//! Terraform and OpenTofu state, kept by the hub per repository

//! (oxygenhub#252): the HTTP backend Terraform and OpenTofu speak, with

//! locking, at `/api/v1/repos/OWNER/NAME/terraform/state/STATE`, so a Flow

//! job keeps its state without any cloud credential. A job authenticates

//! with an identity token of this hub's for the audience `{base}/terraform`

//! (its pipeline's `identity` block) or its runner's job token, either for

//! its own repository only; people with a token of theirs and their

//! repository role. Tokens go as the bearer, or as the password of Basic

//! auth, which is what the backend sends.

//!

//! State is kept outside the repository's history (it often holds secrets),

//! sealed at rest with the hub's secrets key, and its last versions are

//! kept, so a bad apply can be rolled back.

use crate::api::ApiError;

use crate::auth::roles::{Access, Role};

use crate::{db, Shared};

use axum::body::Bytes;

use axum::extract::{Path, Query, State};

use axum::http::{header, HeaderMap, Method, StatusCode};

use axum::response::{IntoResponse, Response};

/// Versions of a state kept besides the current one.

pub const VERSIONS_KEPT: i64 = 20;

/// The most a state may weigh.

pub const MAX_STATE_BYTES: usize = 32 << 20;

/// Who may use a repository's states.

enum Who {

    /// A running job of this repository.

    Job { name: String },

    /// A person, with their role on the repository.

    Person { account: Box<db::accounts::Account>, role: Role },

}

impl Who {

    fn label(&self) -> String {

        match self {

            Who::Job { name } => name.clone(),

            Who::Person { account, .. } => account.username.clone(),

        }

    }

    fn may(&self, access: Access) -> bool {

        match self {

            // A job reads and writes its own repository's states.

            Who::Job { .. } => true,

            Who::Person { role, .. } => crate::auth::roles::allows(Some(*role), access),

        }

    }

}

fn err(status: StatusCode, why: impl Into<String>) -> ApiError {

    ApiError(status, why.into())

}

/// The token a request carries: the bearer, or Basic auth's password.

fn token_of(headers: &HeaderMap) -> Option<String> {

    if let Some(t) = oxy_server::bearer_token(headers) {

        return Some(t.to_string());

    }

    let v = headers.get(header::AUTHORIZATION)?.to_str().ok()?;

    let b64 = v.strip_prefix("Basic ").or_else(|| v.strip_prefix("basic "))?;

    let raw = String::from_utf8(oxy_core::dsse::base64_decode(b64.trim())?).ok()?;

    let (_, password) = raw.split_once(':')?;

    (!password.is_empty()).then(|| password.to_string())

}

/// The audience a job's identity token needs here.

pub fn audience(base_url: &str) -> String {

    format!("{}/terraform", base_url.trim_end_matches('/'))

}

fn valid_name(name: &str) -> bool {

    !name.is_empty()

        && name.len() <= 100

        && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')

        && !name.starts_with('.')

}

async fn who(app: &Shared, headers: &HeaderMap, row: &db::repos::RepoRow) -> Result<Who, ApiError> {

    let token = token_of(headers).ok_or_else(|| {

        err(

            StatusCode::UNAUTHORIZED,

            "a Terraform state needs a token: a job's (TF_HTTP_PASSWORD), or one of yours with repo:read or repo:write",

        )

    })?;

    let hash = crate::auth::token_hash(&token);

    if token.starts_with(crate::flow::JOB_TOKEN_PREFIX) {

        let job = db::flow::job_by_token(&app.db, &hash, crate::flow::JOB_TOKEN_MAX_AGE_MS)

            .await

            .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

            .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "this job token is not valid (the job must be running)"))?;

        let run = db::flow::run_by_id(&app.db, job.run_id)

            .await

            .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

            .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "this job token is not valid"))?;

        if run.repo_id != row.id {

            return Err(err(StatusCode::FORBIDDEN, "a job keeps the states of its own repository only"));

        }

        return Ok(Who::Job { name: format!("run #{} {}", run.number, job.name) });

    }

    let personal = db::accounts::token_by_hash(&app.db, &hash).await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    let Some(token) = personal.filter(|t| !t.expired(db::now_ms())) else {

        // A job's identity token for this hub's Terraform audience.

        let issuer = app.oidc().await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

        let aud = audience(app.config.base_url());

        let Some(claims) = issuer.verify(&token, &aud, db::now_ms()) else {

            return Err(err(StatusCode::UNAUTHORIZED, format!("unknown or expired token (a job's identity token must be for {aud})")));

        };

        let sub = claims["sub"].as_str().unwrap_or("");

        let repo = claims["repository"]

            .as_str()

            .map(String::from)

            .or_else(|| sub.strip_prefix("repo:").and_then(|r| r.split_once(":bookmark:")).map(|(r, _)| r.to_string()));

        if repo.as_deref() != Some(row.slug().as_str()) {

            return Err(err(StatusCode::FORBIDDEN, "a job keeps the states of its own repository only"));

        }

        return Ok(Who::Job { name: sub.to_string() });

    };

    if !(token.has_scope("repo:read") || token.has_scope("repo:write") || token.has_scope("repo:admin")) {

        return Err(err(StatusCode::FORBIDDEN, "the token lacks repo:read (to read a state) or repo:write (to change one)"));

    }

    let slug = row.slug();

    if !token.covers(&slug) {

        return Err(err(StatusCode::FORBIDDEN, format!("the token does not cover {slug}")));

    }

    let account = db::accounts::account_by_id(&app.db, token.account_id)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .filter(|a| !a.banned && !a.disabled)

        .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "unknown token"))?;

    let role = crate::auth::roles::role_for(&app.db, Some(&account), row)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    // A read-only token reads, whatever the role.

    let role = match role {

        Some(r) if !(token.has_scope("repo:write") || token.has_scope("repo:admin")) => Some(r.min(Role::Read)),

        r => r,

    };

    match role {

        Some(r) if crate::auth::roles::allows(Some(r), Access::Read) => Ok(Who::Person { account: Box::new(account), role: r }),

        _ => Err(err(StatusCode::NOT_FOUND, "no such repository")),

    }

}

#[derive(serde::Deserialize, Default)]

pub struct LockQuery {

    #[serde(rename = "ID", default)]

    id: Option<String>,

}

fn json(status: StatusCode, body: String) -> Response {

    (status, [(header::CONTENT_TYPE, "application/json")], body).into_response()

}

/// The lock's ID in a lock-info body (`{"ID": …}`).

fn lock_id(info: &[u8]) -> Option<String> {

    serde_json::from_slice::<serde_json::Value>(info).ok()?.get("ID")?.as_str().map(String::from)

}

/// `GET|POST|DELETE|LOCK|UNLOCK /api/v1/repos/{owner}/{name}/terraform/state/{state}`.

pub async fn state(

    State(app): State<Shared>,

    method: Method,

    headers: HeaderMap,

    Path((owner, name, state)): Path<(String, String, String)>,

    Query(q): Query<LockQuery>,

    body: Bytes,

) -> Result<Response, ApiError> {

    if !valid_name(&state) {

        return Err(err(StatusCode::BAD_REQUEST, "a state's name is letters, digits, '-', '_' and '.', up to 100"));

    }

    let row = db::repos::get(&app.db, &owner, &name)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such repository"))?;

    let who = who(&app, &headers, &row).await?;

    let write = method != Method::GET;

    if !who.may(if write { Access::Write } else { Access::Read }) {

        return Err(err(StatusCode::FORBIDDEN, "changing a state needs the write role"));

    }

    let db_err = |e: sqlx::Error| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string());

    let current = db::terraform::get(&app.db, row.id, &state).await.map_err(db_err)?;

    let locked = current.as_ref().filter(|s| !s.lock_id.is_empty());

    match method.as_str() {

        "GET" => match current.filter(|s| !s.body.is_empty()) {

            Some(s) => {

                let plain =

                    app.secret_key.open(&s.body).ok_or_else(|| err(StatusCode::INTERNAL_SERVER_ERROR, "the state does not open"))?;

                Ok(json(StatusCode::OK, plain))

            }

            // No state yet: Terraform starts afresh.

            None => Ok(StatusCode::NO_CONTENT.into_response()),

        },

        "POST" => {

            if body.len() > MAX_STATE_BYTES {

                return Err(err(StatusCode::PAYLOAD_TOO_LARGE, format!("a state may be {} MiB at most", MAX_STATE_BYTES >> 20)));

            }

            let text = std::str::from_utf8(&body).map_err(|_| err(StatusCode::BAD_REQUEST, "a state is JSON"))?;

            let parsed: serde_json::Value = serde_json::from_str(text).map_err(|_| err(StatusCode::BAD_REQUEST, "a state is JSON"))?;

            if let Some(l) = locked {

                if q.id.as_deref() != Some(l.lock_id.as_str()) {

                    return Ok(json(StatusCode::LOCKED, l.lock_info.clone()));

                }

            }

            let serial = parsed.get("serial").and_then(|v| v.as_i64()).unwrap_or(0);

            let sealed = app.secret_key.seal(text);

            db::terraform::put(&app.db, row.id, &state, &sealed, serial, &who.label(), VERSIONS_KEPT).await.map_err(db_err)?;

            Ok(StatusCode::OK.into_response())

        }

        "DELETE" => {

            if let Some(l) = locked {

                if q.id.as_deref() != Some(l.lock_id.as_str()) {

                    return Ok(json(StatusCode::LOCKED, l.lock_info.clone()));

                }

            }

            db::terraform::delete(&app.db, row.id, &state).await.map_err(db_err)?;

            Ok(StatusCode::OK.into_response())

        }

        "LOCK" => {

            let info = std::str::from_utf8(&body).unwrap_or("");

            let Some(id) = lock_id(body.as_ref()) else {

                return Err(err(StatusCode::BAD_REQUEST, "a lock request is the lock's JSON, with its ID"));

            };

            if let Some(l) = locked {

                return Ok(json(if l.lock_id == id { StatusCode::OK } else { StatusCode::LOCKED }, l.lock_info.clone()));

            }

            if db::terraform::lock(&app.db, row.id, &state, &id, info, &who.label()).await.map_err(db_err)? {

                Ok(json(StatusCode::OK, info.to_string()))

            } else {

                // Taken meanwhile.

                let now = db::terraform::get(&app.db, row.id, &state).await.map_err(db_err)?;

                Ok(json(StatusCode::LOCKED, now.map(|s| s.lock_info).unwrap_or_default()))

            }

        }

        "UNLOCK" => {

            let Some(l) = locked else { return Ok(StatusCode::OK.into_response()) };

            // `terraform force-unlock` sends the ID; a plain unlock its lock info.

            let id = lock_id(body.as_ref()).or(q.id.clone());

            if id.as_deref() != Some(l.lock_id.as_str()) {

                return Ok(json(StatusCode::CONFLICT, l.lock_info.clone()));

            }

            db::terraform::unlock(&app.db, row.id, &state).await.map_err(db_err)?;

            Ok(StatusCode::OK.into_response())

        }

        other => {

            Err(err(StatusCode::METHOD_NOT_ALLOWED, format!("{other} is not a Terraform backend method (GET, POST, DELETE, LOCK, UNLOCK)")))

        }

    }

}