//! Sign in with GitHub or Google on the web (hub spec §5.1.2, #106):

//! the start of the flow, the callback, the administrator's provider

//! settings, and connecting or disconnecting a provider from Settings ›

//! Security.

use super::session::signed_in;

use super::settings::{csrf, require};

use super::{Error, Shell};

use crate::auth::{self, Viewer};

use crate::db::accounts;

use crate::signin::{self, External, Provider, STATE_COOKIE};

use crate::Shared;

use axum::extract::{Path, Query, State};

use axum::http::{header, HeaderMap};

use axum::response::{IntoResponse, Redirect, Response};

use axum::Form;

use serde::Deserialize;

fn state_cookie(app: &Shared, value: &str, max_age: u32) -> String {

    let secure = if app.config.base_url().starts_with("https://") { "; Secure" } else { "" };

    format!("{STATE_COOKIE}={value}; Path=/login; HttpOnly; SameSite=Lax; Max-Age={max_age}{secure}")

}

fn cookie_value(headers: &HeaderMap) -> Option<String> {

    headers

        .get_all(header::COOKIE)

        .iter()

        .filter_map(|v| v.to_str().ok())

        .flat_map(|v| v.split(';'))

        .filter_map(|c| c.trim().strip_prefix(&format!("{STATE_COOKIE}=")))

        .map(String::from)

        .next()

}

/// Begin: a state cookie, then off to the provider.

async fn begin(app: &Shared, p: &'static Provider, mode: &str) -> Result<Response, String> {

    let s = signin::settings(app, p.id).await.map_err(|e| e.to_string())?;

    if !s.usable() {

        return Err(format!("Signing in with {} is not set up on this hub.", p.name));

    }

    let state = signin::state_value(app, mode);

    let to = signin::authorize_url(app, p, &s, &state);

    Ok(([(header::SET_COOKIE, state_cookie(app, &state, 600))], Redirect::to(&to)).into_response())

}

#[derive(Deserialize)]

pub struct StartQuery {

    #[serde(default)]

    invite: String,

}

/// An invitation code as it may ride in the signed state: letters and

/// digits only (the state's parts are separated by dots).

pub fn invite_code_ok(code: &str) -> bool {

    !code.is_empty() && code.len() <= 64 && code.chars().all(|c| c.is_ascii_alphanumeric())

}

/// `GET /login/{provider}`: sign in with the provider; with `?invite=`,

/// sign up with it through that invitation (oxygenhub#214), which rides

/// through the round trip in the signed state.

pub async fn start(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(id): Path<String>,

    Query(q): Query<StartQuery>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/login", &viewer);

    let p = signin::provider(&id).ok_or_else(|| Error::not_found(shell.clone()))?;

    if viewer.signed_in() {

        return Ok(Redirect::to("/").into_response());

    }

    let invite = q.invite.trim();

    if invite.is_empty() {

        return begin(&app, p, "in").await.map_err(|m| Error::bad(shell.clone(), m));

    }

    let unused =

        invite_code_ok(invite) && accounts::invitation_unused(&app.db, invite).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    if !unused {

        return Err(Error::bad(shell, "That invitation has been used or does not exist. Ask whoever invited you for a new one."));

    }

    begin(&app, p, &format!("invite:{invite}")).await.map_err(|m| Error::bad(shell.clone(), m))

}

/// `GET /settings/security/connect/{provider}`: link the provider to the

/// signed-in account.

pub async fn connect(State(app): State<Shared>, viewer: Viewer, Path(id): Path<String>) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/settings/security", &viewer);

    let me = require(&viewer, &shell)?;

    let p = signin::provider(&id).ok_or_else(|| Error::not_found(shell.clone()))?;

    begin(&app, p, &format!("link:{}", me.account.id)).await.map_err(|m| Error::bad(shell.clone(), m))

}

#[derive(Deserialize)]

pub struct Callback {

    #[serde(default)]

    code: String,

    #[serde(default)]

    state: String,

    #[serde(default)]

    error: String,

    #[serde(default)]

    error_description: String,

}

fn to_login(msg: &str) -> Response {

    Redirect::to(&format!("/login?error={}", super::settings::urlencode(msg))).into_response()

}

fn to_security(msg: &str, ok: bool) -> Response {

    let k = if ok { "notice" } else { "error" };

    Redirect::to(&format!("/settings/security?{k}={}", super::settings::urlencode(msg))).into_response()

}

/// `GET /login/{provider}/callback`: the provider sent the person back.

pub async fn callback(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(id): Path<String>,

    headers: HeaderMap,

    Query(q): Query<Callback>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/login", &viewer);

    let p = signin::provider(&id).ok_or_else(|| Error::not_found(shell.clone()))?;

    // The state cookie goes, whatever else the answer sets (appended, so a

    // session cookie beside it is kept).

    let clear = state_cookie(&app, "", 0);

    let with_clear = |mut r: Response| {

        if let Ok(v) = header::HeaderValue::from_str(&clear) {

            r.headers_mut().append(header::SET_COOKIE, v);

        }

        r

    };

    if !q.error.is_empty() {

        let why = if q.error_description.is_empty() { q.error.clone() } else { q.error_description.clone() };

        return Ok(with_clear(to_login(&format!("{} did not sign you in: {why}", p.name))));

    }

    let Some(cookie) = cookie_value(&headers) else {

        return Ok(with_clear(to_login("The sign-in took too long or the browser kept no cookie; try again.")));

    };

    if cookie != q.state || q.code.is_empty() {

        return Ok(with_clear(to_login("The sign-in did not match the one started here; try again.")));

    }

    let Some(mode) = signin::state_mode(&app, &cookie) else {

        return Ok(with_clear(to_login("The sign-in did not match the one started here; try again.")));

    };

    let s = signin::settings(&app, p.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    if !s.usable() {

        return Ok(with_clear(to_login(&format!("Signing in with {} is not set up on this hub.", p.name))));

    }

    let who = match signin::identify(&app, p, &s, &q.code).await {

        Ok(w) => w,

        Err(msg) => return Ok(with_clear(to_login(&msg))),

    };

    let e = |e| Error::from_db(shell.clone(), e);

    // Connecting to a signed-in account.

    if let Some(account_id) = mode.strip_prefix("link:").and_then(|i| i.parse::<i64>().ok()) {

        let Some(me) = viewer.account().filter(|a| a.id == account_id) else {

            return Ok(with_clear(to_security("Sign in first, then connect the account.", false)));

        };

        if let Some(other) = signin::linked_account(&app.db, p.id, &who.subject).await.map_err(e)? {

            if other.id != me.id {

                return Ok(with_clear(to_security(&format!("That {} account is connected to {} already.", p.name, other.username), false)));

            }

        }

        signin::link(&app.db, p.id, &who.subject, me.id, &who.login).await.map_err(e)?;

        accounts::audit(&app.db, Some(me), "signin.connected", &me.username, p.id).await.ok();

        return Ok(with_clear(to_security(&format!("{} connected as {}.", p.name, who.login), true)));

    }

    // Signing in: a known link, else the account with that verified email,

    // else a new account when registration is open.

    if let Some(account) = signin::linked_account(&app.db, p.id, &who.subject).await.map_err(e)? {

        if account.blocked() {

            return Ok(with_clear(to_login("This account cannot sign in.")));

        }

        accounts::audit(&app.db, Some(&account), "login", &account.username, p.id).await.ok();

        return Ok(with_clear(signed_in(&app, &account, "/").await));

    }

    if let Some(email) = &who.email {

        if let Some(account) = accounts::account_by_verified_email(&app.db, email).await.map_err(e)? {

            if account.blocked() {

                return Ok(with_clear(to_login("This account cannot sign in.")));

            }

            signin::link(&app.db, p.id, &who.subject, account.id, &who.login).await.map_err(e)?;

            accounts::audit(&app.db, Some(&account), "signin.connected", &account.username, &format!("{} by email", p.id)).await.ok();

            accounts::audit(&app.db, Some(&account), "login", &account.username, p.id).await.ok();

            return Ok(with_clear(signed_in(&app, &account, "/").await));

        }

    }

    // A new account: when registration is open, or by invitation with an

    // invitation that came through the round trip and is still unused.

    let registration = super::session::registration_mode(&app).await;

    let invite = mode.strip_prefix("invite:").filter(|c| invite_code_ok(c));

    let allowed = match registration.as_str() {

        "open" => true,

        "invite" => invite.is_some(),

        _ => false,

    };

    if !allowed {

        return Ok(with_clear(to_login(&format!(

            "No account here is connected to that {} account, and registration is {}. Register or sign in first, then connect it under Settings › Security.",

            p.name,

            if registration == "invite" { "by invitation" } else { "closed" }

        ))));

    }

    let by_invitation = (registration == "invite").then_some(invite).flatten();

    if let Some(code) = by_invitation {

        if !accounts::invitation_unused(&app.db, code).await.map_err(e)? {

            return Ok(with_clear(to_login("That invitation was used meanwhile. Ask whoever invited you for a new one.")));

        }

    }

    let account = register(&app, p, &who).await.map_err(e)?;

    if let Some(code) = by_invitation {

        if !accounts::claim_invitation(&app.db, code, account.id).await.map_err(e)? {

            tracing::warn!("invitation {code} was used by someone else while {} signed up", account.username);

        }

    }

    Ok(with_clear(signed_in(&app, &account, "/").await))

}

/// A new account for someone the provider vouches for: a username from

/// their login there, an unusable password, the email verified when the

/// provider says so.

async fn register(app: &Shared, p: &Provider, who: &External) -> sqlx::Result<accounts::Account> {

    let username = signin::free_username(&app.db, &who.login, p.id).await?;

    let hash = auth::hash_password(&auth::random_hex(24)).unwrap_or_default();

    let first = accounts::account_count(&app.db).await? == 0;

    // The first account brings the setup code (oxygenhub#245): never one a

    // sign-in provider vouches for.

    if first {

        return Err(sqlx::Error::Protocol("this hub has no administrator yet: register the first account with its setup code".into()));

    }

    let account =

        accounts::create_account(&app.db, &username, who.email.as_deref().unwrap_or(""), &hash, &auth::random_hex(16), first).await?;

    if who.email.is_some() {

        accounts::set_email_verified(&app.db, account.id, true).await?;

    }

    if !who.name.is_empty() {

        accounts::set_profile(&app.db, account.id, &who.name, who.email.as_deref().unwrap_or("")).await?;

        if who.email.is_some() {

            accounts::set_email_verified(&app.db, account.id, true).await?;

        }

    }

    signin::link(&app.db, p.id, &who.subject, account.id, &who.login).await?;

    accounts::audit(&app.db, Some(&account), "register", &username, &format!("with {}", p.id)).await.ok();

    accounts::account_by_id(&app.db, account.id).await.map(|a| a.unwrap_or(account))

}

#[derive(Deserialize)]

pub struct DisconnectForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

}

/// `POST /settings/security/disconnect/{provider}`.

pub async fn disconnect(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(id): Path<String>,

    Form(f): Form<DisconnectForm>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/settings/security", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let p = signin::provider(&id).ok_or_else(|| Error::not_found(shell.clone()))?;

    if signin::unlink(&app.db, p.id, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))? {

        accounts::audit(&app.db, Some(&me.account), "signin.disconnected", &me.account.username, p.id).await.ok();

    }

    Ok(to_security(&format!("{} disconnected.", p.name), true))

}

/// A provider as the admin page shows it.

pub struct ProviderView {

    pub id: &'static str,

    pub name: &'static str,

    pub client_id: String,

    pub has_secret: bool,

    pub enabled: bool,

    pub callback: String,

    /// For a self-hostable provider: its default address and the one set.

    pub default_base: Option<&'static str>,

    pub base: String,

}

pub async fn provider_views(app: &Shared) -> sqlx::Result<Vec<ProviderView>> {

    let mut out = vec![];

    for p in &signin::PROVIDERS {

        let s = signin::settings(app, p.id).await?;

        out.push(ProviderView {

            id: p.id,

            name: p.name,

            client_id: s.client_id,

            has_secret: !s.secret.is_empty(),

            enabled: s.enabled,

            callback: p.callback_url(app),

            default_base: p.default_base,

            base: s.base,

        });

    }

    Ok(out)

}

#[derive(Deserialize)]

pub struct ProviderForm {

    #[serde(rename = "_csrf")]

    pub csrf_token: String,

    pub provider: String,

    #[serde(default)]

    pub client_id: String,

    #[serde(default)]

    pub secret: String,

    #[serde(default)]

    pub enabled: Option<String>,

    /// A self-hostable provider's address (GitLab); empty for its default.

    #[serde(default)]

    pub base: String,

}

/// Apply the admin form: `Ok(notice)` or `Err(message)`.

pub async fn apply(app: &Shared, viewer: &Viewer, f: ProviderForm) -> sqlx::Result<Result<String, String>> {

    let Some(p) = signin::provider(&f.provider) else { return Ok(Err("Unknown provider.".into())) };

    let client_id = f.client_id.trim();

    if client_id.len() > 200 || client_id.contains(char::is_whitespace) && !client_id.is_empty() {

        return Ok(Err("A client id is one token.".into()));

    }

    let secret = f.secret.trim();

    let secret = if secret.is_empty() { None } else { Some(secret) };

    let enabled = f.enabled.is_some();

    let base = f.base.trim().trim_end_matches('/');

    if p.default_base.is_none() && !base.is_empty() {

        return Ok(Err(format!("{} has no address to set.", p.name)));

    }

    if !base.is_empty() && !signin::valid_base(base) {

        return Ok(Err(format!("The {} address is an https:// address, like https://gitlab.example.org.", p.name)));

    }

    signin::save(app, p.id, client_id, secret, enabled, base).await?;

    let s = signin::settings(app, p.id).await?;

    accounts::audit(&app.db, viewer.account(), "admin.signin", p.id, if s.usable() { "on" } else { "off" }).await.ok();

    Ok(Ok(if s.usable() {

        format!("Signing in with {} is on.", p.name)

    } else if enabled {

        format!("{} is saved but off until it has a client id and secret.", p.name)

    } else {

        format!("{} is off.", p.name)

    }))

}

/// A page's view of what people may sign in with.

pub async fn buttons(app: &Shared) -> Vec<(&'static str, &'static str)> {

    signin::enabled(app).await.into_iter().map(|p| (p.id, p.name)).collect()

}