//! Sign in with an external account (hub spec §5.1.2, oxygenhub#106):
//! GitLab (gitlab.com or a self-managed GitLab), GitHub and Google
//! through OAuth 2.0's authorization code flow, set up
//! by an administrator per provider (client id, a sealed secret, on or
//! off). A first sign-in links the provider's subject to the account with
//! the same verified email, or makes an account when registration is
//! open; later sign-ins find the link.

use crate::db::{accounts, now_ms, Pool};
use crate::Shared;
use sqlx::FromRow;

/// A provider the hub knows how to talk to.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct Provider {
    pub id: &'static str,
    pub name: &'static str,
    authorize: &'static str,
    token: &'static str,
    userinfo: &'static str,
    pub scope: &'static str,
    /// For a provider that can be self-hosted: the address used when the
    /// administrator gives none. Its endpoints are then paths under the
    /// address (oxygenhub#213).
    pub default_base: Option<&'static str>,
}

pub const PROVIDERS: [Provider; 3] = [
    // GitLab's OpenID Connect endpoints, the same on gitlab.com and on a
    // self-managed GitLab.
    Provider {
        id: "gitlab",
        name: "GitLab",
        authorize: "/oauth/authorize",
        token: "/oauth/token",
        userinfo: "/oauth/userinfo",
        scope: "openid profile email",
        default_base: Some("https://gitlab.com"),
    },
    Provider {
        id: "github",
        name: "GitHub",
        authorize: "https://github.com/login/oauth/authorize",
        token: "https://github.com/login/oauth/access_token",
        userinfo: "https://api.github.com/user",
        scope: "read:user user:email",
        default_base: None,
    },
    Provider {
        id: "google",
        name: "Google",
        authorize: "https://accounts.google.com/o/oauth2/v2/auth",
        token: "https://oauth2.googleapis.com/token",
        userinfo: "https://openidconnect.googleapis.com/v1/userinfo",
        scope: "openid email profile",
        default_base: None,
    },
];

pub fn provider(id: &str) -> Option<&'static Provider> {
    PROVIDERS.iter().find(|p| p.id == id)
}

impl Provider {
    /// The provider's endpoints, or a test double's when `[auth]
    /// signin_mock` names one: `{mock}/{id}/authorize|token|userinfo`.
    fn url(&self, app: &Shared, s: &Settings, which: &str) -> String {
        let path = match which {
            "authorize" => self.authorize,
            "token" => self.token,
            _ => self.userinfo,
        };
        match &app.config.auth.signin_mock {
            Some(base) => format!("{}/{}/{which}", base.trim_end_matches('/'), self.id),
            None => match self.default_base {
                Some(default) => format!("{}{path}", s.base_or(default)),
                None => path.to_string(),
            },
        }
    }

    /// Where the provider sends the person back.
    pub fn callback_url(&self, app: &Shared) -> String {
        format!("{}/login/{}/callback", app.config.base_url(), self.id)
    }
}

/// What an administrator set for a provider.
#[derive(Clone, Debug, Default)]
pub struct Settings {
    pub client_id: String,
    /// The client secret, opened; empty when none is set.
    pub secret: String,
    pub enabled: bool,
    /// A self-hostable provider's address (GitLab), empty for its default.
    pub base: String,
}

impl Settings {
    pub fn usable(&self) -> bool {
        self.enabled && !self.client_id.is_empty() && !self.secret.is_empty()
    }

    /// The address to use: the one set, else `default`.
    pub fn base_or<'a>(&'a self, default: &'a str) -> &'a str {
        let b = self.base.trim().trim_end_matches('/');
        if b.is_empty() {
            default
        } else {
            b
        }
    }
}

/// Whether `base` may be a self-hosted provider's address: https, a host,
/// nothing after it but an optional path prefix, no query.
pub fn valid_base(base: &str) -> bool {
    let Some(rest) = base.strip_prefix("https://") else { return false };
    let host = rest.split('/').next().unwrap_or("");
    !host.is_empty() && !rest.contains(['?', '#', ' ']) && host.contains('.')
}

fn key(id: &str, what: &str) -> String {
    format!("signin.{id}.{what}")
}

pub async fn settings(app: &Shared, id: &str) -> sqlx::Result<Settings> {
    let client_id = accounts::setting(&app.db, &key(id, "client_id")).await?.unwrap_or_default();
    let sealed = accounts::setting(&app.db, &key(id, "secret")).await?.unwrap_or_default();
    let secret = hex::decode(&sealed).ok().and_then(|b| app.secret_key.open(&b)).unwrap_or_default();
    let enabled = accounts::setting(&app.db, &key(id, "enabled")).await?.as_deref() == Some("1");
    let base = accounts::setting(&app.db, &key(id, "base")).await?.unwrap_or_default();
    Ok(Settings { client_id, secret, enabled, base })
}

/// Save a provider's settings; `secret` is `None` to keep the stored one.
pub async fn save(app: &Shared, id: &str, client_id: &str, secret: Option<&str>, enabled: bool, base: &str) -> sqlx::Result<()> {
    accounts::set_setting(&app.db, &key(id, "base"), base.trim().trim_end_matches('/')).await?;
    accounts::set_setting(&app.db, &key(id, "client_id"), client_id.trim()).await?;
    if let Some(s) = secret {
        accounts::set_setting(&app.db, &key(id, "secret"), &hex::encode(app.secret_key.seal(s.trim()))).await?;
    }
    accounts::set_setting(&app.db, &key(id, "enabled"), if enabled { "1" } else { "0" }).await?;
    Ok(())
}

/// The providers people may sign in with: usable ones, in order.
pub async fn enabled(app: &Shared) -> Vec<&'static Provider> {
    let mut out = vec![];
    for p in &PROVIDERS {
        if settings(app, p.id).await.map(|s| s.usable()).unwrap_or(false) {
            out.push(p);
        }
    }
    out
}

// ------------------------------------------------------------- the flow

/// The state cookie's name: a nonce, what the sign-in is for, and a MAC.
pub const STATE_COOKIE: &str = "oxyhub_signin";

/// A state value: `NONCE.MODE.MAC`, where MODE is `in` (sign in) or
/// `link:ACCOUNT_ID` (connect to a signed-in account).
pub fn state_value(app: &Shared, mode: &str) -> String {
    let nonce = crate::auth::random_hex(16);
    let mac = app.cookie_key.mac(format!("signin:{nonce}:{mode}").as_bytes());
    format!("{nonce}.{mode}.{mac}")
}

/// The mode a state value carries, when its MAC holds.
pub fn state_mode(app: &Shared, value: &str) -> Option<String> {
    let (nonce, rest) = value.split_once('.')?;
    let (mode, mac) = rest.rsplit_once('.')?;
    let want = app.cookie_key.mac(format!("signin:{nonce}:{mode}").as_bytes());
    crate::auth::mac_equal(&want, mac).then(|| mode.to_string())
}

/// Where to send the person to sign in with `p`.
pub fn authorize_url(app: &Shared, p: &Provider, s: &Settings, state: &str) -> String {
    let q = |s: &str| crate::web::settings::urlencode(s);
    format!(
        "{}?client_id={}&redirect_uri={}&scope={}&state={}&response_type=code{}",
        p.url(app, s, "authorize"),
        q(&s.client_id),
        q(&p.callback_url(app)),
        q(p.scope),
        q(state),
        if p.id == "google" { "&access_type=online&prompt=select_account" } else { "" }
    )
}

/// Who the provider says the person is.
#[derive(Clone, Debug)]
pub struct External {
    pub provider: &'static str,
    pub subject: String,
    pub login: String,
    pub name: String,
    /// A verified email, when the provider vouches for one.
    pub email: Option<String>,
}

/// Swap the code for a token and ask who it belongs to.
pub async fn identify(app: &Shared, p: &'static Provider, s: &Settings, code: &str) -> Result<External, String> {
    let client = reqwest::Client::builder()
        .timeout(std::time::Duration::from_secs(20))
        .user_agent(format!("oxygenhub/{}", env!("CARGO_PKG_VERSION")))
        .build()
        .map_err(|e| e.to_string())?;
    let token: serde_json::Value = client
        .post(p.url(app, s, "token"))
        .header("accept", "application/json")
        .form(&[
            ("client_id", s.client_id.as_str()),
            ("client_secret", s.secret.as_str()),
            ("code", code),
            ("redirect_uri", &p.callback_url(app)),
            ("grant_type", "authorization_code"),
        ])
        .send()
        .await
        .map_err(|e| format!("{} did not answer: {e}", p.name))?
        .json()
        .await
        .map_err(|_| format!("{} answered with something other than a token", p.name))?;
    let Some(access) = token["access_token"].as_str() else {
        let why = token["error_description"].as_str().or(token["error"].as_str()).unwrap_or("no token");
        return Err(format!("{} refused the sign-in: {why}", p.name));
    };
    let get = |url: String| {
        let client = client.clone();
        let access = access.to_string();
        async move {
            client
                .get(url)
                .bearer_auth(access)
                .header("accept", "application/json")
                .send()
                .await
                .map_err(|e| format!("{} did not answer: {e}", p.name))?
                .json::<serde_json::Value>()
                .await
                .map_err(|_| format!("{} answered with something unexpected", p.name))
        }
    };
    let user = get(p.url(app, s, "userinfo")).await?;
    Ok(match p.id {
        "github" => {
            let subject =
                user["id"].as_i64().map(|i| i.to_string()).or_else(|| user["id"].as_str().map(String::from)).ok_or("GitHub gave no id")?;
            // The primary verified address is on its own endpoint.
            let emails = get(format!("{}/emails", p.url(app, s, "userinfo"))).await.unwrap_or_default();
            let email = emails
                .as_array()
                .and_then(|list| {
                    list.iter()
                        .filter(|e| e["verified"] == true)
                        .max_by_key(|e| e["primary"] == true)
                        .and_then(|e| e["email"].as_str().map(String::from))
                })
                .or_else(|| user["email"].as_str().map(String::from).filter(|_| false));
            External {
                provider: p.id,
                subject,
                login: user["login"].as_str().unwrap_or("").to_string(),
                name: user["name"].as_str().unwrap_or("").to_string(),
                email,
            }
        }
        // GitLab's OpenID Connect userinfo: the subject is its user id, the
        // username is `nickname`.
        "gitlab" => {
            let subject = user["sub"]
                .as_str()
                .map(String::from)
                .or_else(|| user["sub"].as_i64().map(|i| i.to_string()))
                .ok_or("GitLab gave no subject")?;
            let email = user["email"].as_str().filter(|_| user["email_verified"] == true).map(String::from);
            let login = user["nickname"].as_str().or(user["preferred_username"].as_str()).unwrap_or("").to_string();
            External { provider: p.id, subject, login, name: user["name"].as_str().unwrap_or("").to_string(), email }
        }
        _ => {
            let subject = user["sub"].as_str().ok_or("Google gave no subject")?.to_string();
            let email = user["email"].as_str().filter(|_| user["email_verified"] == true).map(String::from);
            let login = email.as_deref().and_then(|e| e.split('@').next()).unwrap_or("").to_string();
            External { provider: p.id, subject, login, name: user["name"].as_str().unwrap_or("").to_string(), email }
        }
    })
}

// --------------------------------------------------------------- links

#[derive(Clone, Debug, FromRow)]
pub struct Login {
    pub provider: String,
    pub subject: String,
    pub account_id: i64,
    pub login: String,
    pub linked_ms: i64,
}

pub async fn linked_account(pool: &Pool, provider: &str, subject: &str) -> sqlx::Result<Option<accounts::Account>> {
    let id: Option<i64> = sqlx::query_scalar("SELECT account_id FROM account_logins WHERE provider = $1 AND subject = $2")
        .bind(provider)
        .bind(subject)
        .fetch_optional(pool)
        .await?;
    match id {
        Some(id) => accounts::account_by_id(pool, id).await,
        None => Ok(None),
    }
}

pub async fn link(pool: &Pool, provider: &str, subject: &str, account_id: i64, login: &str) -> sqlx::Result<()> {
    sqlx::query("INSERT INTO account_logins (provider, subject, account_id, login, linked_ms) VALUES ($1, $2, $3, $4, $5) ON CONFLICT (provider, subject) DO UPDATE SET account_id = excluded.account_id, login = excluded.login, linked_ms = excluded.linked_ms")
        .bind(provider)
        .bind(subject)
        .bind(account_id)
        .bind(login)
        .bind(now_ms())
        .execute(pool)
        .await?;
    Ok(())
}

pub async fn unlink(pool: &Pool, provider: &str, account_id: i64) -> sqlx::Result<bool> {
    let r = sqlx::query("DELETE FROM account_logins WHERE provider = $1 AND account_id = $2")
        .bind(provider)
        .bind(account_id)
        .execute(pool)
        .await?;
    Ok(r.rows_affected() > 0)
}

pub async fn links_of(pool: &Pool, account_id: i64) -> sqlx::Result<Vec<Login>> {
    sqlx::query_as("SELECT * FROM account_logins WHERE account_id = $1 ORDER BY provider").bind(account_id).fetch_all(pool).await
}

/// A username for a new account from what the provider calls them:
/// valid, and free.
pub async fn free_username(pool: &Pool, wanted: &str, provider: &str) -> sqlx::Result<String> {
    let base: String = wanted.chars().filter(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_')).take(40).collect();
    let base = base.trim_matches(|c: char| !c.is_ascii_alphanumeric()).to_string();
    let base = if base.is_empty() { provider.to_string() } else { base };
    let mut candidates = vec![base.clone(), format!("{base}-{provider}")];
    candidates.extend((2..100).map(|n| format!("{base}-{n}")));
    for c in candidates {
        if !crate::repos::names::valid_owner(&c) {
            continue;
        }
        let taken = accounts::account_by_name(pool, &c).await?.is_some()
            || accounts::org_by_name(pool, &c).await?.is_some()
            || accounts::username_retired(pool, &c).await?;
        if !taken {
            return Ok(c);
        }
    }
    Ok(format!("{provider}-{}", crate::auth::random_hex(4)))
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn providers_are_known() {
        assert_eq!(provider("github").map(|p| p.name), Some("GitHub"));
        assert_eq!(provider("google").map(|p| p.name), Some("Google"));
        assert_eq!(provider("gitlab").map(|p| (p.name, p.default_base)), Some(("GitLab", Some("https://gitlab.com"))));
        assert!(provider("bitbucket").is_none());
        // A self-managed GitLab's address (#213).
        assert!(valid_base("https://gitlab.example.org") && valid_base("https://code.example.org/gitlab"));
        assert!(
            !valid_base("http://gitlab.example.org")
                && !valid_base("https://")
                && !valid_base("https://gitlab.example.org/?x=1")
                && !valid_base("https://localhost")
        );
        let s = Settings { base: "https://gitlab.example.org/".into(), ..Settings::default() };
        assert_eq!(s.base_or("https://gitlab.com"), "https://gitlab.example.org");
        assert_eq!(Settings::default().base_or("https://gitlab.com"), "https://gitlab.com");
    }
}