//! `security.txt` (RFC 9116, oxygenhub#224): where to report a

//! vulnerability in this hub. A site administrator sets the contact and,

//! if there is one, a policy page under Administration; until a contact is

//! set there is no file (404). `Expires` is always just under a year ahead,

//! as the RFC asks, so the file never goes stale.

use super::settings::csrf;

use super::{Error, Page, Shell};

use crate::auth::Viewer;

use crate::db::{self, accounts};

use crate::Shared;

use axum::extract::{Form, State};

use axum::http::{header, StatusCode};

use axum::response::{IntoResponse, Response};

use serde::Deserialize;

const CONTACT: &str = "security_contact";

const POLICY: &str = "security_policy";

const EMAIL: &str = "security_email";

const PAGE: &str = "security_page";

/// The longest page text kept.

const MAX_PAGE: usize = 20_000;

/// What `/security-contact` says until an administrator writes their own

/// (oxygenhub#230). It makes no promises on the site's behalf.

pub const DEFAULT_PAGE: &str = "If you think you have found a security problem in this hub, please tell us privately rather than in a public issue, proposal or comment.\n\n\

Please include:\n\n\

- what you found, and where (the page, the API call, the repository if one is involved);\n\

- how to reproduce it, step by step;\n\

- what you think someone could do with it.\n\n\

While you look, please do not read or change other people's data beyond what you need to show the problem, do not run tests that slow the service down for others, and give us a fair chance to fix it before you tell anyone else.\n";

/// How far ahead `Expires` is: under a year (RFC 9116 §2.5.5).

const EXPIRES_MS: i64 = 360 * 24 * 60 * 60_000;

/// The reporting address and the page text (empty when unset).

pub async fn page_settings(app: &Shared) -> (String, String) {

    let get = |k| async move { accounts::setting(&app.db, k).await.ok().flatten().unwrap_or_default() };

    (get(EMAIL).await, get(PAGE).await)

}

#[derive(askama::Template)]

#[template(path = "security_contact.html")]

pub struct ContactPage {

    shell: Shell,

    email: String,

    /// The page text as HTML, sanitised by the Markdown renderer.

    body_html: String,

}

/// `GET /security-contact`: how to report a security problem (oxygenhub#230).

pub async fn contact_page(State(app): State<Shared>, viewer: Viewer) -> Page<ContactPage> {

    let shell = Shell::new(&app, "/security-contact", &viewer);

    let (mut email, text) = page_settings(&app).await;

    // No address of its own: security.txt's, when that is an email.

    if email.is_empty() {

        let (contact, _) = settings(&app).await;

        email = contact_uri(&contact).and_then(|u| u.strip_prefix("mailto:").map(String::from)).unwrap_or_default();

    }

    let text = if text.trim().is_empty() { DEFAULT_PAGE.to_string() } else { text };

    Page(ContactPage { shell, email, body_html: crate::render::markdown::render(&text, "", "") })

}

/// The saved contact and policy (empty when unset).

pub async fn settings(app: &Shared) -> (String, String) {

    let get = |k| async move { accounts::setting(&app.db, k).await.ok().flatten().unwrap_or_default() };

    (get(CONTACT).await, get(POLICY).await)

}

/// A contact as the file gives it: an email address becomes a `mailto:`

/// URI; an https or mailto URI is kept. `None` for anything else.

pub fn contact_uri(contact: &str) -> Option<String> {

    let c = contact.trim();

    if c.is_empty() || c.chars().any(|ch| ch.is_whitespace() || ch.is_control()) {

        return None;

    }

    if c.starts_with("https://") || c.starts_with("mailto:") {

        return Some(c.to_string());

    }

    let (user, domain) = c.split_once('@')?;

    (!user.is_empty() && domain.contains('.') && !domain.contains('@') && !c.contains(':')).then(|| format!("mailto:{c}"))

}

/// The file's text, for a contact and policy, at `now_ms`.

pub fn text(base_url: &str, contact: &str, policy: &str, now_ms: i64) -> Option<String> {

    let contact = contact_uri(contact)?;

    let expires = crate::render::time::rfc3339((now_ms + EXPIRES_MS) as u64);

    let base = base_url.trim_end_matches('/');

    let mut out = format!("Contact: {contact}\nExpires: {expires}\n");

    if !policy.trim().is_empty() {

        out.push_str(&format!("Policy: {}\n", policy.trim()));

    }

    out.push_str(&format!("Preferred-Languages: en\nCanonical: {base}/.well-known/security.txt\n"));

    Some(out)

}

/// `GET /.well-known/security.txt` and `/security.txt`.

pub async fn serve(State(app): State<Shared>) -> Response {

    let (contact, policy) = settings(&app).await;

    match text(app.config.base_url(), &contact, &policy, db::now_ms()) {

        Some(t) => ([(header::CONTENT_TYPE, "text/plain; charset=utf-8")], t).into_response(),

        None => (StatusCode::NOT_FOUND, "This hub has no security contact set.\n").into_response(),

    }

}

#[derive(Deserialize)]

pub struct SecurityForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    #[serde(default)]

    contact: String,

    #[serde(default)]

    policy: String,

    /// Where reports go, shown on /security-contact.

    #[serde(default)]

    email: String,

    /// The page's text, Markdown; empty for the default.

    #[serde(default)]

    page: String,

}

/// `POST /admin/security`: the contact (an email address or https page)

/// and an optional https policy page; an empty contact takes the file down.

pub async fn save(State(app): State<Shared>, viewer: Viewer, Form(f): Form<SecurityForm>) -> Result<Page<super::admin::AdminPage>, Error> {

    let shell = Shell::new(&app, "/admin", &viewer);

    let me = super::admin::require_admin(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let (contact, policy) = (f.contact.trim(), f.policy.trim());

    if !contact.is_empty() && contact_uri(contact).is_none() {

        return Err(Error::bad(shell, "The contact is an email address or an https:// page."));

    }

    if !policy.is_empty() && (!policy.starts_with("https://") || policy.chars().any(char::is_whitespace)) {

        return Err(Error::bad(shell, "The policy is an https:// page, or empty."));

    }

    let (email, page) = (f.email.trim(), f.page.trim());

    if !email.is_empty() && contact_uri(email).is_none_or(|u| !u.starts_with("mailto:")) {

        return Err(Error::bad(shell, "The reporting address is an email address, or empty."));

    }

    if page.chars().count() > MAX_PAGE {

        return Err(Error::bad(shell, format!("The page text is at most {MAX_PAGE} characters.")));

    }

    let e = |e| Error::from_db(shell.clone(), e);

    accounts::set_setting(&app.db, CONTACT, contact).await.map_err(e)?;

    accounts::set_setting(&app.db, POLICY, policy).await.map_err(e)?;

    accounts::set_setting(&app.db, EMAIL, email).await.map_err(e)?;

    accounts::set_setting(&app.db, PAGE, page).await.map_err(e)?;

    accounts::audit(&app.db, Some(&me), "admin.security_contact", contact, policy).await.ok();

    let notice = if contact.is_empty() {

        "No security contact: /.well-known/security.txt is gone.".to_string()

    } else {

        "Security contact saved: /.well-known/security.txt names it.".to_string()

    };

    super::admin::admin_page(&app, shell, super::admin::AdminSection::SecurityContact, Some(notice)).await

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn contacts_become_uris_or_are_refused() {

        assert_eq!(contact_uri("[email protected]").as_deref(), Some("mailto:[email protected]"));

        assert_eq!(contact_uri(" https://example.org/report ").as_deref(), Some("https://example.org/report"));

        assert_eq!(contact_uri("mailto:[email protected]").as_deref(), Some("mailto:[email protected]"));

        for bad in ["", "http://example.org", "nobody", "a@b", "a [email protected]", "javascript:alert(1)", "[email protected]\nContact: evil"] {

            assert_eq!(contact_uri(bad), None, "{bad:?}");

        }

    }

    #[test]

    fn the_file_expires_under_a_year_ahead_and_is_canonical() {

        let now = 1_800_000_000_000; // 2027-01-15

        let t = text("https://hub.example/", "[email protected]", "https://hub.example/policy", now).unwrap();

        assert_eq!(

            t,

            "Contact: mailto:[email protected]\nExpires: 2028-01-10T08:00:00Z\nPolicy: https://hub.example/policy\n\

             Preferred-Languages: en\nCanonical: https://hub.example/.well-known/security.txt\n"

        );

        assert!(!text("https://hub.example", "[email protected]", "", now).unwrap().contains("Policy"));

        assert!(text("https://hub.example", "", "", now).is_none());

    }

}