//! Account settings (hub spec §6.3 `/settings/*`): profile, security,

//! linked identities, tokens.

use super::{filters, Error, Page, Shell};

use crate::auth::{self, totp, Viewer, ViewerAccount};

use crate::db::{self, accounts};

use crate::Shared;

use askama::Template;

use axum::extract::{Form, Multipart, Path, Query, State};

use axum::http::{header, HeaderMap, StatusCode};

use axum::response::{IntoResponse, Redirect, Response};

use oxy_core::identity::{Identity, Signature};

use serde::Deserialize;

/// The signed-in account, or a redirect to sign in.

pub fn require(viewer: &Viewer, shell: &Shell) -> Result<ViewerAccount, Error> {

    viewer.0.clone().ok_or_else(|| Error::redirect(format!("/login?next={}", urlencode(&shell.path))))

}

pub fn urlencode(s: &str) -> String {

    let mut out = String::new();

    for b in s.bytes() {

        match b {

            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' | b'/' => out.push(b as char),

            _ => out.push_str(&format!("%{b:02X}")),

        }

    }

    out

}

pub fn csrf(viewer: &Viewer, token: &str, shell: &Shell) -> Result<(), Error> {

    if viewer.csrf_ok(token) {

        Ok(())

    } else {

        Err(Error::bad(shell.clone(), "This form has expired; reload the page and try again."))

    }

}

#[derive(Template)]

#[template(path = "settings.html")]

pub struct SettingsPage {

    shell: Shell,

    me: accounts::Account,

    notice: Option<String>,

    error: Option<String>,

    /// The theme cookie's value, for the Appearance form.

    theme: &'static str,

    themes: &'static [(&'static str, &'static str)],

    /// The backdrop cookie's value and the choices (docs/backgrounds.md §7).

    backdrop: &'static str,

    backdrops: &'static [(&'static str, &'static str)],

    /// Whether the hub sends mail, for the "send a new link" button.

    mail: bool,

}

/// The themes (hub spec §6.1): the cookie value and its label.

const THEMES: &[(&str, &str)] = &[("light", "Light"), ("dark", "Dark"), ("auto", "Match the system")];

/// Backdrops (docs/backgrounds.md §7): the cookie value and its label.

const BACKDROPS: &[(&str, &str)] = &[("moving", "Moving"), ("still", "Still"), ("off", "Off")];

/// The backdrop the request's cookie asks for; moving when unset.

fn backdrop_of(headers: &HeaderMap) -> &'static str {

    let v = auth::viewer::cookie(headers, "backdrop").unwrap_or_default();

    BACKDROPS.iter().map(|(t, _)| *t).find(|t| *t == v).unwrap_or("moving")

}

/// The theme the request's cookie asks for; light when unset or unknown.

fn theme_of(headers: &HeaderMap) -> &'static str {

    let v = auth::viewer::cookie(headers, "theme").unwrap_or_default();

    THEMES.iter().map(|(t, _)| *t).find(|t| *t == v).unwrap_or("light")

}

impl SettingsPage {

    fn new(shell: Shell, me: accounts::Account, headers: &HeaderMap) -> SettingsPage {

        SettingsPage {

            shell,

            me,

            notice: None,

            error: None,

            theme: theme_of(headers),

            themes: THEMES,

            backdrop: backdrop_of(headers),

            backdrops: BACKDROPS,

            mail: false,

        }

    }

    fn with_mail(mut self, app: &Shared) -> Self {

        self.mail = crate::mail::enabled(app);

        self

    }

    fn notice(mut self, n: impl Into<String>) -> Self {

        self.notice = Some(n.into());

        self

    }

    fn error(mut self, e: impl Into<String>) -> Self {

        self.error = Some(e.into());

        self

    }

}

pub async fn profile(State(app): State<Shared>, viewer: Viewer, headers: HeaderMap) -> Result<Page<SettingsPage>, Error> {

    let shell = Shell::new(&app, "/settings", &viewer);

    let me = require(&viewer, &shell)?;

    Ok(Page(SettingsPage::new(shell, me.account, &headers).with_mail(&app)))

}

/// `POST /settings/avatar`: upload or remove the profile picture.

pub async fn avatar(

    State(app): State<Shared>,

    viewer: Viewer,

    headers: HeaderMap,

    multipart: Multipart,

) -> Result<Page<SettingsPage>, Error> {

    let shell = Shell::new(&app, "/settings", &viewer);

    let me = require(&viewer, &shell)?;

    let upload = super::avatar::read_upload(multipart).await;

    csrf(&viewer, &upload.csrf, &shell)?;

    let result = super::avatar::apply(&app, "account", me.account.id, upload).await;

    if result.is_ok() {

        accounts::audit(&app.db, Some(&me.account), "profile.picture", &me.account.username, "").await.ok();

    }

    let fresh = accounts::account_by_id(&app.db, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.unwrap_or(me.account);

    let page = SettingsPage::new(shell, fresh, &headers).with_mail(&app);

    Ok(Page(match result {

        Ok(m) => page.notice(m),

        Err(e) => page.error(e),

    }))

}

/// `POST /settings/email/verify`: send a new verification link.

pub async fn resend_verification(

    State(app): State<Shared>,

    viewer: Viewer,

    headers: HeaderMap,

    Form(f): Form<super::session::CsrfForm>,

) -> Result<Page<SettingsPage>, Error> {

    let shell = Shell::new(&app, "/settings", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf, &shell)?;

    let page = SettingsPage::new(shell, me.account.clone(), &headers).with_mail(&app);

    Ok(Page(match super::recovery::send_verification(&app, &me.account).await {

        Ok(()) if me.account.email_verified => page.notice("Your email is already verified."),

        Ok(()) => page.notice(format!("A verification link is on its way to {}.", me.account.email)),

        Err(e) => page.error(e),

    }))

}

#[derive(Deserialize)]

pub struct AppearanceForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    theme: String,

    #[serde(default)]

    backdrop: String,

}

/// Remember the theme and the backdrop in cookies for a year; the page

/// scripts apply them.

pub async fn appearance(State(app): State<Shared>, viewer: Viewer, Form(f): Form<AppearanceForm>) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/settings", &viewer);

    require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let Some((theme, _)) = THEMES.iter().find(|(t, _)| *t == f.theme) else {

        return Err(Error::bad(shell, "Pick dark, light or match the system."));

    };

    let secure = if app.config.base_url().starts_with("https://") { "; Secure" } else { "" };

    let backdrop = if f.backdrop.is_empty() { "moving" } else { f.backdrop.as_str() };

    let Some((backdrop, _)) = BACKDROPS.iter().find(|(b, _)| *b == backdrop) else {

        return Err(Error::bad(shell, "Pick a moving, still or no background."));

    };

    Ok((

        StatusCode::SEE_OTHER,

        axum::response::AppendHeaders([

            (header::SET_COOKIE, format!("theme={theme}; Path=/; Max-Age=31536000; SameSite=Lax{secure}")),

            (header::SET_COOKIE, format!("backdrop={backdrop}; Path=/; Max-Age=31536000; SameSite=Lax{secure}")),

            (header::LOCATION, "/settings".to_string()),

        ]),

    )

        .into_response())

}

#[derive(Deserialize)]

pub struct ProfileForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    display_name: String,

    email: String,

    #[serde(default)]

    bio: String,

    #[serde(default)]

    website: String,

    #[serde(default)]

    location: String,

    #[serde(default)]

    bluesky: String,

    #[serde(default)]

    mastodon: String,

    #[serde(default)]

    github: String,

}

pub async fn update_profile(

    State(app): State<Shared>,

    viewer: Viewer,

    headers: HeaderMap,

    Form(f): Form<ProfileForm>,

) -> Result<Page<SettingsPage>, Error> {

    let shell = Shell::new(&app, "/settings", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let website = f.website.trim();

    if !(website.is_empty() || website.starts_with("https://") || website.starts_with("http://")) || website.len() > 200 {

        return Ok(Page(

            SettingsPage::new(shell, me.account, &headers).with_mail(&app).error("The website must be an http:// or https:// address."),

        ));

    }

    // Accounts elsewhere: checked and normalised, or refused by name.

    let link = |given: &str, what: &str, parse: fn(&str) -> Option<String>| -> Result<String, String> {

        if given.trim().is_empty() {

            Ok(String::new())

        } else {

            parse(given).ok_or_else(|| format!("That is not a {what}."))

        }

    };

    let links = (|| {

        Ok::<_, String>((

            link(&f.bluesky, "Bluesky handle (such as andy.bsky.social)", crate::social::bluesky)?,

            link(&f.mastodon, "Mastodon address (such as @[email protected])", crate::social::mastodon)?,

            link(&f.github, "GitHub username", crate::social::github)?,

        ))

    })();

    let (bluesky, mastodon, github) = match links {

        Ok(l) => l,

        Err(msg) => return Ok(Page(SettingsPage::new(shell, me.account, &headers).with_mail(&app).error(&msg))),

    };

    let bio: String = f.bio.trim().chars().take(280).collect();

    let location: String = f.location.trim().chars().take(80).collect();

    accounts::set_profile(&app.db, me.account.id, f.display_name.trim(), f.email.trim())

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::set_bio(&app.db, me.account.id, &bio, website, &location).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::set_links(&app.db, me.account.id, &bluesky, &mastodon, &github).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let changed = me.account.email != f.email.trim();

    let updated =

        accounts::account_by_id(&app.db, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.unwrap_or(me.account);

    let mut notice = "Profile saved.".to_string();

    if changed && !updated.email.is_empty() {

        accounts::audit(&app.db, Some(&updated), "email.changed", &updated.username, "").await.ok();

        match super::recovery::send_verification(&app, &updated).await {

            Ok(()) => notice = format!("Profile saved. A verification link is on its way to {}.", updated.email),

            Err(e) => notice = format!("Profile saved. {e}"),

        }

    }

    Ok(Page(SettingsPage::new(shell, updated, &headers).with_mail(&app).notice(notice)))

}

#[derive(Deserialize)]

pub struct PasswordForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    current: String,

    password: String,

}

pub async fn change_password(

    State(app): State<Shared>,

    viewer: Viewer,

    headers: HeaderMap,

    Form(f): Form<PasswordForm>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/settings", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    if !auth::verify_password(&me.account.password_hash, &f.current) {

        return Ok(

            Page(SettingsPage::new(shell, me.account, &headers).with_mail(&app).error("Your current password is wrong.")).into_response()

        );

    }

    if let Err(e) = auth::password_ok(&f.password) {

        return Ok(Page(SettingsPage::new(shell, me.account, &headers).with_mail(&app).error(e)).into_response());

    }

    let hash = auth::hash_password(&f.password).map_err(|e| Error::bad(shell.clone(), e.to_string()))?;

    // A new session salt signs out every other session; this one is renewed.

    accounts::set_password(&app.db, me.account.id, &hash, &auth::random_hex(16)).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me.account), "password.changed", &me.account.username, "").await.ok();

    let fresh = accounts::account_by_id(&app.db, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.unwrap_or(me.account);

    Ok(super::session::signed_in(&app, &fresh, "/settings/security").await)

}

#[derive(Template)]

#[template(path = "settings_security.html")]

pub struct SecurityPage {

    shell: Shell,

    me: accounts::Account,

    notice: Option<String>,

    error: Option<String>,

    /// Enrolment in progress: secret, URI and QR.

    enrol: Option<(String, String, String)>,

    recovery: Vec<String>,

    /// Providers on this hub and the login connected, if any (#106).

    connected: Vec<(&'static str, &'static str, Option<String>)>,

    /// Where the account is signed in (oxygenhub#223).

    sessions: Vec<SessionView>,

    /// Phones that approve as a second factor (oxygenhub#356).

    phones: Vec<crate::db::approvals::Authenticator>,

}

/// One signed-in browser, as Settings › Security lists it.

pub struct SessionView {

    pub id: i64,

    pub current: bool,

    pub browser: String,

    pub address: String,

    pub seen_ms: i64,

    pub created_ms: i64,

}

/// "Firefox on Linux" from a User-Agent; "Unknown browser" when it says nothing useful.

pub fn browser_of(agent: &str) -> String {

    let has = |s: &str| agent.contains(s);

    let browser = if has("Edg/") {

        "Edge"

    } else if has("OPR/") {

        "Opera"

    } else if has("Firefox/") {

        "Firefox"

    } else if has("Chrome/") || has("Chromium/") {

        "Chrome"

    } else if has("Safari/") {

        "Safari"

    } else if has("curl/") {

        "curl"

    } else {

        ""

    };

    let os = if has("Android") {

        "Android"

    } else if has("iPhone") || has("iPad") {

        "iOS"

    } else if has("Windows") {

        "Windows"

    } else if has("Mac OS X") || has("Macintosh") {

        "macOS"

    } else if has("CrOS") {

        "ChromeOS"

    } else if has("Linux") {

        "Linux"

    } else {

        ""

    };

    match (browser, os) {

        ("", "") => "Unknown browser".into(),

        (b, "") => b.into(),

        ("", o) => format!("A browser on {o}"),

        (b, o) => format!("{b} on {o}"),

    }

}

async fn sessions_of(app: &Shared, me: &crate::auth::ViewerAccount) -> sqlx::Result<Vec<SessionView>> {

    Ok(crate::db::sessions::of_account(&app.db, me.account.id, &me.account.session_salt)

        .await?

        .into_iter()

        .map(|s| SessionView {

            id: s.id,

            current: s.id == me.session_id,

            browser: browser_of(&s.agent),

            address: s.address,

            seen_ms: s.seen_ms,

            created_ms: s.created_ms,

        })

        .collect())

}

#[derive(Deserialize)]

pub struct SecurityQuery {

    notice: Option<String>,

    error: Option<String>,

}

pub async fn security(State(app): State<Shared>, viewer: Viewer, Query(q): Query<SecurityQuery>) -> Result<Page<SecurityPage>, Error> {

    let shell = Shell::new(&app, "/settings/security", &viewer);

    let me = require(&viewer, &shell)?;

    let connected = connected_of(&app, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let sessions = sessions_of(&app, &me).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let phones = crate::db::approvals::authenticators(&app.db, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    Ok(Page(SecurityPage {

        shell,

        me: me.account,

        notice: q.notice,

        error: q.error,

        enrol: None,

        recovery: vec![],

        connected,

        sessions,

        phones,

    }))

}

/// Each sign-in provider this hub offers, with the login connected to the account.

pub async fn connected_of(app: &Shared, account_id: i64) -> sqlx::Result<Vec<(&'static str, &'static str, Option<String>)>> {

    let links = crate::signin::links_of(&app.db, account_id).await?;

    let mut out = vec![];

    for p in crate::signin::enabled(app).await {

        out.push((p.id, p.name, links.iter().find(|l| l.provider == p.id).map(|l| l.login.clone())));

    }

    Ok(out)

}

#[derive(Deserialize)]

pub struct TotpForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    #[serde(default)]

    secret: String,

    #[serde(default)]

    code: String,

    #[serde(default)]

    password: String,

}

/// Step one: show a fresh secret to scan.

pub async fn totp_begin(State(app): State<Shared>, viewer: Viewer, Form(f): Form<TotpForm>) -> Result<Page<SecurityPage>, Error> {

    let shell = Shell::new(&app, "/settings/security", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let secret = totp::new_secret();

    let uri = totp::uri(&app.config.site.name, &me.account.username, &secret);

    let qr = totp::qr_svg(&uri).unwrap_or_default();

    Ok(Page(SecurityPage {

        shell,

        me: me.account,

        notice: None,

        error: None,

        enrol: Some((secret, uri, qr)),

        recovery: vec![],

        connected: vec![],

        sessions: vec![],

        phones: vec![],

    }))

}

/// Step two: the first code proves the app holds the secret.

pub async fn totp_enable(State(app): State<Shared>, viewer: Viewer, Form(f): Form<TotpForm>) -> Result<Page<SecurityPage>, Error> {

    let shell = Shell::new(&app, "/settings/security", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let now = (db::now_ms() / 1000) as u64;

    if f.secret.is_empty() || !totp::verify(&f.secret, &f.code, now) {

        let uri = totp::uri(&app.config.site.name, &me.account.username, &f.secret);

        let qr = totp::qr_svg(&uri).unwrap_or_default();

        return Ok(Page(SecurityPage {

            shell,

            me: me.account,

            notice: None,

            error: Some("That code did not match; scan again and enter the current code.".into()),

            enrol: Some((f.secret, uri, qr)),