//! Email verification and password reset (hub spec §5.1.1).

use super::{Error, Page, Shell};

use crate::auth::{self, Viewer};

use crate::db::{self, accounts};

use crate::Shared;

use askama::Template;

use axum::extract::{Form, Path, State};

use axum::response::{IntoResponse, Redirect, Response};

use serde::Deserialize;

const MINUTE: i64 = 60_000;

pub const VERIFY_TTL_MS: i64 = 48 * 60 * MINUTE;

pub const RESET_TTL_MS: i64 = 60 * MINUTE;

pub const ADMIN_RESET_TTL_MS: i64 = 24 * 60 * MINUTE;

/// At most one mailed link of a kind per account (and address) in this time.

pub const MAIL_EVERY_MS: i64 = 2 * MINUTE;

/// At most this many verification mails per account per hour, whatever the addresses.

pub const VERIFY_PER_HOUR: i64 = 10;

#[derive(Template)]

#[template(path = "reset.html")]

pub struct RecoveryPage {

    shell: Shell,

    /// `request`, `sent`, `new`, `invalid`, `verified`, `verify-invalid`.

    mode: &'static str,

    mail: bool,

    error: Option<String>,

    username: String,

    secret: String,

}

impl RecoveryPage {

    fn new(app: &Shared, shell: Shell, mode: &'static str) -> RecoveryPage {

        RecoveryPage { shell, mode, mail: crate::mail::enabled(app), error: None, username: String::new(), secret: String::new() }

    }

}

/// Send a verification link for the account's current email.

pub async fn send_verification(app: &Shared, account: &accounts::Account) -> Result<(), String> {

    if account.email.is_empty() || account.email_verified {

        return Ok(());

    }

    if !crate::mail::enabled(app) {

        return Err("This hub cannot send mail, so addresses cannot be verified yet.".into());

    }

    let now = db::now_ms();

    let recent = accounts::last_link_ms(&app.db, account.id, "verify", Some(&account.email)).await.map_err(|e| e.to_string())?;

    if recent.is_some_and(|t| now - t < MAIL_EVERY_MS) {

        return Err("A verification link was sent less than two minutes ago.".into());

    }

    if accounts::links_since(&app.db, account.id, "verify", now - 60 * MINUTE).await.map_err(|e| e.to_string())? >= VERIFY_PER_HOUR {

        return Err("Too many verification links this hour; try again later.".into());

    }

    let secret =

        accounts::create_link(&app.db, account.id, "verify", &account.email, None, VERIFY_TTL_MS).await.map_err(|e| e.to_string())?;

    let url = format!("{}/verify/{secret}", app.config.base_url());

    let body = format!(

        "Confirm that {} is the email address of {} on {}:\n\n{url}\n\nThe link works for 48 hours. If you did not ask for this, ignore it.\n",

        account.email,

        account.username,

        app.config.site.name

    );

    crate::mail::send(app, account.name(), &account.email, "Confirm your email address", &body).await

}

/// `GET /verify/{secret}`.

pub async fn verify(State(app): State<Shared>, viewer: Viewer, Path(secret): Path<String>) -> Result<Page<RecoveryPage>, Error> {

    let shell = Shell::new(&app, "/verify", &viewer);

    let e = |e| Error::from_db(shell.clone(), e);

    let link = accounts::live_link(&app.db, "verify", &secret).await.map_err(e)?;

    let account = match &link {

        Some(l) => accounts::account_by_id(&app.db, l.account_id).await.map_err(e)?,

        None => None,

    };

    match (link, account) {

        // Only the address the link was sent to, and only while it is still the account's.

        (Some(l), Some(a)) if a.email == l.email && accounts::use_link(&app.db, l.id).await.map_err(e)? => {

            accounts::set_email_verified(&app.db, a.id, true).await.map_err(e)?;

            accounts::audit(&app.db, Some(&a), "email.verified", &a.username, &a.email).await.ok();

            let mut page = RecoveryPage::new(&app, shell, "verified");

            page.username = a.email;

            Ok(Page(page))

        }

        _ => Ok(Page(RecoveryPage::new(&app, shell, "verify-invalid"))),

    }

}

/// `GET /login/reset`.

pub async fn request_form(State(app): State<Shared>, viewer: Viewer) -> Page<RecoveryPage> {

    Page(RecoveryPage::new(&app, Shell::new(&app, "/login/reset", &viewer), "request"))

}

#[derive(Deserialize)]

pub struct RequestForm {

    who: String,

}

/// `POST /login/reset`: the same answer whether or not anything matched.

pub async fn request(State(app): State<Shared>, viewer: Viewer, Form(f): Form<RequestForm>) -> Result<Page<RecoveryPage>, Error> {

    let shell = Shell::new(&app, "/login/reset", &viewer);

    if !crate::mail::enabled(&app) {

        return Ok(Page(RecoveryPage::new(&app, shell, "request")));

    }

    let who = f.who.trim();

    let e = |e| Error::from_db(shell.clone(), e);

    let account = if who.contains('@') {

        accounts::account_by_verified_email(&app.db, who).await.map_err(e)?

    } else {

        accounts::account_by_name(&app.db, who).await.map_err(e)?

    };

    if let Some(a) = account.filter(|a| a.email_verified && !a.email.is_empty() && !a.blocked()) {

        let recent = accounts::last_link_ms(&app.db, a.id, "reset", None).await.map_err(e)?;

        if !recent.is_some_and(|t| db::now_ms() - t < MAIL_EVERY_MS) {

            let secret = accounts::create_link(&app.db, a.id, "reset", "", None, RESET_TTL_MS).await.map_err(e)?;

            let url = format!("{}/login/reset/{secret}", app.config.base_url());

            let body = format!(

                "Someone asked to reset the password of {} on {}. To choose a new password, open:\n\n{url}\n\nThe link works once, for one hour. If it was not you, ignore this; your password stays as it is.\n",

                a.username, app.config.site.name

            );

            // Sent in the background, so the answer takes as long either way.

            let (mailer, name, addr, user) = (app.clone(), a.name().to_string(), a.email.clone(), a.username.clone());

            tokio::spawn(async move {

                if let Err(err) = crate::mail::send(&mailer, &name, &addr, "Reset your password", &body).await {

                    tracing::warn!("reset mail for {user}: {err}");

                }

            });

            accounts::audit(&app.db, Some(&a), "password.reset_requested", &a.username, "").await.ok();

        }

    }

    Ok(Page(RecoveryPage::new(&app, shell, "sent")))

}

async fn reset_target(app: &Shared, secret: &str) -> sqlx::Result<Option<(accounts::AccountLink, accounts::Account)>> {

    let Some(link) = accounts::live_link(&app.db, "reset", secret).await? else { return Ok(None) };

    let account = accounts::account_by_id(&app.db, link.account_id).await?;

    Ok(account.filter(|a| !a.blocked()).map(|a| (link, a)))

}

/// `GET /login/reset/{secret}`.

pub async fn new_password_form(State(app): State<Shared>, viewer: Viewer, Path(secret): Path<String>) -> Result<Page<RecoveryPage>, Error> {

    let shell = Shell::new(&app, "/login/reset", &viewer);

    match reset_target(&app, &secret).await.map_err(|e| Error::from_db(shell.clone(), e))? {

        Some((_, a)) => {

            let mut page = RecoveryPage::new(&app, shell, "new");

            page.username = a.username;

            page.secret = secret;

            Ok(Page(page))

        }

        None => Ok(Page(RecoveryPage::new(&app, shell, "invalid"))),

    }

}

#[derive(Deserialize)]

pub struct NewPasswordForm {

    password: String,

    confirm: String,

}

/// `POST /login/reset/{secret}`.

pub async fn set_new_password(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(secret): Path<String>,

    Form(f): Form<NewPasswordForm>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/login/reset", &viewer);

    let e = |e| Error::from_db(shell.clone(), e);

    let Some((link, account)) = reset_target(&app, &secret).await.map_err(e)? else {

        return Ok(Page(RecoveryPage::new(&app, shell, "invalid")).into_response());

    };

    let problem = if f.password != f.confirm {

        Some("The two passwords differ.".to_string())

    } else {

        auth::password_ok(&f.password).err().map(String::from)

    };

    if let Some(msg) = problem {

        let mut page = RecoveryPage::new(&app, shell, "new");

        page.username = account.username;

        page.secret = secret;

        page.error = Some(msg);

        return Ok(Page(page).into_response());

    }

    if !accounts::use_link(&app.db, link.id).await.map_err(e)? {

        return Ok(Page(RecoveryPage::new(&app, shell, "invalid")).into_response());

    }

    let hash = auth::hash_password(&f.password).map_err(|err| Error::bad(shell.clone(), err.to_string()))?;

    // A new session salt ends every session; other reset links die with it.

    accounts::set_password(&app.db, account.id, &hash, &auth::random_hex(16)).await.map_err(e)?;

    accounts::void_links(&app.db, account.id, "reset").await.map_err(e)?;

    let by = if link.created_by.is_some() { "administrator's link" } else { "emailed link" };

    accounts::audit(&app.db, Some(&account), "password.reset", &account.username, by).await.ok();

    Ok(Redirect::to("/login?reset=1").into_response())

}

/// An administrator's reset link for an account (the admin page shows it once).

pub async fn admin_reset_link(app: &Shared, admin: &accounts::Account, target: &accounts::Account) -> sqlx::Result<String> {

    let secret = accounts::create_link(&app.db, target.id, "reset", "", Some(admin.id), ADMIN_RESET_TTL_MS).await?;

    accounts::audit(&app.db, Some(admin), "admin.account.reset_link", &target.username, "valid 24 hours").await.ok();

    Ok(format!("{}/login/reset/{secret}", app.config.base_url()))

}