//! The sudo step (oxygenhub#356): before a sensitive change (a password,
//! two-factor settings, keys and tokens, secrets, a repository's deletion
//! or transfer, the site's administration), a session that has not proved
//! a second factor for a while proves one again: a phone's approval, a code
//! from the authenticator app, or the password when the account has no
//! second factor. Signing in counts as proof.

use super::{Error, Page, Shell};
use crate::auth::{self, phone, totp, Viewer};
use crate::db::{self, accounts};
use crate::throttle::{self, Key};
use crate::Shared;
use askama::Template;
use axum::extract::{Form, Path, Query, State};
use axum::http::{header, Method, StatusCode};
use axum::response::{IntoResponse, Redirect, Response};
use serde::Deserialize;

/// Whether a request changes something the sudo step guards. Only
/// changes are guarded: reading a page never asks.
pub fn sensitive(method: &Method, path: &str) -> bool {
    if method == Method::GET || method == Method::HEAD {
        return false;
    }
    let p = path.trim_end_matches('/');
    if p.starts_with("/admin") {
        return true;
    }
    if matches!(
        p,
        "/settings/password"
            | "/settings/security/totp/disable"
            | "/settings/keys/upload"
            | "/settings/keys/unlink"
            | "/settings/tokens"
            | "/settings/backups"
    ) || p.starts_with("/settings/security/phones/")
        || p.starts_with("/settings/security/disconnect/")
        || (p.starts_with("/settings/tokens/") && p.ends_with("/agent"))
    {
        return true;
    }
    let parts: Vec<&str> = p.trim_start_matches('/').split('/').collect();
    match parts.as_slice() {
        ["orgs", _, "settings", what] => matches!(*what, "secrets" | "storage" | "hooks" | "backups"),
        [owner, _, "settings", what] if !matches!(*owner, "settings" | "admin" | "orgs") => {
            matches!(*what, "delete" | "transfer" | "secrets" | "hooks" | "push-protection" | "secret-bypass" | "backup" | "collaborators")
        }
        _ => false,
    }
}

/// The middleware: a guarded change from a session whose proof is older
/// than [`phone::FRESH_MS`] goes to the sudo page instead, which comes back
/// to the page it was sent from.
pub async fn gate(State(app): State<Shared>, req: axum::extract::Request, next: axum::middleware::Next) -> Response {
    if !sensitive(req.method(), req.uri().path()) {
        return next.run(req).await;
    }
    let Some(value) = auth::viewer::cookie(req.headers(), auth::SESSION_COOKIE) else { return next.run(req).await };
    let Some((_, session)) = auth::viewer::resolve(&app, &value).await else { return next.run(req).await };
    if db::now_ms() - session.second_factor_ms < phone::FRESH_MS {
        return next.run(req).await;
    }
    let base = app.config.base_url().trim_end_matches('/').to_string();
    let back = req
        .headers()
        .get(header::REFERER)
        .and_then(|v| v.to_str().ok())
        .and_then(|r| r.strip_prefix(&base))
        .filter(|p| p.starts_with('/') && !p.starts_with("//"))
        .unwrap_or("/settings/security")
        .to_string();
    Redirect::to(&format!("/sudo?next={}", super::settings::urlencode(&back))).into_response()
}

#[derive(Template)]
#[template(path = "sudo.html")]
pub struct SudoPage {
    shell: Shell,
    next: String,
    error: Option<String>,
    /// The account has a phone that approves.
    phones: bool,
    /// The account has an authenticator app.
    totp: bool,
    /// Neither: the password stands in.
    password: bool,
    /// Waiting for the phone: the approval and its number.
    approval: Option<(String, i64)>,
}

#[derive(Deserialize)]
pub struct NextQuery {
    #[serde(default)]
    next: String,
}

fn safe_next(next: &str) -> String {
    if next.starts_with('/') && !next.starts_with("//") {
        next.to_string()
    } else {
        "/".into()
    }
}

async fn page(
    app: &Shared,
    viewer: &Viewer,
    next: &str,
    error: Option<String>,
    approval: Option<(String, i64)>,
) -> Result<Response, Error> {
    let shell = Shell::new(app, "/sudo", viewer);
    let Some(me) = viewer.account() else {
        return Ok(Redirect::to(&format!("/login?next={}", super::settings::urlencode(next))).into_response());
    };
    let totp = me.totp_secret.is_some();
    let phones = totp && !db::approvals::authenticators(&app.db, me.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.is_empty();
    let password = !totp && !me.password_hash.is_empty();
    Ok(Page(SudoPage { shell, next: safe_next(next), error, phones, totp, password, approval }).into_response())
}

/// `GET /sudo?next=`: prove it is you, then carry on.
pub async fn show(State(app): State<Shared>, viewer: Viewer, Query(q): Query<NextQuery>) -> Result<Response, Error> {
    page(&app, &viewer, &q.next, None, None).await
}

#[derive(Deserialize)]
pub struct SudoForm {
    #[serde(rename = "_csrf")]
    csrf: String,
    #[serde(default)]
    next: String,
    #[serde(default)]
    code: String,
    #[serde(default)]
    password: String,
}

/// `POST /sudo`: a code from the authenticator app (or a recovery code),
/// or the password for an account without one.
pub async fn confirm(State(app): State<Shared>, viewer: Viewer, Form(f): Form<SudoForm>) -> Result<Response, Error> {
    let Some(me) = viewer.0.clone() else { return Ok(Redirect::to("/login").into_response()) };
    let shell = Shell::new(&app, "/sudo", &viewer);
    if !viewer.csrf_ok(&f.csrf) {
        return page(&app, &viewer, &f.next, Some("That form had expired: try again.".into()), None).await;
    }
    let now = db::now_ms();
    let keys = [Key::account("sudo", &me.account.username)];
    let wait = app.throttle.lock().unwrap().wait(&keys, now);
    if let Some(wait) = wait {
        return page(&app, &viewer, &f.next, Some(throttle::message(wait)), None).await;
    }
    let ok = match &me.account.totp_secret {
        Some(secret) => {
            totp::verify(secret, f.code.trim(), (now / 1000) as u64)
                || match totp::use_recovery_code(&me.account.recovery_codes, f.code.trim()) {
                    Some(rest) => {
                        accounts::set_totp(&app.db, me.account.id, Some(secret), &rest)
                            .await
                            .map_err(|e| Error::from_db(shell.clone(), e))?;
                        true
                    }
                    None => false,
                }
        }
        None => !me.account.password_hash.is_empty() && auth::verify_password(&me.account.password_hash, &f.password),
    };
    if !ok {
        app.throttle.lock().unwrap().failed(&keys, now);
        accounts::audit(&app.db, Some(&me.account), "sudo.failed", &me.account.username, "").await.ok();
        let what = if me.account.totp_secret.is_some() { "That code is not right." } else { "That password is not right." };
        return page(&app, &viewer, &f.next, Some(what.into()), None).await;
    }
    app.throttle.lock().unwrap().cleared(&keys[0]);
    db::sessions::mark_second_factor(&app.db, me.session_id, now).await.map_err(|e| Error::from_db(shell.clone(), e))?;
    accounts::audit(
        &app.db,
        Some(&me.account),
        "sudo",
        &me.account.username,
        if me.account.totp_secret.is_some() { "code" } else { "password" },
    )
    .await
    .ok();
    Ok(Redirect::to(&safe_next(&f.next)).into_response())
}

#[derive(Deserialize)]
pub struct PhoneForm {
    #[serde(rename = "_csrf")]
    csrf: String,
    #[serde(default)]
    next: String,
}

/// `POST /sudo/phone`: ask the account's phones; the page waits for one.
pub async fn ask_phone(
    State(app): State<Shared>,
    viewer: Viewer,
    headers: axum::http::HeaderMap,
    Form(f): Form<PhoneForm>,
) -> Result<Response, Error> {
    let Some(me) = viewer.0.clone() else { return Ok(Redirect::to("/login").into_response()) };
    let shell = Shell::new(&app, "/sudo", &viewer);
    if !viewer.csrf_ok(&f.csrf) {
        return page(&app, &viewer, &f.next, Some("That form had expired: try again.".into()), None).await;
    }
    let agent = headers.get(header::USER_AGENT).and_then(|v| v.to_str().ok()).unwrap_or("");
    let what = format!("Confirm a change from {}", super::settings::browser_of(agent));
    let a = phone::ask(&app, &me.account, "stepup", &what, Some(me.session_id)).await.map_err(|e| Error::from_db(shell.clone(), e))?;
    page(&app, &viewer, &f.next, None, Some((a.id, a.number))).await
}

/// `GET /sudo/approval/{id}`: what became of this session's approval.
pub async fn approval_state(State(app): State<Shared>, viewer: Viewer, Path(id): Path<String>) -> Response {
    let found = match viewer.0.as_ref() {
        Some(me) => {
            db::approvals::get(&app.db, &id).await.ok().flatten().filter(|a| a.session_id == Some(me.session_id) && a.kind == "stepup")
        }
        None => None,
    };
    match found {
        Some(a) => {
            let state = if a.state == "pending" && a.expires_ms <= db::now_ms() { "expired".to_string() } else { a.state };
            axum::Json(serde_json::json!({ "state": state })).into_response()
        }
        None => (StatusCode::NOT_FOUND, axum::Json(serde_json::json!({ "state": "unknown" }))).into_response(),
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn only_changes_that_matter_are_guarded() {
        let post = Method::POST;
        for p in [
            "/settings/password",
            "/settings/security/totp/disable",
            "/settings/security/phones/3/remove",
            "/settings/tokens",
            "/settings/tokens/4/agent",
            "/settings/keys/upload",
            "/admin/mail",
            "/admin/runners/7/state",
            "/orgs/acme/settings/secrets",
            "/andy/demo/settings/delete",
            "/andy/demo/settings/transfer",
            "/andy/demo/settings/secrets",
            "/andy/demo/settings/collaborators",
        ] {
            assert!(sensitive(&post, p), "{p}");
        }
        for p in [
            "/settings",
            "/settings/appearance",
            "/settings/security/totp/begin",
            "/settings/tokens/4/delete",
            "/andy/demo/issues/new",
            "/andy/demo/settings/topics",
            "/login",
            "/sudo",
        ] {
            assert!(!sensitive(&post, p), "{p}");
        }
        assert!(!sensitive(&Method::GET, "/admin/mail"), "reading never asks");
    }
}