//! Account settings (hub spec §6.3 `/settings/*`): profile, security,

//! linked identities, tokens.

use super::{filters, Error, Page, Shell};

use crate::auth::{self, totp, Viewer, ViewerAccount};

use crate::db::{self, accounts};

use crate::Shared;

use askama::Template;

use axum::extract::{Form, Multipart, Path, State};

use axum::response::{IntoResponse, Response};

use oxy_core::identity::{Identity, Signature};

use serde::Deserialize;

/// The signed-in account, or a redirect to sign in.

pub fn require(viewer: &Viewer, shell: &Shell) -> Result<ViewerAccount, Error> {

    viewer.0.clone().ok_or_else(|| Error::redirect(format!("/login?next={}", urlencode(&shell.path))))

}

pub fn urlencode(s: &str) -> String {

    let mut out = String::new();

    for b in s.bytes() {

        match b {

            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' | b'/' => out.push(b as char),

            _ => out.push_str(&format!("%{b:02X}")),

        }

    }

    out

}

pub fn csrf(viewer: &Viewer, token: &str, shell: &Shell) -> Result<(), Error> {

    if viewer.csrf_ok(token) {

        Ok(())

    } else {

        Err(Error::bad(shell.clone(), "This form has expired; reload the page and try again."))

    }

}

#[derive(Template)]

#[template(path = "settings.html")]

pub struct SettingsPage {

    shell: Shell,

    me: accounts::Account,

    notice: Option<String>,

    error: Option<String>,

}

pub async fn profile(State(app): State<Shared>, viewer: Viewer) -> Result<Page<SettingsPage>, Error> {

    let shell = Shell::new(&app, "/settings", &viewer);

    let me = require(&viewer, &shell)?;

    Ok(Page(SettingsPage { shell, me: me.account, notice: None, error: None }))

}

#[derive(Deserialize)]

pub struct ProfileForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    display_name: String,

    email: String,

}

pub async fn update_profile(State(app): State<Shared>, viewer: Viewer, Form(f): Form<ProfileForm>) -> Result<Page<SettingsPage>, Error> {

    let shell = Shell::new(&app, "/settings", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    accounts::set_profile(&app.db, me.account.id, f.display_name.trim(), f.email.trim())

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?;

    let updated =

        accounts::account_by_id(&app.db, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.unwrap_or(me.account);

    Ok(Page(SettingsPage { shell, me: updated, notice: Some("Profile saved.".into()), error: None }))

}

#[derive(Deserialize)]

pub struct PasswordForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    current: String,

    password: String,

}

pub async fn change_password(State(app): State<Shared>, viewer: Viewer, Form(f): Form<PasswordForm>) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/settings", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    if !auth::verify_password(&me.account.password_hash, &f.current) {

        return Ok(Page(SettingsPage { shell, me: me.account, notice: None, error: Some("Your current password is wrong.".into()) })

            .into_response());

    }

    if let Err(e) = auth::password_ok(&f.password) {

        return Ok(Page(SettingsPage { shell, me: me.account, notice: None, error: Some(e.into()) }).into_response());

    }

    let hash = auth::hash_password(&f.password).map_err(|e| Error::bad(shell.clone(), e.to_string()))?;

    // A new session salt signs out every other session; this one is renewed.

    accounts::set_password(&app.db, me.account.id, &hash, &auth::random_hex(16)).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me.account), "password.changed", &me.account.username, "").await.ok();

    let fresh = accounts::account_by_id(&app.db, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.unwrap_or(me.account);

    Ok(super::session::signed_in(&app, &fresh, "/settings/security"))

}

#[derive(Template)]

#[template(path = "settings_security.html")]

pub struct SecurityPage {

    shell: Shell,

    me: accounts::Account,

    notice: Option<String>,

    error: Option<String>,

    /// Enrolment in progress: secret, URI and QR.

    enrol: Option<(String, String, String)>,

    recovery: Vec<String>,

}

pub async fn security(State(app): State<Shared>, viewer: Viewer) -> Result<Page<SecurityPage>, Error> {

    let shell = Shell::new(&app, "/settings/security", &viewer);

    let me = require(&viewer, &shell)?;

    Ok(Page(SecurityPage { shell, me: me.account, notice: None, error: None, enrol: None, recovery: vec![] }))

}

#[derive(Deserialize)]

pub struct TotpForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    #[serde(default)]

    secret: String,

    #[serde(default)]

    code: String,

    #[serde(default)]

    password: String,

}

/// Step one: show a fresh secret to scan.

pub async fn totp_begin(State(app): State<Shared>, viewer: Viewer, Form(f): Form<TotpForm>) -> Result<Page<SecurityPage>, Error> {

    let shell = Shell::new(&app, "/settings/security", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let secret = totp::new_secret();

    let uri = totp::uri(&app.config.site.name, &me.account.username, &secret);

    let qr = totp::qr_svg(&uri).unwrap_or_default();

    Ok(Page(SecurityPage { shell, me: me.account, notice: None, error: None, enrol: Some((secret, uri, qr)), recovery: vec![] }))

}

/// Step two: the first code proves the app holds the secret.

pub async fn totp_enable(State(app): State<Shared>, viewer: Viewer, Form(f): Form<TotpForm>) -> Result<Page<SecurityPage>, Error> {

    let shell = Shell::new(&app, "/settings/security", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let now = (db::now_ms() / 1000) as u64;

    if f.secret.is_empty() || !totp::verify(&f.secret, &f.code, now) {

        let uri = totp::uri(&app.config.site.name, &me.account.username, &f.secret);

        let qr = totp::qr_svg(&uri).unwrap_or_default();

        return Ok(Page(SecurityPage {

            shell,

            me: me.account,

            notice: None,

            error: Some("That code did not match; scan again and enter the current code.".into()),

            enrol: Some((f.secret, uri, qr)),

            recovery: vec![],

        }));

    }

    let (codes, stored) = totp::new_recovery_codes();

    accounts::set_totp(&app.db, me.account.id, Some(&f.secret), &stored).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me.account), "totp.enabled", &me.account.username, "").await.ok();

    let fresh = accounts::account_by_id(&app.db, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.unwrap_or(me.account);

    Ok(Page(SecurityPage {

        shell,

        me: fresh,

        notice: Some("Two-factor authentication is on. Keep these recovery codes somewhere safe; each works once.".into()),

        error: None,

        enrol: None,

        recovery: codes,

    }))

}

pub async fn totp_disable(State(app): State<Shared>, viewer: Viewer, Form(f): Form<TotpForm>) -> Result<Page<SecurityPage>, Error> {

    let shell = Shell::new(&app, "/settings/security", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    if !auth::verify_password(&me.account.password_hash, &f.password) {

        return Ok(Page(SecurityPage {

            shell,

            me: me.account,

            notice: None,

            error: Some("Your password is wrong.".into()),

            enrol: None,

            recovery: vec![],

        }));

    }

    accounts::set_totp(&app.db, me.account.id, None, "").await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me.account), "totp.disabled", &me.account.username, "").await.ok();

    let fresh = accounts::account_by_id(&app.db, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.unwrap_or(me.account);

    Ok(Page(SecurityPage {

        shell,

        me: fresh,

        notice: Some("Two-factor authentication is off.".into()),

        error: None,

        enrol: None,

        recovery: vec![],

    }))

}

/// Sign out everywhere: a new session salt invalidates every cookie, then

/// this browser gets a fresh one.

pub async fn sessions_reset(State(app): State<Shared>, viewer: Viewer, Form(f): Form<super::session::CsrfForm>) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/settings/security", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf, &shell)?;

    accounts::set_session_salt(&app.db, me.account.id, &auth::random_hex(16)).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me.account), "sessions.reset", &me.account.username, "").await.ok();

    let fresh = accounts::account_by_id(&app.db, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.unwrap_or(me.account);

    Ok(super::session::signed_in(&app, &fresh, "/settings/security"))

}

// ------------------------------------------------------------------- keys

#[derive(Template)]

#[template(path = "settings_keys.html")]

pub struct KeysPage {

    shell: Shell,

    me: accounts::Account,

    keys: Vec<accounts::LinkedIdentity>,

    notice: Option<String>,

    error: Option<String>,

    /// A pending challenge: id, hex bytes, identity name.

    pending: Option<(i64, String, String)>,

}

async fn keys_page(

    app: &Shared,

    shell: Shell,

    me: accounts::Account,

    notice: Option<String>,

    error: Option<String>,

    pending: Option<(i64, String, String)>,

) -> Result<Page<KeysPage>, Error> {

    let keys = accounts::identities_of(&app.db, me.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    Ok(Page(KeysPage { shell, me, keys, notice, error, pending }))

}

pub async fn keys(State(app): State<Shared>, viewer: Viewer) -> Result<Page<KeysPage>, Error> {

    let shell = Shell::new(&app, "/settings/keys", &viewer);

    let me = require(&viewer, &shell)?;

    keys_page(&app, shell, me.account, None, None, None).await

}

/// Upload an identity object (`oxy identity export`): the hub issues a

/// challenge to sign with that key.

pub async fn keys_upload(State(app): State<Shared>, viewer: Viewer, mut multipart: Multipart) -> Result<Page<KeysPage>, Error> {

    let shell = Shell::new(&app, "/settings/keys", &viewer);

    let me = require(&viewer, &shell)?;

    let mut token = String::new();

    let mut object: Vec<u8> = Vec::new();

    while let Ok(Some(field)) = multipart.next_field().await {

        match field.name() {

            Some("_csrf") => token = field.text().await.unwrap_or_default(),

            Some("identity") => object = field.bytes().await.map(|b| b.to_vec()).unwrap_or_default(),

            _ => {}

        }

    }

    csrf(&viewer, &token, &shell)?;

    let identity = match Identity::decode(&object) {

        Ok(i) => i,

        Err(e) => return keys_page(&app, shell, me.account, None, Some(format!("That is not an identity file: {e}")), None).await,

    };

    let key = identity.hash().to_hex();

    if let Some(existing) = accounts::identity_by_key(&app.db, &key).await.map_err(|e| Error::from_db(shell.clone(), e))? {

        let msg = if existing.account_id == me.account.id {

            "That key is already linked to you."

        } else {

            "That key is linked to another account."

        };

        return keys_page(&app, shell, me.account, None, Some(msg.into()), None).await;

    }

    let bytes = auth::random_hex(32);

    let id = accounts::create_challenge(&app.db, me.account.id, &bytes).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    sqlx::query("UPDATE challenges SET object = ? WHERE id = ?")

        .bind(&object)

        .bind(id)

        .execute(&app.db)

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?;

    keys_page(&app, shell, me.account, None, None, Some((id, bytes, identity.name))).await

}

#[derive(Deserialize)]

pub struct KeyVerifyForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    challenge: i64,

    signature: String,

}

pub async fn keys_verify(State(app): State<Shared>, viewer: Viewer, Form(f): Form<KeyVerifyForm>) -> Result<Page<KeysPage>, Error> {

    let shell = Shell::new(&app, "/settings/keys", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let object: Option<Vec<u8>> = sqlx::query_scalar("SELECT object FROM challenges WHERE id = ? AND account_id = ?")

        .bind(f.challenge)

        .bind(me.account.id)

        .fetch_optional(&app.db)

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?;

    let bytes = accounts::take_challenge(&app.db, me.account.id, f.challenge).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let (Some(object), Some(bytes)) = (object, bytes) else {

        return keys_page(&app, shell, me.account, None, Some("That challenge has expired; upload the identity again.".into()), None).await;

    };

    let Ok(identity) = Identity::decode(&object) else {

        return keys_page(&app, shell, me.account, None, Some("The stored identity is unreadable.".into()), None).await;

    };

    let sig_bytes = hex::decode(f.signature.trim()).unwrap_or_default();

    let sigs = Signature::decode_list(&sig_bytes).unwrap_or_default();

    let challenge = hex::decode(&bytes).unwrap_or_default();

    let ok = sigs.first().is_some_and(|sig| oxy_core::identity::verify_challenge(&identity, sig, &challenge).is_ok());

    if !ok {

        return keys_page(

            &app,

            shell,

            me.account,

            None,

            Some("The signature does not verify against that identity and challenge.".into()),

            None,

        )

        .await;

    }

    let key = identity.hash().to_hex();

    accounts::link_identity(&app.db, me.account.id, &key, &identity.name, &identity.email, &object)

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me.account), "identity.linked", &key, &identity.name).await.ok();

    keys_page(&app, shell, me.account, Some("Key linked. Changes signed with it are now yours on every page.".into()), None, None).await

}

#[derive(Deserialize)]

pub struct KeyForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    key: String,

}

pub async fn keys_unlink(State(app): State<Shared>, viewer: Viewer, Form(f): Form<KeyForm>) -> Result<Page<KeysPage>, Error> {

    let shell = Shell::new(&app, "/settings/keys", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    accounts::unlink_identity(&app.db, me.account.id, &f.key).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me.account), "identity.unlinked", &f.key, "").await.ok();

    keys_page(&app, shell, me.account, Some("Key unlinked.".into()), None, None).await

}

// ----------------------------------------------------------------- tokens

#[derive(Template)]

#[template(path = "settings_tokens.html")]

pub struct TokensPage {

    shell: Shell,

    me: accounts::Account,

    tokens: Vec<accounts::Token>,

    /// A freshly created token, shown once.

    fresh: Option<String>,

    notice: Option<String>,

    error: Option<String>,

}

async fn tokens_page(

    app: &Shared,

    shell: Shell,

    me: accounts::Account,

    fresh: Option<String>,

    notice: Option<String>,

    error: Option<String>,

) -> Result<Page<TokensPage>, Error> {

    let tokens = accounts::tokens_of(&app.db, me.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    Ok(Page(TokensPage { shell, me, tokens, fresh, notice, error }))

}

pub async fn tokens(State(app): State<Shared>, viewer: Viewer) -> Result<Page<TokensPage>, Error> {

    let shell = Shell::new(&app, "/settings/tokens", &viewer);

    let me = require(&viewer, &shell)?;

    tokens_page(&app, shell, me.account, None, None, None).await

}

#[derive(Deserialize)]

pub struct TokenForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    name: String,

    #[serde(default)]

    scopes: Vec<String>,

    #[serde(default)]

    repos: String,

    #[serde(default)]

    expires_days: String,

}

pub const SCOPES: &[(&str, &str)] = &[

    ("repo:read", "read repositories you can see (clone, fetch, pull)"),

    ("repo:write", "push to repositories you can write to"),

    ("repo:admin", "change repository settings through the API"),

    ("user:read", "read your profile through the API"),

];

pub async fn tokens_create(

    State(app): State<Shared>,

    viewer: Viewer,

    axum_extra::extract::Form(f): axum_extra::extract::Form<TokenForm>,

) -> Result<Page<TokensPage>, Error> {

    let shell = Shell::new(&app, "/settings/tokens", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let name = f.name.trim();

    if name.is_empty() {

        return tokens_page(&app, shell, me.account, None, None, Some("Give the token a name.".into())).await;

    }

    let scopes: Vec<&str> = f.scopes.iter().map(String::as_str).filter(|s| SCOPES.iter().any(|(k, _)| k == s)).collect();

    if scopes.is_empty() {

        return tokens_page(&app, shell, me.account, None, None, Some("Pick at least one scope.".into())).await;

    }

    let expires_ms = f.expires_days.trim().parse::<i64>().ok().filter(|d| *d > 0).map(|d| db::now_ms() + d * 86_400_000);

    let repos = f.repos.split(',').map(str::trim).filter(|r| !r.is_empty()).collect::<Vec<_>>().join(",");

    let (secret, hash) = auth::new_token();

    accounts::create_token(&app.db, me.account.id, name, &hash, &scopes.join(","), &repos, expires_ms)

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me.account), "token.created", name, &scopes.join(",")).await.ok();

    tokens_page(&app, shell, me.account, Some(secret), Some("Copy the token now; it is not shown again.".into()), None).await

}

pub async fn tokens_delete(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(id): Path<i64>,

    Form(f): Form<super::session::CsrfForm>,

) -> Result<Page<TokensPage>, Error> {

    let shell = Shell::new(&app, "/settings/tokens", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf, &shell)?;

    accounts::delete_token(&app.db, me.account.id, id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me.account), "token.deleted", &id.to_string(), "").await.ok();