("this token lacks the {scope} scope")));

        }

        self.account.as_ref().ok_or_else(|| ApiError(StatusCode::UNAUTHORIZED, "a personal access token is required".into()))

    }

}

pub async fn caller(app: &Shared, headers: &HeaderMap) -> Result<Caller, ApiError> {

    let Some(t) = oxy_server::bearer_token(headers) else {

        return Ok(Caller { account: None, scopes: vec![], site: false, token: String::new(), token_id: None });

    };

    if app.config.auth.push_tokens.iter().any(|x| auth::mac_equal(x, t)) {

        let admin = db::accounts::accounts(&app.db).await?.into_iter().find(|a| a.is_admin);

        return Ok(Caller {

            account: admin,

            scopes: vec!["repo:admin".into(), "user:read".into(), "checks:write".into()],

            site: true,

            token: "site token".into(),

            token_id: None,

        });

    }

    let token = db::accounts::token_by_hash(&app.db, &auth::token_hash(t)).await?;

    match token {

        Some(tok) if !tok.expired(db::now_ms()) => {

            let account = db::accounts::account_by_id(&app.db, tok.account_id).await?.filter(|a| !a.banned);

            db::accounts::touch_token(&app.db, tok.id).await.ok();

            Ok(Caller {

                account,

                scopes: tok.scope_list().iter().map(|s| s.to_string()).collect(),

                site: false,

                token: tok.name.clone(),

                token_id: Some(tok.id),

            })

        }

        _ => Err(ApiError(StatusCode::UNAUTHORIZED, "unknown or expired token".into())),

    }

}

fn repository(app: &Shared, r: &db::repos::RepoRow) -> Repository {

    Repository {

        owner: r.owner.clone(),

        name: r.name.clone(),

        description: r.description.clone(),

        default_bookmark: r.default_bookmark.clone(),

        visibility: r.visibility(),

        created_ms: r.created_ms,

        updated_ms: r.updated_ms,

        clone_url: format!("{}/{}/{}", app.config.base_url(), r.owner, r.name),

    }

}

/// A repository the caller may reach with `access`, else 404.

async fn reach(

    app: &Shared,

    c: &Caller,

    owner: &str,

    name: &str,

    access: Access,

) -> Result<(RepoName, db::repos::RepoRow, Role), ApiError> {

    let repo = RepoName::new(owner, name).ok_or_else(|| not_found("no such repository"))?;

    let row = db::repos::get(&app.db, owner, name).await?.ok_or_else(|| not_found("no such repository"))?;

    let role = auth::roles::role_for(&app.db, c.account.as_ref(), &row).await?;

    if !auth::roles::allows(role, access) {

        return Err(not_found("no such repository"));

    }

    Ok((repo, row, role.unwrap_or(Role::Read)))

}

fn summary(c: &view::ChangeView) -> ChangeSummary {

    ChangeSummary {

        hash: c.hash.clone(),

        message: if c.body.is_empty() { c.title.clone() } else { format!("{}\n\n{}", c.title, c.body) },

        author: Author {

            name: c.author.name.clone(),

            email: c.author.email.clone(),

            key: c.author.key.clone(),

            account: c.author.account.clone(),

            note: Author::note_for(&c.author.key, &c.author.account),

        },

        when_ms: c.when_ms,

        deps: c.deps.clone(),

        head: c.head,

        signature: match &c.signature {

            view::SigView::Unsigned => Signature::Unsigned,

            view::SigView::Valid { key, sealed, revoked, .. } => Signature::Valid { key: key.clone(), sealed: *sealed, revoked: *revoked },

            view::SigView::Invalid(why) => Signature::Invalid { reason: why.clone() },

        },

    }

}

// ---------------------------------------------------------------- accounts

async fn me(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<User>, ApiError> {

    let c = caller(&app, &headers).await?;

    let a = c.require("user:read")?;

    Ok(Json(user_of(&app, a).await?))

}

#[derive(Deserialize)]

struct InboxQuery {

    #[serde(default)]

    limit: Option<i64>,

}

/// The caller's inbox; reading and clearing it needs `user:read`, since

/// it touches nothing but the caller's own notifications.

async fn notifications(

    State(app): State<Shared>,

    headers: HeaderMap,

    Query(q): Query<InboxQuery>,

) -> Result<Json<hub_api::Inbox>, ApiError> {

    let c = caller(&app, &headers).await?;

    let a = c.require("user:read")?;

    let limit = q.limit.unwrap_or(50).clamp(1, 200);

    let base = app.config.base_url().trim_end_matches('/').to_string();

    let items = db::notify::inbox(&app.db, a.id, limit)

        .await?

        .into_iter()

        .map(|n| hub_api::Notification {

            id: n.id,

            at_ms: n.at_ms,

            kind: n.kind,

            title: n.title,

            url: if n.url.starts_with('/') { format!("{base}{}", n.url) } else { n.url },

            actor: n.actor,

            read: n.read,

        })

        .collect();

    Ok(Json(hub_api::Inbox { unread: db::notify::unread(&app.db, a.id).await?, items }))

}

async fn notification_read(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<i64>) -> Result<StatusCode, ApiError> {

    let c = caller(&app, &headers).await?;

    let a = c.require("user:read")?;

    db::notify::mark_read(&app.db, a.id, Some(id)).await?;

    Ok(StatusCode::NO_CONTENT)

}

async fn notifications_read_all(State(app): State<Shared>, headers: HeaderMap) -> Result<StatusCode, ApiError> {

    let c = caller(&app, &headers).await?;

    let a = c.require("user:read")?;

    db::notify::mark_read(&app.db, a.id, None).await?;

    Ok(StatusCode::NO_CONTENT)

}

async fn user_of(app: &Shared, a: &Account) -> Result<User, ApiError> {

    let keys = db::accounts::identities_of(&app.db, a.id).await?.into_iter().map(|i| i.key).collect();

    Ok(User { username: a.username.clone(), display_name: a.display_name.clone(), is_admin: a.is_admin, keys, created_ms: a.created_ms })

}

async fn user(State(app): State<Shared>, Path(name): Path<String>) -> Result<Json<User>, ApiError> {

    let a = db::accounts::account_by_name(&app.db, &name).await?.ok_or_else(|| not_found("no such account"))?;

    Ok(Json(user_of(&app, &a).await?))

}

async fn org(State(app): State<Shared>, Path(name): Path<String>) -> Result<Json<Organisation>, ApiError> {

    let o = db::accounts::org_by_name(&app.db, &name).await?.ok_or_else(|| not_found("no such organisation"))?;