//! Terraform and OpenTofu state, kept by the hub per repository

//! (oxygenhub#252): the HTTP backend Terraform and OpenTofu speak, with

//! locking, at `/api/v1/repos/OWNER/NAME/terraform/state/STATE`, so a Flow

//! job keeps its state without any cloud credential. A job authenticates

//! with an identity token of this hub's for the audience `{base}/terraform`

//! (its pipeline's `identity` block) or its runner's job token, either for

//! its own repository only; people with a token of theirs and their

//! repository role. Tokens go as the bearer, or as the password of Basic

//! auth, which is what the backend sends.

//!

//! State is kept outside the repository's history (it often holds secrets),

//! sealed at rest with the hub's secrets key, and its last versions are

//! kept, so a bad apply can be rolled back: a kept version is restored as a

//! new one (#255), so nothing is lost and going forward again is restoring

//! a newer one.

use crate::api::ApiError;

use crate::auth::roles::{Access, Role};

use crate::{db, Shared};

use axum::body::Bytes;

use axum::extract::{Path, Query, State};

use axum::http::{header, HeaderMap, Method, StatusCode};

use axum::response::{IntoResponse, Response};

/// Versions of a state kept besides the current one.

pub const VERSIONS_KEPT: i64 = 20;

/// The most a state may weigh.

pub const MAX_STATE_BYTES: usize = 32 << 20;

/// Who may use a repository's states.

enum Who {

    /// A running job of this repository.

    Job { name: String },

    /// A person, with their role on the repository.

    Person { account: Box<db::accounts::Account>, role: Role },

}

impl Who {

    fn label(&self) -> String {

        match self {

            Who::Job { name } => name.clone(),

            Who::Person { account, .. } => account.username.clone(),

        }

    }

    fn may(&self, access: Access) -> bool {

        match self {

            // A job reads and writes its own repository's states.

            Who::Job { .. } => true,

            Who::Person { role, .. } => crate::auth::roles::allows(Some(*role), access),

        }

    }

}

fn err(status: StatusCode, why: impl Into<String>) -> ApiError {

    ApiError(status, why.into())

}

/// The token a request carries: the bearer, or Basic auth's password.

fn token_of(headers: &HeaderMap) -> Option<String> {

    if let Some(t) = oxy_server::bearer_token(headers) {

        return Some(t.to_string());

    }

    let v = headers.get(header::AUTHORIZATION)?.to_str().ok()?;

    let b64 = v.strip_prefix("Basic ").or_else(|| v.strip_prefix("basic "))?;

    let raw = String::from_utf8(oxy_core::dsse::base64_decode(b64.trim())?).ok()?;

    let (_, password) = raw.split_once(':')?;

    (!password.is_empty()).then(|| password.to_string())

}

/// The audience a job's identity token needs here.

pub fn audience(base_url: &str) -> String {

    format!("{}/terraform", base_url.trim_end_matches('/'))

}

fn valid_name(name: &str) -> bool {

    !name.is_empty()

        && name.len() <= 100

        && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')

        && !name.starts_with('.')

}

async fn who(app: &Shared, headers: &HeaderMap, row: &db::repos::RepoRow) -> Result<Who, ApiError> {

    let token = token_of(headers).ok_or_else(|| {

        err(StatusCode::UNAUTHORIZED, "a Terraform state needs a token: a job's (TF_HTTP_PASSWORD), or one of yours with repo:write")

    })?;

    let hash = crate::auth::token_hash(&token);

    if token.starts_with(crate::flow::JOB_TOKEN_PREFIX) {

        let job = db::flow::job_by_token(&app.db, &hash, crate::flow::JOB_TOKEN_MAX_AGE_MS)

            .await

            .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

            .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "this job token is not valid (the job must be running)"))?;

        let run = db::flow::run_by_id(&app.db, job.run_id)

            .await

            .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

            .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "this job token is not valid"))?;

        if run.repo_id != row.id {

            return Err(err(StatusCode::FORBIDDEN, "a job keeps the states of its own repository only"));

        }

        return Ok(Who::Job { name: format!("run #{} {}", run.number, job.name) });

    }

    let personal = db::accounts::token_by_hash(&app.db, &hash).await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    let Some(token) = personal.filter(|t| !t.expired(db::now_ms())) else {

        // A job's identity token for this hub's Terraform audience.

        let issuer = app.oidc().await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

        let aud = audience(app.config.base_url());

        let Some(claims) = issuer.verify(&token, &aud, db::now_ms()) else {

            return Err(err(StatusCode::UNAUTHORIZED, format!("unknown or expired token (a job's identity token must be for {aud})")));

        };

        let sub = claims["sub"].as_str().unwrap_or("");

        let repo = claims["repository"]

            .as_str()

            .map(String::from)

            .or_else(|| sub.strip_prefix("repo:").and_then(|r| r.split_once(":bookmark:")).map(|(r, _)| r.to_string()));

        if repo.as_deref() != Some(row.slug().as_str()) {

            return Err(err(StatusCode::FORBIDDEN, "a job keeps the states of its own repository only"));

        }

        return Ok(Who::Job { name: sub.to_string() });

    };

    if !(token.has_scope("repo:write") || token.has_scope("repo:admin")) {

        return Err(err(

            StatusCode::FORBIDDEN,

            "the token lacks repo:write: a Terraform state, read or written, needs it (states hold secrets)",

        ));

    }

    let slug = row.slug();

    if !token.covers(&slug) {

        return Err(err(StatusCode::FORBIDDEN, format!("the token does not cover {slug}")));

    }

    let account = db::accounts::account_by_id(&app.db, token.account_id)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .filter(|a| !a.banned && !a.disabled)

        .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "unknown token"))?;

    let role = crate::auth::roles::role_for(&app.db, Some(&account), row)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    match role {

        Some(r) if crate::auth::roles::allows(Some(r), Access::Read) => Ok(Who::Person { account: Box::new(account), role: r }),

        _ => Err(err(StatusCode::NOT_FOUND, "no such repository")),

    }

}

#[derive(serde::Deserialize, Default)]

pub struct LockQuery {

    #[serde(rename = "ID", default)]

    id: Option<String>,

}

fn json(status: StatusCode, body: String) -> Response {

    (status, [(header::CONTENT_TYPE, "application/json")], body).into_response()

}

/// The lock's ID in a lock-info body (`{"ID": …}`).

fn lock_id(info: &[u8]) -> Option<String> {

    serde_json::from_slice::<serde_json::Value>(info).ok()?.get("ID")?.as_str().map(String::from)

}

/// Why a restore did not happen.

pub enum RestoreError {

    /// No such version of that state.

    NotFound,

    /// Someone holds the state's lock: who.

    Locked(String),

    /// The kept body does not open or is not JSON.

    Broken,

    Db(sqlx::Error),

}

impl RestoreError {

    pub fn message(&self) -> String {

        match self {

            RestoreError::NotFound => "no such version of this state".into(),

            RestoreError::Locked(by) => format!("the state is locked by {by}: restore it once the lock is released"),

            RestoreError::Broken => "that version does not open: it cannot be restored".into(),

            RestoreError::Db(e) => e.to_string(),

        }

    }

    fn status(&self) -> StatusCode {

        match self {

            RestoreError::NotFound => StatusCode::NOT_FOUND,

            RestoreError::Locked(_) => StatusCode::LOCKED,

            RestoreError::Broken | RestoreError::Db(_) => StatusCode::INTERNAL_SERVER_ERROR,

        }

    }

}

/// Restore kept version `id` of a state (#255): written as a new version

/// whose serial is above the current one (OpenTofu and Terraform take a

/// state only forward), so the state it replaces is kept as a version too.

/// Refused while the state is locked. The new serial.

pub async fn restore(app: &Shared, repo_id: i64, state: &str, id: i64, by: &str) -> Result<i64, RestoreError> {

    let current = db::terraform::get(&app.db, repo_id, state).await.map_err(RestoreError::Db)?;

    if let Some(l) = current.as_ref().filter(|s| !s.lock_id.is_empty()) {

        return Err(RestoreError::Locked(l.locked_by.clone()));

    }

    let (body, old_serial) =

        db::terraform::version_body(&app.db, repo_id, state, id).await.map_err(RestoreError::Db)?.ok_or(RestoreError::NotFound)?;

    let plain = app.secret_key.open(&body).ok_or(RestoreError::Broken)?;

    let mut json: serde_json::Value = serde_json::from_str(&plain).map_err(|_| RestoreError::Broken)?;

    let serial = current.map_or(0, |c| c.serial).max(old_serial) + 1;

    json["serial"] = serial.into();

    let text = serde_json::to_string_pretty(&json).map_err(|_| RestoreError::Broken)?;

    let label = format!("{by}, restoring serial {old_serial}");

    db::terraform::put(&app.db, repo_id, state, &app.secret_key.seal(&text), serial, &label, VERSIONS_KEPT)

        .await

        .map_err(RestoreError::Db)?;

    Ok(serial)

}

/// `GET /api/v1/repos/{owner}/{name}/terraform/state/{state}/versions`:

/// the state's kept versions, newest first (#255).

pub async fn versions(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, state)): Path<(String, String, String)>,

) -> Result<Response, ApiError> {

    let (row, _who) = versions_caller(&app, &headers, &owner, &name, &state, Access::Write).await?;

    let list =

        db::terraform::version_list(&app.db, row.id, &state).await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    let out: Vec<serde_json::Value> = list

        .iter()

        .map(|v| serde_json::json!({ "id": v.id, "serial": v.serial, "written_by": v.created_by, "written_ms": v.created_ms }))

        .collect();

    Ok(json(StatusCode::OK, serde_json::Value::Array(out).to_string()))

}

/// `GET …/terraform/state/{state}/versions/{id}`: one kept version's state.

pub async fn version(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, state, id)): Path<(String, String, String, i64)>,

) -> Result<Response, ApiError> {

    let (row, _who) = versions_caller(&app, &headers, &owner, &name, &state, Access::Write).await?;

    let (body, _) = db::terraform::version_body(&app.db, row.id, &state, id)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such version of this state"))?;

    let plain = app.secret_key.open(&body).ok_or_else(|| err(StatusCode::INTERNAL_SERVER_ERROR, "the version does not open"))?;

    Ok(json(StatusCode::OK, plain))

}

/// `POST …/terraform/state/{state}/versions/{id}/restore`: restore a kept

/// version, by a person with the maintain role (never a job), audited.

pub async fn restore_version(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, state, id)): Path<(String, String, String, i64)>,

) -> Result<Response, ApiError> {

    let (row, who) = versions_caller(&app, &headers, &owner, &name, &state, Access::Maintain).await?;

    let Who::Person { account, .. } = &who else {

        return Err(err(StatusCode::FORBIDDEN, "a job does not restore a state: a person with the maintain role does"));

    };

    let serial = restore(&app, row.id, &state, id, &account.username).await.map_err(|e| err(e.status(), e.message()))?;

    db::accounts::audit(

        &app.db,

        Some(account),

        "terraform.restored",

        &format!("{}:{state}", row.slug()),

        &format!("version {id}, now serial {serial}"),

    )

    .await

    .ok();

    Ok(json(StatusCode::OK, serde_json::json!({ "serial": serial }).to_string()))

}

/// The repository and the caller of a versions endpoint, allowed `access`.

async fn versions_caller(

    app: &Shared,

    headers: &HeaderMap,

    owner: &str,

    name: &str,

    state: &str,

    access: Access,

) -> Result<(db::repos::RepoRow, Who), ApiError> {

    if !valid_name(state) {

        return Err(err(StatusCode::BAD_REQUEST, "a state's name is letters, digits, '-', '_' and '.', up to 100"));

    }

    let row = db::repos::get(&app.db, owner, name)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such repository"))?;

    let who = who(app, headers, &row).await?;

    if !who.may(access) {

        return Err(err(

            StatusCode::FORBIDDEN,

            if access == Access::Maintain { "restoring a state needs the maintain role" } else { "a Terraform state needs the write role" },

        ));

    }

    Ok((row, who))

}

/// `GET|POST|DELETE|LOCK|UNLOCK /api/v1/repos/{owner}/{name}/terraform/state/{state}`.

pub async fn state(

    State(app): State<Shared>,

    method: Method,

    headers: HeaderMap,

    Path((owner, name, state)): Path<(String, String, String)>,

    Query(q): Query<LockQuery>,

    body: Bytes,

) -> Result<Response, ApiError> {

    if !valid_name(&state) {

        return Err(err(StatusCode::BAD_REQUEST, "a state's name is letters, digits, '-', '_' and '.', up to 100"));

    }

    let row = db::repos::get(&app.db, &owner, &name)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such repository"))?;

    let who = who(&app, &headers, &row).await?;

    // Reading a state needs the write role too: states hold secrets, and

    // every account reads a public or internal repository (#256).

    if !who.may(Access::Write) {

        return Err(err(StatusCode::FORBIDDEN, "a Terraform state needs the write role on its repository: states hold secrets"));

    }

    let db_err = |e: sqlx::Error| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string());

    let current = db::terraform::get(&app.db, row.id, &state).await.map_err(db_err)?;

    let locked = current.as_ref().filter(|s| !s.lock_id.is_empty());

    match method.as_str() {

        "GET" => match current.filter(|s| !s.body.is_empty()) {

            Some(s) => {

                let plain =

                    app.secret_key.open(&s.body).ok_or_else(|| err(StatusCode::INTERNAL_SERVER_ERROR, "the state does not open"))?;

                Ok(json(StatusCode::OK, plain))

            }

            // No state yet: Terraform starts afresh.

            None => Ok(StatusCode::NO_CONTENT.into_response()),

        },

        "POST" => {

            if body.len() > MAX_STATE_BYTES {

                return Err(err(StatusCode::PAYLOAD_TOO_LARGE, format!("a state may be {} MiB at most", MAX_STATE_BYTES >> 20)));

            }

            let text = std::str::from_utf8(&body).map_err(|_| err(StatusCode::BAD_REQUEST, "a state is JSON"))?;

            let parsed: serde_json::Value = serde_json::from_str(text).map_err(|_| err(StatusCode::BAD_REQUEST, "a state is JSON"))?;

            if let Some(l) = locked {

                if q.id.as_deref() != Some(l.lock_id.as_str()) {

                    return Ok(json(StatusCode::LOCKED, l.lock_info.clone()));

                }

            }

            let serial = parsed.get("serial").and_then(|v| v.as_i64()).unwrap_or(0);

            let sealed = app.secret_key.seal(text);

            db::terraform::put(&app.db, row.id, &state, &sealed, serial, &who.label(), VERSIONS_KEPT).await.map_err(db_err)?;

            Ok(StatusCode::OK.into_response())

        }

        "DELETE" => {

            if let Some(l) = locked {

                if q.id.as_deref() != Some(l.lock_id.as_str()) {

                    return Ok(json(StatusCode::LOCKED, l.lock_info.clone()));

                }

            }

            db::terraform::delete(&app.db, row.id, &state).await.map_err(db_err)?;

            Ok(StatusCode::OK.into_response())

        }

        "LOCK" => {

            let info = std::str::from_utf8(&body).unwrap_or("");

            let Some(id) = lock_id(body.as_ref()) else {

                return Err(err(StatusCode::BAD_REQUEST, "a lock request is the lock's JSON, with its ID"));

            };

            if let Some(l) = locked {

                return Ok(json(if l.lock_id == id { StatusCode::OK } else { StatusCode::LOCKED }, l.lock_info.clone()));

            }

            if db::terraform::lock(&app.db, row.id, &state, &id, info, &who.label()).await.map_err(db_err)? {

                Ok(json(StatusCode::OK, info.to_string()))

            } else {

                // Taken meanwhile.

                let now = db::terraform::get(&app.db, row.id, &state).await.map_err(db_err)?;

                Ok(json(StatusCode::LOCKED, now.map(|s| s.lock_info).unwrap_or_default()))

            }

        }

        "UNLOCK" => {

            let Some(l) = locked else { return Ok(StatusCode::OK.into_response()) };

            // `terraform force-unlock` sends the ID; a plain unlock its lock info.

            let id = lock_id(body.as_ref()).or(q.id.clone());

            if id.as_deref() != Some(l.lock_id.as_str()) {

                return Ok(json(StatusCode::CONFLICT, l.lock_info.clone()));

            }

            db::terraform::unlock(&app.db, row.id, &state).await.map_err(db_err)?;

            Ok(StatusCode::OK.into_response())

        }

        other => {

            Err(err(StatusCode::METHOD_NOT_ALLOWED, format!("{other} is not a Terraform backend method (GET, POST, DELETE, LOCK, UNLOCK)")))

        }

    }

}