//! `oxygenhub`: `init`, `serve`, `admin`, `check` (hub spec §17.3).

use clap::{Parser, Subcommand};

use hub_api::Visibility;

use oxygenhub::config::Config;

use oxygenhub::repos::RepoName;

use oxygenhub::{db, keys};

use std::path::PathBuf;

#[derive(Parser)]

#[command(name = "oxygenhub", version, about = "A forge for Oxygen repositories")]

struct Cli {

    /// The data directory (hub spec §3.2)

    #[arg(long, global = true, env = "OXYHUB_DATA", default_value = "data")]

    data: PathBuf,

    #[command(subcommand)]

    cmd: Cmd,

}

#[derive(Subcommand)]

enum Cmd {

    /// Create the data directory, keys, database and a default hub.toml

    Init {

        /// What links and clone URLs start with

        #[arg(long)]

        base_url: Option<String>,

        /// Generate a self-signed TLS certificate (developer edition)

        #[arg(long)]

        self_signed: bool,

    },

    /// Run the hub

    Serve,

    /// Offline administration

    Admin {

        #[command(subcommand)]

        cmd: AdminCmd,

    },

    /// Verify every repository's objects and signatures

    Check,

    /// Garbage-collect every repository now, as the nightly job does

    Gc,

}

#[derive(Subcommand)]

enum AdminCmd {

    /// Repositories

    Repo {

        #[command(subcommand)]

        cmd: RepoCmd,

    },

    /// Accounts

    User {

        #[command(subcommand)]

        cmd: UserCmd,

    },

    /// Backups (docs/backups.md)

    Backup {

        #[command(subcommand)]

        cmd: BackupCmd,

    },

}

#[derive(Subcommand)]

enum BackupCmd {

    /// Back up a user's or organisation's repositories now, as its settings say

    Run { owner: String },

    /// Restore every repository of a whole run from a backup directory

    /// (the one holding LATEST, runs/ and blobs/) into this hub

    Restore {

        #[arg(long)]

        from: std::path::PathBuf,

        /// The run (runs/<RUN>); the latest whole one when not given

        #[arg(long)]

        run: Option<String>,

    },

}

#[derive(Subcommand)]

enum UserCmd {

    /// Create an account with a generated password, printed once

    Create {

        username: String,

        #[arg(long, default_value = "")]

        email: String,

        /// Make it a site administrator

        #[arg(long)]

        admin: bool,

    },

    /// Reset an account's password to a new generated one, printed once

    ResetPassword { username: String },

    /// List accounts

    List,

}

#[derive(Subcommand)]

enum RepoCmd {

    /// Create an empty repository OWNER/NAME

    Create {

        slug: String,

        #[arg(long, default_value = "")]

        description: String,

        #[arg(long, default_value = "public")]

        visibility: String,

        /// Bind to this repository id now (32 hex characters, from `.oxy/id`);

        /// otherwise the first push binds it

        #[arg(long)]

        id: Option<String>,

    },

    /// List repositories

    List,

    /// Move a repository to the trash

    Delete { slug: String },

    /// Change the description, default bookmark or visibility

    Set {

        slug: String,

        #[arg(long)]

        description: Option<String>,

        #[arg(long)]

        default_bookmark: Option<String>,

        #[arg(long)]

        visibility: Option<String>,

    },

}

fn main() -> anyhow::Result<()> {

    tune_allocator();

    let rt = tokio::runtime::Builder::new_multi_thread().enable_all().build()?;

    rt.spawn(return_freed_memory());

    rt.block_on(run())

}

/// glibc's allocator gives each thread that allocates an arena of its own

/// and keeps what is freed in it: under the hub's worker threads, loaded

/// states that the cache had let go still held their pages, and the hub

/// grew to 12 GB with its state cache capped at 3 GiB (oxygenhub#117).

/// Two arenas, as oxy found for its own threads; MALLOC_ARENA_MAX in the

/// environment still has the last word. Called before any thread starts.

fn tune_allocator() {

    #[cfg(all(target_os = "linux", target_env = "gnu"))]

    if std::env::var_os("MALLOC_ARENA_MAX").is_none() {

        // SAFETY: mallopt is called once, before any other thread exists.

        unsafe {

            libc::mallopt(libc::M_ARENA_MAX, 2);

        }

    }

}

/// Hand freed memory back to the system every minute, so the hub's size

/// follows what it holds rather than its peak (oxygenhub#117).

async fn return_freed_memory() {

    #[cfg(all(target_os = "linux", target_env = "gnu"))]

    loop {

        tokio::time::sleep(std::time::Duration::from_secs(60)).await;

        // SAFETY: malloc_trim only releases free pages.

        let _ = tokio::task::spawn_blocking(|| unsafe { libc::malloc_trim(0) }).await;

    }

}

async fn run() -> anyhow::Result<()> {

    tracing_subscriber::fmt()

        .with_env_filter(tracing_subscriber::EnvFilter::from_default_env().add_directive("oxygenhub=info".parse()?))

        .init();

    let cli = Cli::parse();

    match cli.cmd {

        Cmd::Init { base_url, self_signed } => init(&cli.data, base_url, self_signed).await,

        Cmd::Serve => {

            let config = Config::load(&cli.data)?;

            let app = oxygenhub::build(config).await?;

            oxygenhub::serve(app).await

        }

        Cmd::Admin { cmd: AdminCmd::Repo { cmd } } => {

            let config = Config::load(&cli.data)?;

            let app = oxygenhub::build(config).await?;

            repo_admin(&app, cmd).await

        }

        Cmd::Admin { cmd: AdminCmd::Backup { cmd } } => {

            let config = Config::load(&cli.data)?;

            let app = oxygenhub::build(config).await?;

            match cmd {

                BackupCmd::Run { owner } => {

                    let r = oxygenhub::backups::run(&app, &owner, "now").await?;

                    println!(

                        "{} {}: {} repositories, {} of {} files sent ({} KiB){}",

                        r.status,

                        r.at,

                        r.repos,

                        r.sent,

                        r.files,

                        r.bytes / 1024,

                        if r.detail.is_empty() { String::new() } else { format!(": {}", r.detail) }

                    );

                    if r.status == "failed" {

                        std::process::exit(1);

                    }

                    Ok(())

                }

                BackupCmd::Restore { from, run } => {

                    let dest: std::sync::Arc<dyn oxygenhub::backups::Destination> =

                        std::sync::Arc::new(oxygenhub::backups::Directory { root: from });

                    for d in oxygenhub::backups::restore_into_hub(&app, dest, run).await? {

                        println!("restored {d}");

                    }

                    Ok(())

                }

            }

        }

        Cmd::Admin { cmd: AdminCmd::User { cmd } } => {

            let config = Config::load(&cli.data)?;

            let app = oxygenhub::build(config).await?;

            user_admin(&app, cmd).await

        }

        Cmd::Check => {

            let config = Config::load(&cli.data)?;

            let app = oxygenhub::build(config).await?;

            check(&app).await

        }

        Cmd::Gc => {

            let config = Config::load(&cli.data)?;

            let app = oxygenhub::build(config).await?;

            let done = oxygenhub::maintenance::gc_all(&app).await;

            for d in &done {

                println!("{d}");

            }

            if done.iter().any(|d| d.failed) {

                anyhow::bail!("a repository could not be garbage collected");

            }

            Ok(())

        }

    }

}

async fn init(data: &PathBuf, base_url: Option<String>, self_signed: bool) -> anyhow::Result<()> {

    std::fs::create_dir_all(data)?;

    let toml_path = data.join("hub.toml");

    if !toml_path.exists() {

        let base = base_url.clone().unwrap_or_else(|| "http://127.0.0.1:7300".into());

        let mut text = String::from("# OxygenHub configuration (docs/spec.md section 17.1)\n\n[site]\nname = \"OxygenHub\"\n\n[server]\nbind = \"127.0.0.1:7300\"\n");

        if self_signed {

            text.push_str("tls_bind = \"0.0.0.0:7343\"\n");

        }

        text.push_str(&format!("base_url = \"{base}\"\n\n[tls]\nself_signed = {self_signed}\n\n[auth]\n# Bearer tokens allowed to push until accounts exist.\npush_tokens = []\n"));

        std::fs::write(&toml_path, text)?;

        println!("wrote {}", toml_path.display());

    }

    let mut config = Config::load(data)?;

    if let Some(b) = base_url {

        config.server.base_url = b;

    }

    let app = oxygenhub::build(config).await?;

    println!("hub key {}", app.hub_key.key.to_hex());

    if (self_signed || app.config.tls.self_signed)

        && keys::ensure_self_signed(&app.config.tls_cert(), &app.config.tls_key(), app.config.base_url())?

    {

        println!("wrote self-signed certificate {}", app.config.tls_cert().display());

    }

    println!("data directory {} is ready", data.display());

    Ok(())

}

async fn repo_admin(app: &oxygenhub::Shared, cmd: RepoCmd) -> anyhow::Result<()> {

    match cmd {

        RepoCmd::Create { slug, description, visibility, id } => {

            let name = RepoName::parse(&slug).ok_or_else(|| anyhow::anyhow!("{slug:?} is not a valid owner/name"))?;

            let visibility = Visibility::parse(&visibility).ok_or_else(|| anyhow::anyhow!("visibility is public, internal or private"))?;

            let id = match id {

                Some(h) => {

                    let bytes = hex::decode(h.trim()).ok().and_then(|v| <[u8; 16]>::try_from(v).ok());

                    Some(bytes.ok_or_else(|| anyhow::anyhow!("--id takes 32 hex characters"))?)

                }

                None => None,

            };

            if db::repos::get(&app.db, &name.owner, &name.name).await?.is_some() {

                anyhow::bail!("{name} already exists");

            }

            app.repos.create(&name, id)?;

            db::repos::create(&app.db, &name.owner, &name.name, &description, visibility).await?;

            println!("created {name}: oxy clone {}/{name}", app.config.base_url());

        }

        RepoCmd::List => {

            for r in db::repos::list(&app.db).await? {

                println!("{:<40} {:<8} {}", r.slug(), r.visibility, r.description);

            }

        }

        RepoCmd::Delete { slug } => {

            let name = RepoName::parse(&slug).ok_or_else(|| anyhow::anyhow!("{slug:?} is not a valid owner/name"))?;

            let row = db::repos::get(&app.db, &name.owner, &name.name).await?.ok_or_else(|| anyhow::anyhow!("{name} does not exist"))?;

            let dest = app.repos.trash(&name)?;

            db::repos::delete(&app.db, row.id).await?;

            println!("moved {name} to {}", dest.display());

        }

        RepoCmd::Set { slug, description, default_bookmark, visibility } => {

            let name = RepoName::parse(&slug).ok_or_else(|| anyhow::anyhow!("{slug:?} is not a valid owner/name"))?;

            let row = db::repos::get(&app.db, &name.owner, &name.name).await?.ok_or_else(|| anyhow::anyhow!("{name} does not exist"))?;

            if let Some(d) = description {

                db::repos::set_description(&app.db, row.id, &d).await?;

            }

            if let Some(b) = default_bookmark {

                db::repos::set_default_bookmark(&app.db, row.id, &b).await?;

            }

            if let Some(v) = visibility {

                let v = Visibility::parse(&v).ok_or_else(|| anyhow::anyhow!("visibility is public, internal or private"))?;

                db::repos::set_visibility(&app.db, row.id, v).await?;

            }

            println!("updated {name}");

        }

    }

    Ok(())

}

async fn user_admin(app: &oxygenhub::Shared, cmd: UserCmd) -> anyhow::Result<()> {

    use oxygenhub::auth;

    use oxygenhub::db::accounts;

    match cmd {

        UserCmd::Create { username, email, admin } => {

            if !oxygenhub::repos::names::valid_owner(&username) {

                anyhow::bail!("{username:?} is not a valid username");

            }

            if accounts::account_by_name(&app.db, &username).await?.is_some() || accounts::org_by_name(&app.db, &username).await?.is_some()

            {

                anyhow::bail!("{username} is taken");

            }

            let password = auth::random_hex(12);

            let hash = auth::hash_password(&password)?;

            accounts::create_account(&app.db, &username, &email, &hash, &auth::random_hex(16), admin).await?;

            accounts::audit(&app.db, None, "admin.user.create", &username, if admin { "administrator" } else { "" }).await?;

            println!("created {username}{}; one-time password: {password}", if admin { " (administrator)" } else { "" });

            println!("sign in at {}/login and change it under Settings", app.config.base_url());

        }

        UserCmd::ResetPassword { username } => {

            let account = accounts::account_by_name(&app.db, &username).await?.ok_or_else(|| anyhow::anyhow!("no such account"))?;

            let password = auth::random_hex(12);

            let hash = auth::hash_password(&password)?;

            accounts::set_password(&app.db, account.id, &hash, &auth::random_hex(16)).await?;

            accounts::audit(&app.db, None, "admin.user.reset_password", &username, "").await?;

            println!("new one-time password for {username}: {password}");

        }

        UserCmd::List => {

            for a in accounts::accounts(&app.db).await? {

                println!(

                    "{:<24} {:<32} {}{}{}",

                    a.username,

                    a.email,

                    if a.is_admin { "admin " } else { "" },

                    if a.banned { "banned " } else { "" },

                    if a.disabled { "disabled" } else { "" }

                );

            }

        }

    }

    Ok(())

}

async fn check(app: &oxygenhub::Shared) -> anyhow::Result<()> {

    let mut problems = 0;

    for r in db::repos::list(&app.db).await? {

        let name = RepoName::new(&r.owner, &r.name).unwrap();

        let report = app.repos.read(&name, oxygenhub::repos::view::verification).await;

        match report {

            Ok(v) => {

                println!(

                    "{:<40} {} changes, {} signed, {} sealed, {} unsigned, {} invalid",

                    name,

                    v.total,

                    v.signed,

                    v.sealed,

                    v.unsigned,

                    v.invalid.len()

                );

                problems += v.invalid.len();

            }

            Err(e) => {

                println!("{name:<40} ERROR {e}");

                problems += 1;

            }

        }

    }

    if problems > 0 {

        anyhow::bail!("{problems} problem(s)");

    }

    Ok(())

}