//! The JSON API (hub spec §12.1) under `/api/v1`: bearer tokens, RFC 7807

//! problems, the same shapes as `oxy --json` where one exists. Reads need

//! `repo:read` (anonymous for public repositories); writes the scope named

//! on each handler.

use crate::auth::{self, Access, Role};

use crate::db::{self, accounts::Account};

use crate::repos::{view, RepoError, RepoName};

use crate::Shared;

use axum::extract::{Path, Query, State};

use axum::http::{HeaderMap, StatusCode};

use axum::response::{IntoResponse, Response};

use axum::routing::{get, post};

use axum::{Json, Router};

use hub_api::*;

use serde::Deserialize;

mod backups;

pub mod device;

mod drops;

mod images;

mod projects;

mod reports;

/// Any other path under `/api/v1`: a problem document, not the site's page.

/// `GET /api/v1/version`: the hub's version and build, and the Oxygen and

/// OxygenFlow library versions it is built on.

async fn version() -> Json<serde_json::Value> {

    Json(crate::web::home::versions())

}

async fn no_route() -> ApiError {

    ApiError(StatusCode::NOT_FOUND, "no such API route".into())

}

/// A known route asked with a method it does not take: a problem body

/// rather than axum's empty 405 (oxygenhub#115).

async fn wrong_method(method: axum::http::Method, uri: axum::http::Uri) -> ApiError {

    ApiError(StatusCode::METHOD_NOT_ALLOWED, format!("{} is an API route, but not for {method}", uri.path()))

}

/// The API, with release assets up to `asset_limit` bytes (the web form's

/// limit too; axum's default of 2 MiB refused ordinary builds).

pub fn router(asset_limit: usize) -> Router<Shared> {

    Router::new()

        .fallback(no_route)

        .route("/keyless/certify", post(crate::keyless::certify))

        .route("/agents/grants", get(crate::keyless::grants_list).post(crate::keyless::grants_create))

        .route(

            "/repos/{owner}/{name}/terraform/state/{state}",

            axum::routing::any(crate::terraform::state)

                .layer(axum::extract::DefaultBodyLimit::max(crate::terraform::MAX_STATE_BYTES + 4096)),

        )

        .route("/repos/{owner}/{name}/terraform/state/{state}/versions", axum::routing::get(crate::terraform::versions))

        .route("/repos/{owner}/{name}/terraform/state/{state}/versions/{id}", axum::routing::get(crate::terraform::version))

        .route(

            "/repos/{owner}/{name}/terraform/state/{state}/versions/{id}/restore",

            axum::routing::post(crate::terraform::restore_version),

        )

        .route("/agents/grants/{id}", axum::routing::delete(crate::keyless::grants_revoke))

        .route("/flow/claim", post(crate::flow::claim))

        .route("/flow/runners/register", post(crate::flow::register))

        .route("/flow/runners/heartbeat", post(crate::flow::heartbeat))

        .route("/flow/images/missing", post(images::missing).layer(axum::extract::DefaultBodyLimit::max(images::MAX_ASK_BYTES)))

        .route("/flow/swarm/announce", post(crate::swarm::announce))

        .route("/flow/images/chunks/{hash}", axum::routing::put(images::put_chunk).get(images::get_chunk))

        .route(

            "/flow/images/{hash}",

            axum::routing::put(images::put_manifest).get(images::get_manifest).layer(axum::extract::DefaultBodyLimit::max(64 << 20)),

        )

        .route("/flow/jobs/{id}/log", post(crate::flow::log))

        .route("/flow/jobs/{id}/finish", post(crate::flow::finish))

        .route("/flow/jobs/{id}/decline", post(crate::flow::decline))

        .route(

            "/flow/jobs/{id}/artifacts/{name}",

            post(crate::flow::artifact).layer(axum::extract::DefaultBodyLimit::max(crate::flow::MAX_ARTIFACT_BYTES + (1 << 20))),

        )

        .route("/flow/jobs/{id}/inputs/{index}", get(crate::flow::input))

        .route(

            "/flow/jobs/{id}/reports/{name}/files",

            post(crate::flow::report_file).layer(axum::extract::DefaultBodyLimit::max(crate::flow::MAX_ARTIFACT_BYTES + (1 << 20))),

        )

        .route("/projects/{owner}", get(projects::list).post(projects::create))

        .route("/projects/{owner}/{number}", get(projects::board).patch(projects::edit))

        .route("/projects/{owner}/{number}/cards", get(projects::cards).post(projects::add_card))

        .route("/projects/{owner}/{number}/cards/{id}", axum::routing::patch(projects::move_card).delete(projects::remove_card))

        .route("/device/code", post(device::code))

        .route("/device/token", post(device::token))

        .route("/runners", get(runners))

        .route("/runners/queue", get(runner_queue))

        .route("/runners/{id}/jobs", get(runner_jobs))

        .route("/user", get(me))

        .route("/user/token", axum::routing::delete(revoke_own_token))

        .route("/version", get(version))

        .route("/notifications", get(notifications))

        .route("/notifications/read", post(notifications_read_all))

        .route("/notifications/{id}/read", post(notification_read))

        .route("/users/{name}", get(user))

        .route("/users/{name}/drops", get(drops::of_user))

        .route("/drops", get(drops::mine).post(drops::create))

        .route("/drops/{id}", get(drops::view).patch(drops::edit).delete(drops::delete))

        .route("/orgs/{name}", get(org))

        .route("/search", get(search))

        .route("/repos", get(list_repos).post(create_repo))

        .route("/repos/{owner}/{name}", get(get_repo))

        .route("/repos/{owner}/{name}/bookmarks", get(bookmarks))

        .route("/repos/{owner}/{name}/tags", get(tags))

        .route("/repos/{owner}/{name}/consumers", get(consumers))

        .route("/repos/{owner}/{name}/diffusion", get(diffusion).put(set_diffusion))

        .route("/repos/{owner}/{name}/backup", axum::routing::put(set_backup))

        .route("/user/backups", get(backups::user_get).put(backups::user_put))

        .route("/user/backups/test", post(backups::user_test))

        .route("/user/backups/run", post(backups::user_run))

        .route("/user/backups/runs", get(backups::user_runs))

        .route("/orgs/{name}/backups", get(backups::org_get).put(backups::org_put))

        .route("/orgs/{name}/backups/test", post(backups::org_test))

        .route("/orgs/{name}/backups/run", post(backups::org_run))

        .route("/orgs/{name}/backups/runs", get(backups::org_runs))

        .route("/repos/{owner}/{name}/history/{r}", get(history))

        .route("/repos/{owner}/{name}/changes/{hash}", get(change))

        .route("/repos/{owner}/{name}/tree/{r}", get(tree_root))

        .route("/repos/{owner}/{name}/tree/{r}/{*path}", get(tree))

        .route("/repos/{owner}/{name}/file/{r}/{*path}", get(file))

        .route("/repos/{owner}/{name}/blame/{r}/{*path}", get(blame))

        .route("/repos/{owner}/{name}/conflicts", get(conflicts))

        .route("/repos/{owner}/{name}/trust", get(trust))

        .route("/repos/{owner}/{name}/releases/trust/{*tag}", get(release_trust))

        .route("/repos/{owner}/{name}/pushes", get(pushes))

        .route("/repos/{owner}/{name}/proposals", get(proposals).post(create_proposal))

        .route("/repos/{owner}/{name}/proposals/{number}", get(proposal).patch(edit_proposal))

        .route("/repos/{owner}/{name}/proposals/{number}/land", post(land_proposal))

        .route("/repos/{owner}/{name}/proposals/{number}/auto-land", post(auto_land_on).delete(auto_land_off))

        .route("/repos/{owner}/{name}/proposals/{number}/comments", get(proposal_comments).post(proposal_comment))

        .route("/repos/{owner}/{name}/proposals/{number}/reviews", get(proposal_reviews).post(proposal_review))

        .route("/repos/{owner}/{name}/proposals/{number}/reviewers", post(request_reviewers))

        .route("/repos/{owner}/{name}/proposals/{number}/review-requests", post(request_assistant))

        .route("/repos/{owner}/{name}/proposals/{number}/reviewers/{username}", axum::routing::delete(withdraw_reviewer))

        .route("/repos/{owner}/{name}/proposals/{number}/checks", get(proposal_checks))

        .route("/repos/{owner}/{name}/proposals/{number}/files", get(proposal_files))

        .route("/repos/{owner}/{name}/proposals/{number}/content/{side}/{*path}", get(proposal_content))

        .route("/repos/{owner}/{name}/issues", get(issues).post(create_issue))

        .route("/repos/{owner}/{name}/issues/{number}", get(issue).post(issue_state).patch(issue_edit))

        .route("/repos/{owner}/{name}/issues/{number}/comments", get(issue_comments).post(issue_comment))

        .route("/repos/{owner}/{name}/labels", get(labels).post(create_label))

        .route("/repos/{owner}/{name}/labels/{label}", axum::routing::delete(delete_label))

        .route("/repos/{owner}/{name}/milestones", get(milestones).post(create_milestone))

        .route(

            "/repos/{owner}/{name}/coverage",

            get(reports::coverage_list)

                .post(reports::coverage_upload)

                .layer(axum::extract::DefaultBodyLimit::max(crate::coverage::MAX_REPORT + (1 << 20))),

        )

        .route("/repos/{owner}/{name}/coverage/{id}", get(reports::coverage_one))

        .route("/repos/{owner}/{name}/tests", get(reports::tests_list))

        .route("/repos/{owner}/{name}/tests/{id}", get(reports::tests_one))

        .route("/repos/{owner}/{name}/milestones/{title}", axum::routing::patch(edit_milestone))

        .route("/repos/{owner}/{name}/hooks", get(hooks).post(create_hook))

        .route("/repos/{owner}/{name}/assistants", get(repo_assistants).post(repo_assistant_put))

        .route("/repos/{owner}/{name}/assistants/prompt", get(repo_prompt).put(repo_prompt_put))

        .route("/repos/{owner}/{name}/assistants/{assistant}", axum::routing::delete(repo_assistant_delete))

        .route("/orgs/{org}/assistants", get(org_assistants).post(org_assistant_put))

        .route("/orgs/{org}/assistants/prompt", get(org_prompt).put(org_prompt_put))

        .route("/orgs/{org}/assistants/{assistant}", axum::routing::delete(org_assistant_delete))

        .route("/admin/assistants", get(site_assistants).post(site_assistant_put))

        .route("/admin/assistants/prompt", get(site_prompt).put(site_prompt_put))

        .route("/admin/assistants/{assistant}", axum::routing::delete(site_assistant_delete))

        .route("/repos/{owner}/{name}/hooks/{id}/delete", post(delete_hook))

        .route("/repos/{owner}/{name}/checks", post(post_check))

        .route("/repos/{owner}/{name}/flow/runs", get(flow_runs).post(start_flow_run))

        .route("/repos/{owner}/{name}/flow/runs/{number}", get(flow_run))

        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/log", get(flow_job_log))

        .route("/repos/{owner}/{name}/flow/runs/{number}/rerun", post(rerun_flow_run))

        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/rerun", post(rerun_flow_job))

        .route("/repos/{owner}/{name}/flow/runs/{number}/cancel", post(cancel_flow_run))

        .route("/repos/{owner}/{name}/deployments", get(list_deployments))

        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/approve", post(approve_flow_job))

        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/reject", post(reject_flow_job))

        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/approval", get(flow_job_statement))

        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/seal", post(seal_flow_job))

        .route("/repos/{owner}/{name}/checks/required", get(required_checks).put(set_required_checks))

        .route("/repos/{owner}/{name}/checks/{state}", get(checks_for_state))

        .route("/repos/{owner}/{name}/releases", get(releases).post(create_release))

        .route("/repos/{owner}/{name}/releases/{tag}", axum::routing::patch(edit_release))

        .route(

            "/repos/{owner}/{name}/releases/{tag}/assets",

            post(upload_asset).layer(axum::extract::DefaultBodyLimit::max(asset_limit + (1 << 20))),

        )

        // Last: it applies to the routes registered before it.

        .method_not_allowed_fallback(wrong_method)

}

async fn releases(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name)): Path<(String, String)>,

) -> Result<Json<Vec<Release>>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;

    Ok(Json(crate::web::releases::api_views(&app, &repo, &row).await?))

}

async fn create_release(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name)): Path<(String, String)>,

    Json(body): Json<NewRelease>,

) -> Result<(StatusCode, Json<Release>), ApiError> {

    let c = caller(&app, &headers).await?;

    let me = c.require("repo:write")?.clone();

    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;

    crate::web::releases::create_release(&app, &repo, &row, &me, &body.tag, &body.title, body.notes, body.prerelease)

        .await

        .map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;

    let r = crate::web::releases::api_views(&app, &repo, &row)

        .await?

        .into_iter()

        .find(|r| r.tag == body.tag)

        .ok_or_else(|| not_found("no such release"))?;

    Ok((StatusCode::CREATED, Json(r)))

}

/// `PATCH …/releases/{tag}` (oxygenhub#72): change a release's title,

/// notes or prerelease flag, as the release page's Edit does.

async fn edit_release(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, tag)): Path<(String, String, String)>,

    Json(body): Json<ReleaseEdit>,

) -> Result<Json<Release>, ApiError> {

    let c = caller(&app, &headers).await?;

    let me = c.require("repo:write")?.clone();

    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;

    let r = db::releases::get(&app.db, row.id, &tag).await?.ok_or_else(|| not_found("no such release"))?;

    let title = body.title.as_deref().map(str::trim).filter(|t| !t.is_empty()).unwrap_or(&r.title);

    let notes = body.notes.as_deref().map(str::trim).unwrap_or(&r.notes);

    db::releases::edit(&app.db, r.id, title, notes, body.prerelease.unwrap_or(r.prerelease)).await?;

    db::accounts::audit(&app.db, Some(&me), "release.edited", &format!("{owner}/{name}@{tag}"), "").await.ok();

    let r = crate::web::releases::api_views(&app, &repo, &row)

        .await?

        .into_iter()

        .find(|r| r.tag == tag)

        .ok_or_else(|| not_found("no such release"))?;

    Ok(Json(r))

}

#[derive(Deserialize)]

struct AssetQuery {

    name: String,

}

/// `POST …/releases/{tag}/assets?name=file.tar.gz` with the file as the body.

async fn upload_asset(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, tag)): Path<(String, String, String)>,

    Query(q): Query<AssetQuery>,

    body: axum::body::Bytes,

) -> Result<(StatusCode, Json<Release>), ApiError> {

    let c = caller(&app, &headers).await?;

    c.require("repo:write")?;

    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;

    let r = db::releases::get(&app.db, row.id, &tag).await?.ok_or_else(|| not_found("no such release"))?;

    let ct = headers.get(axum::http::header::CONTENT_TYPE).and_then(|v| v.to_str().ok()).unwrap_or("application/octet-stream").to_string();

    crate::web::releases::store_asset(&app, r.id, &q.name, &ct, &body).await.map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;

    let r = crate::web::releases::api_views(&app, &repo, &row)

        .await?

        .into_iter()

        .find(|r| r.tag == tag)

        .ok_or_else(|| not_found("no such release"))?;

    Ok((StatusCode::CREATED, Json(r)))

}

pub struct ApiError(pub StatusCode, pub String);

impl IntoResponse for ApiError {

    fn into_response(self) -> Response {

        let body = Problem { status: self.0.as_u16(), title: self.0.canonical_reason().unwrap_or("error").into(), detail: self.1 };

        (self.0, [("content-type", "application/problem+json")], Json(body)).into_response()

    }

}

impl From<RepoError> for ApiError {

    fn from(e: RepoError) -> ApiError {

        match e {

            RepoError::NotFound => not_found("no such repository"),

            RepoError::Oxy(oxy_core::repo::RepoError::Msg(m)) => ApiError(StatusCode::NOT_FOUND, m),

            other => ApiError(StatusCode::INTERNAL_SERVER_ERROR, other.to_string()),

        }

    }

}

impl From<sqlx::Error> for ApiError {

    fn from(e: sqlx::Error) -> ApiError {

        ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string())

    }

}

pub(crate) fn not_found(what: &str) -> ApiError {

    ApiError(StatusCode::NOT_FOUND, what.into())

}

pub(crate) fn forbidden(what: &str) -> ApiError {

    ApiError(StatusCode::FORBIDDEN, what.into())

}

/// The address a request came from: the client's, as the proxy reports

/// it when the hub is behind one (`server.behind_proxy`), else the peer's.

/// Only an address's characters are kept, so it is safe to show.

pub fn client_addr(app: &Shared, headers: &HeaderMap, extensions: &axum::http::Extensions) -> String {

    let from_proxy = || {

        ["cf-connecting-ip", "x-forwarded-for", "x-real-ip"]

            .iter()

            .find_map(|h| headers.get(*h).and_then(|v| v.to_str().ok()).and_then(|v| v.split(',').next()).map(|v| v.trim().to_string()))

    };

    let addr = if app.config.server.behind_proxy {

        from_proxy()

    } else {

        extensions.get::<axum::extract::ConnectInfo<std::net::SocketAddr>>().map(|c| c.0.ip().to_string())

    };

    addr.map(|a| a.chars().filter(|c| c.is_ascii_hexdigit() || matches!(c, '.' | ':')).take(45).collect()).unwrap_or_default()

}

/// `DELETE /api/v1/user/token`: revoke the token this request is made

/// with, as `oxy auth logout` does.

async fn revoke_own_token(State(app): State<Shared>, headers: HeaderMap) -> Result<StatusCode, ApiError> {

    let c = caller(&app, &headers).await?;

    let (Some(account), Some(id)) = (c.account.as_ref(), c.token_id) else {

        return Err(ApiError(StatusCode::UNAUTHORIZED, "revoking needs the personal access token to revoke".into()));

    };

    db::accounts::delete_token(&app.db, account.id, id).await?;

    db::accounts::audit(&app.db, Some(account), "token.revoke", &c.token, "").await.ok();

    Ok(StatusCode::NO_CONTENT)

}

/// Who calls: the account behind a bearer token, with the token's scopes.

pub struct Caller {

    pub account: Option<Account>,

    pub scopes: Vec<String>,

    pub site: bool,

    /// The token's name, for records of what a call did.

    pub token: String,

    /// The personal access token's id, when one is used.

    pub token_id: Option<i64>,

    /// The token is an agent's (oxygenhub#183): what it does says so.

    pub agent: bool,

}

impl Caller {

    fn has(&self, scope: &str) -> bool {

        self.site

            || self.scopes.iter().any(|s| {

                s == scope

                    || (scope == "repo:read" && (s == "repo:write" || s == "repo:admin"))

                    || (scope == "repo:write" && s == "repo:admin")

            })

    }

    fn require(&self, scope: &str) -> Result<&Account, ApiError> {

        if !self.has(scope) {

            return Err(forbidden(&format!("this token lacks the {scope} scope")));

        }

        self.account.as_ref().ok_or_else(|| ApiError(StatusCode::UNAUTHORIZED, "a personal access token is required".into()))

    }

}

pub async fn caller(app: &Shared, headers: &HeaderMap) -> Result<Caller, ApiError> {

    let Some(t) = oxy_server::bearer_token(headers) else {

        return Ok(Caller { account: None, scopes: vec![], site: false, token: String::new(), token_id: None, agent: false });

    };

    if app.config.auth.push_tokens.iter().any(|x| auth::mac_equal(x, t)) {

        let admin = db::accounts::accounts(&app.db).await?.into_iter().find(|a| a.is_admin);

        return Ok(Caller {

            account: admin,

            scopes: vec!["repo:admin".into(), "user:read".into(), "checks:write".into()],

            site: true,

            token: "site token".into(),

            token_id: None,

            agent: false,

        });

    }

    // An agent's grant token (keyless agents, #241, #253): an agent's token

    // of its owner, reading, and writing when the grant lets its keys move

    // references, as it is for the protocol.

    if t.starts_with(crate::keyless::GRANT_TOKEN_PREFIX) {

        let grant = db::accounts::agent_grant_by_token(&app.db, &auth::token_hash(t)).await?.filter(|g| g.live(db::now_ms()));

        let Some(g) = grant else {

            return Err(ApiError(StatusCode::UNAUTHORIZED, "this agent grant is not valid (revoked, ended or unknown)".into()));

        };

        let account = db::accounts::account_by_id(&app.db, g.account_id).await?.filter(|a| !a.blocked());

        db::accounts::touch_agent_grant(&app.db, g.id).await.ok();

        let mut scopes = vec!["repo:read".to_string(), "user:read".to_string()];

        if g.scope.split(',').any(|s| s.trim() == "refs") {

            scopes.push("repo:write".into());

        }

        return Ok(Caller { account, scopes, site: false, token: g.agent.clone(), token_id: None, agent: true });

    }

    let token = db::accounts::token_by_hash(&app.db, &auth::token_hash(t)).await?;

    match token {

        Some(tok) if !tok.expired(db::now_ms()) => {

            let account = db::accounts::account_by_id(&app.db, tok.account_id).await?.filter(|a| !a.blocked());

            db::accounts::touch_token(&app.db, tok.id).await.ok();

            Ok(Caller {

                account,