//! Terraform and OpenTofu state, kept by the hub per repository
//! (oxygenhub#252): the HTTP backend Terraform and OpenTofu speak, with
//! locking, at `/api/v1/repos/OWNER/NAME/terraform/state/STATE`, so a Flow
//! job keeps its state without any cloud credential. A job authenticates
//! with an identity token of this hub's for the audience `{base}/terraform`
//! (its pipeline's `identity` block) or its runner's job token, either for
//! its own repository only; people with a token of theirs and their
//! repository role. Tokens go as the bearer, or as the password of Basic
//! auth, which is what the backend sends.
//!
//! State is kept outside the repository's history (it often holds secrets),
//! sealed at rest with the hub's secrets key, and its last versions are
//! kept, so a bad apply can be rolled back.

use crate::api::ApiError;
use crate::auth::roles::{Access, Role};
use crate::{db, Shared};
use axum::body::Bytes;
use axum::extract::{Path, Query, State};
use axum::http::{header, HeaderMap, Method, StatusCode};
use axum::response::{IntoResponse, Response};

/// Versions of a state kept besides the current one.
pub const VERSIONS_KEPT: i64 = 20;
/// The most a state may weigh.
pub const MAX_STATE_BYTES: usize = 32 << 20;

/// Who may use a repository's states.
enum Who {
    /// A running job of this repository.
    Job { name: String },
    /// A person, with their role on the repository.
    Person { account: Box<db::accounts::Account>, role: Role },
}

impl Who {
    fn label(&self) -> String {
        match self {
            Who::Job { name } => name.clone(),
            Who::Person { account, .. } => account.username.clone(),
        }
    }

    fn may(&self, access: Access) -> bool {
        match self {
            // A job reads and writes its own repository's states.
            Who::Job { .. } => true,
            Who::Person { role, .. } => crate::auth::roles::allows(Some(*role), access),
        }
    }
}

fn err(status: StatusCode, why: impl Into<String>) -> ApiError {
    ApiError(status, why.into())
}

/// The token a request carries: the bearer, or Basic auth's password.
fn token_of(headers: &HeaderMap) -> Option<String> {
    if let Some(t) = oxy_server::bearer_token(headers) {
        return Some(t.to_string());
    }
    let v = headers.get(header::AUTHORIZATION)?.to_str().ok()?;
    let b64 = v.strip_prefix("Basic ").or_else(|| v.strip_prefix("basic "))?;
    let raw = String::from_utf8(oxy_core::dsse::base64_decode(b64.trim())?).ok()?;
    let (_, password) = raw.split_once(':')?;
    (!password.is_empty()).then(|| password.to_string())
}

/// The audience a job's identity token needs here.
pub fn audience(base_url: &str) -> String {
    format!("{}/terraform", base_url.trim_end_matches('/'))
}

fn valid_name(name: &str) -> bool {
    !name.is_empty()
        && name.len() <= 100
        && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
        && !name.starts_with('.')
}

async fn who(app: &Shared, headers: &HeaderMap, row: &db::repos::RepoRow) -> Result<Who, ApiError> {
    let token = token_of(headers).ok_or_else(|| {
        err(
            StatusCode::UNAUTHORIZED,
            "a Terraform state needs a token: a job's (TF_HTTP_PASSWORD), or one of yours with repo:read or repo:write",
        )
    })?;
    let hash = crate::auth::token_hash(&token);
    if token.starts_with(crate::flow::JOB_TOKEN_PREFIX) {
        let job = db::flow::job_by_token(&app.db, &hash, crate::flow::JOB_TOKEN_MAX_AGE_MS)
            .await
            .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
            .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "this job token is not valid (the job must be running)"))?;
        let run = db::flow::run_by_id(&app.db, job.run_id)
            .await
            .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
            .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "this job token is not valid"))?;
        if run.repo_id != row.id {
            return Err(err(StatusCode::FORBIDDEN, "a job keeps the states of its own repository only"));
        }
        return Ok(Who::Job { name: format!("run #{} {}", run.number, job.name) });
    }
    let personal = db::accounts::token_by_hash(&app.db, &hash).await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
    let Some(token) = personal.filter(|t| !t.expired(db::now_ms())) else {
        // A job's identity token for this hub's Terraform audience.
        let issuer = app.oidc().await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
        let aud = audience(app.config.base_url());
        let Some(claims) = issuer.verify(&token, &aud, db::now_ms()) else {
            return Err(err(StatusCode::UNAUTHORIZED, format!("unknown or expired token (a job's identity token must be for {aud})")));
        };
        let sub = claims["sub"].as_str().unwrap_or("");
        let repo = claims["repository"]
            .as_str()
            .map(String::from)
            .or_else(|| sub.strip_prefix("repo:").and_then(|r| r.split_once(":bookmark:")).map(|(r, _)| r.to_string()));
        if repo.as_deref() != Some(row.slug().as_str()) {
            return Err(err(StatusCode::FORBIDDEN, "a job keeps the states of its own repository only"));
        }
        return Ok(Who::Job { name: sub.to_string() });
    };
    if !(token.has_scope("repo:read") || token.has_scope("repo:write") || token.has_scope("repo:admin")) {
        return Err(err(StatusCode::FORBIDDEN, "the token lacks repo:read (to read a state) or repo:write (to change one)"));
    }
    let slug = row.slug();
    if !token.covers(&slug) {
        return Err(err(StatusCode::FORBIDDEN, format!("the token does not cover {slug}")));
    }
    let account = db::accounts::account_by_id(&app.db, token.account_id)
        .await
        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
        .filter(|a| !a.banned && !a.disabled)
        .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "unknown token"))?;
    let role = crate::auth::roles::role_for(&app.db, Some(&account), row)
        .await
        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
    // A read-only token reads, whatever the role.
    let role = match role {
        Some(r) if !(token.has_scope("repo:write") || token.has_scope("repo:admin")) => Some(r.min(Role::Read)),
        r => r,
    };
    match role {
        Some(r) if crate::auth::roles::allows(Some(r), Access::Read) => Ok(Who::Person { account: Box::new(account), role: r }),
        _ => Err(err(StatusCode::NOT_FOUND, "no such repository")),
    }
}

#[derive(serde::Deserialize, Default)]
pub struct LockQuery {
    #[serde(rename = "ID", default)]
    id: Option<String>,
}

fn json(status: StatusCode, body: String) -> Response {
    (status, [(header::CONTENT_TYPE, "application/json")], body).into_response()
}

/// The lock's ID in a lock-info body (`{"ID": …}`).
fn lock_id(info: &[u8]) -> Option<String> {
    serde_json::from_slice::<serde_json::Value>(info).ok()?.get("ID")?.as_str().map(String::from)
}

/// `GET|POST|DELETE|LOCK|UNLOCK /api/v1/repos/{owner}/{name}/terraform/state/{state}`.
pub async fn state(
    State(app): State<Shared>,
    method: Method,
    headers: HeaderMap,
    Path((owner, name, state)): Path<(String, String, String)>,
    Query(q): Query<LockQuery>,
    body: Bytes,
) -> Result<Response, ApiError> {
    if !valid_name(&state) {
        return Err(err(StatusCode::BAD_REQUEST, "a state's name is letters, digits, '-', '_' and '.', up to 100"));
    }
    let row = db::repos::get(&app.db, &owner, &name)
        .await
        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such repository"))?;
    let who = who(&app, &headers, &row).await?;
    let write = method != Method::GET;
    if !who.may(if write { Access::Write } else { Access::Read }) {
        return Err(err(StatusCode::FORBIDDEN, "changing a state needs the write role"));
    }
    let db_err = |e: sqlx::Error| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string());
    let current = db::terraform::get(&app.db, row.id, &state).await.map_err(db_err)?;
    let locked = current.as_ref().filter(|s| !s.lock_id.is_empty());
    match method.as_str() {
        "GET" => match current.filter(|s| !s.body.is_empty()) {
            Some(s) => {
                let plain =
                    app.secret_key.open(&s.body).ok_or_else(|| err(StatusCode::INTERNAL_SERVER_ERROR, "the state does not open"))?;
                Ok(json(StatusCode::OK, plain))
            }
            // No state yet: Terraform starts afresh.
            None => Ok(StatusCode::NO_CONTENT.into_response()),
        },
        "POST" => {
            if body.len() > MAX_STATE_BYTES {
                return Err(err(StatusCode::PAYLOAD_TOO_LARGE, format!("a state may be {} MiB at most", MAX_STATE_BYTES >> 20)));
            }
            let text = std::str::from_utf8(&body).map_err(|_| err(StatusCode::BAD_REQUEST, "a state is JSON"))?;
            let parsed: serde_json::Value = serde_json::from_str(text).map_err(|_| err(StatusCode::BAD_REQUEST, "a state is JSON"))?;
            if let Some(l) = locked {
                if q.id.as_deref() != Some(l.lock_id.as_str()) {
                    return Ok(json(StatusCode::LOCKED, l.lock_info.clone()));
                }
            }
            let serial = parsed.get("serial").and_then(|v| v.as_i64()).unwrap_or(0);
            let sealed = app.secret_key.seal(text);
            db::terraform::put(&app.db, row.id, &state, &sealed, serial, &who.label(), VERSIONS_KEPT).await.map_err(db_err)?;
            Ok(StatusCode::OK.into_response())
        }
        "DELETE" => {
            if let Some(l) = locked {
                if q.id.as_deref() != Some(l.lock_id.as_str()) {
                    return Ok(json(StatusCode::LOCKED, l.lock_info.clone()));
                }
            }
            db::terraform::delete(&app.db, row.id, &state).await.map_err(db_err)?;
            Ok(StatusCode::OK.into_response())
        }
        "LOCK" => {
            let info = std::str::from_utf8(&body).unwrap_or("");
            let Some(id) = lock_id(body.as_ref()) else {
                return Err(err(StatusCode::BAD_REQUEST, "a lock request is the lock's JSON, with its ID"));
            };
            if let Some(l) = locked {
                return Ok(json(if l.lock_id == id { StatusCode::OK } else { StatusCode::LOCKED }, l.lock_info.clone()));
            }
            if db::terraform::lock(&app.db, row.id, &state, &id, info, &who.label()).await.map_err(db_err)? {
                Ok(json(StatusCode::OK, info.to_string()))
            } else {
                // Taken meanwhile.
                let now = db::terraform::get(&app.db, row.id, &state).await.map_err(db_err)?;
                Ok(json(StatusCode::LOCKED, now.map(|s| s.lock_info).unwrap_or_default()))
            }
        }
        "UNLOCK" => {
            let Some(l) = locked else { return Ok(StatusCode::OK.into_response()) };
            // `terraform force-unlock` sends the ID; a plain unlock its lock info.
            let id = lock_id(body.as_ref()).or(q.id.clone());
            if id.as_deref() != Some(l.lock_id.as_str()) {
                return Ok(json(StatusCode::CONFLICT, l.lock_info.clone()));
            }
            db::terraform::unlock(&app.db, row.id, &state).await.map_err(db_err)?;
            Ok(StatusCode::OK.into_response())
        }
        other => {
            Err(err(StatusCode::METHOD_NOT_ALLOWED, format!("{other} is not a Terraform backend method (GET, POST, DELETE, LOCK, UNLOCK)")))
        }
    }
}