//! Attachments over the API (oxygenhub#350): `POST
//! /api/v1/repos/{owner}/{name}/attachments?name=FILE` with the file's
//! bytes as the body. Anyone signed in who may read the repository and
//! write issues may attach; what comes back says how to show it.

use super::{caller, reach, ApiError};
use crate::auth::roles::Access;
use crate::db;
use crate::Shared;
use axum::body::Bytes;
use axum::extract::{Path, Query, State};
use axum::http::{HeaderMap, StatusCode};
use axum::Json;

/// The largest file one attachment may be.
pub const ATTACHMENT_MAX: usize = 25 << 20;

#[derive(serde::Deserialize)]
pub struct Named {
    name: String,
}

/// An image type a page may show, from the bytes; never what the uploader
/// said (an SVG or HTML file would run in the hub's origin).
pub fn image_type(bytes: &[u8]) -> Option<&'static str> {
    if bytes.starts_with(b"\x89PNG\r\n\x1a\n") {
        Some("image/png")
    } else if bytes.starts_with(&[0xFF, 0xD8, 0xFF]) {
        Some("image/jpeg")
    } else if bytes.starts_with(b"GIF87a") || bytes.starts_with(b"GIF89a") {
        Some("image/gif")
    } else if bytes.len() >= 12 && &bytes[..4] == b"RIFF" && &bytes[8..12] == b"WEBP" {
        Some("image/webp")
    } else {
        None
    }
}

/// A file name to keep: its last part, plain, not hidden.
pub fn file_name(name: &str) -> Option<String> {
    let base = name.rsplit(['/', '\\']).next().unwrap_or(name).trim();
    let clean: String = base.chars().filter(|c| !c.is_control() && !matches!(c, '"' | '<' | '>' | '`')).collect();
    (!clean.is_empty() && !clean.starts_with('.') && clean.len() <= 200).then_some(clean)
}

/// Percent-encode a path segment.
fn seg(s: &str) -> String {
    s.bytes()
        .map(|b| if b.is_ascii_alphanumeric() || b"-._~".contains(&b) { (b as char).to_string() } else { format!("%{b:02X}") })
        .collect()
}

pub async fn upload(
    State(app): State<Shared>,
    headers: HeaderMap,
    Path((owner, name)): Path<(String, String)>,
    Query(q): Query<Named>,
    body: Bytes,
) -> Result<(StatusCode, Json<hub_api::Attachment>), ApiError> {
    let c = caller(&app, &headers).await?;
    let me = c.require("issues:write").or_else(|_| c.require("repo:write"))?.clone();
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
    let Some(file) = file_name(&q.name) else {
        return Err(ApiError(
            StatusCode::UNPROCESSABLE_ENTITY,
            "give the file a name (?name=FILE): plain, not hidden, at most 200 bytes".into(),
        ));
    };
    if body.is_empty() {
        return Err(ApiError(StatusCode::UNPROCESSABLE_ENTITY, "the file is empty".into()));
    }
    if body.len() > ATTACHMENT_MAX {
        return Err(ApiError(StatusCode::PAYLOAD_TOO_LARGE, format!("an attachment is at most {} MiB", ATTACHMENT_MAX >> 20)));
    }
    let image = image_type(&body);
    let content_type = image.unwrap_or("application/octet-stream");
    let hash = hex::encode(blake3::hash(&body).as_bytes());
    let path = crate::web::releases::blob_path(&app, &hash);
    if !path.exists() {
        let parent = path.parent().expect("a blob is in a directory");
        tokio::fs::create_dir_all(parent).await.map_err(|e| ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
        let tmp = path.with_extension("partial");
        tokio::fs::write(&tmp, &body).await.map_err(|e| ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
        tokio::fs::rename(&tmp, &path).await.map_err(|e| ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
    }
    let a = db::attachments::add(&app.db, row.id, &file, body.len() as i64, &hash, content_type, Some(me.id)).await?;
    let url = format!("{}/{}/{}/attachments/{}/{}", app.config.base_url().trim_end_matches('/'), row.owner, row.name, a.id, seg(&file));
    let markdown = if image.is_some() { format!("![{file}]({url})") } else { format!("[{file}]({url})") };
    Ok((
        StatusCode::CREATED,
        Json(hub_api::Attachment {
            id: a.id,
            name: file,
            size: a.size,
            content_type: content_type.into(),
            inline: image.is_some(),
            url,
            markdown,
        }),
    ))
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn only_real_images_show_in_place() {
        assert_eq!(image_type(b"\x89PNG\r\n\x1a\n...."), Some("image/png"));
        assert_eq!(image_type(&[0xFF, 0xD8, 0xFF, 0xE0]), Some("image/jpeg"));
        assert_eq!(image_type(b"GIF89a.."), Some("image/gif"));
        assert_eq!(image_type(b"RIFF\0\0\0\0WEBPVP8 "), Some("image/webp"));
        assert_eq!(image_type(b"<svg xmlns=\"http://www.w3.org/2000/svg\"><script/></svg>"), None, "an SVG is a download");
        assert_eq!(image_type(b"<html><script>alert(1)</script>"), None);
    }

    #[test]
    fn file_names_are_kept_plain() {
        assert_eq!(file_name("C:\\Users\\a\\shot.png").as_deref(), Some("shot.png"));
        assert_eq!(file_name("../../etc/passwd").as_deref(), Some("passwd"));
        assert_eq!(file_name("a\"b<c>.txt").as_deref(), Some("abc.txt"));
        assert_eq!(file_name(".env"), None);
        assert_eq!(file_name("  "), None);
    }
}