//! Drops' pages (oxygenhub#279): `/{owner}/drops` lists a person's drops

//! (all of them to themselves, the public ones to everyone else), `/drops`

//! goes to your own, `/drops/new` makes one, and `/{owner}/drops/{id}`

//! shows one with its files rendered, with Edit and Delete for its owner.

//! A drop's history, changes and raw files are the repository pages under

//! `/{owner}/drops/{id}/…`, with the drop's bar in place of the tabs.

use super::settings::{csrf, require};

use super::{filters, Error, Page, RepoShell, Shell};

use crate::auth::{Access, Viewer};

use crate::db;

use crate::drops::{self, DropFile, NewFile};

use crate::render::{highlight, markdown};

use crate::Shared;

use askama::Template;

use axum::extract::{Form, Path, Query, State};

use axum::response::{IntoResponse, Redirect, Response};

use serde::Deserialize;

/// One drop on a Drops page.

pub struct DropLine {

    pub url: String,

    pub title: String,

    pub description: String,

    pub secret: bool,

    pub files: Vec<String>,

    pub updated_ms: i64,

}

#[derive(Template)]

#[template(path = "drops.html")]

pub struct DropsPage {

    shell: Shell,

    owner: String,

    is_me: bool,

    drops: Vec<DropLine>,

    notice: Option<String>,

}

/// One file as the drop page shows it.

pub struct ShownFile {

    pub path: String,

    pub anchor: String,

    pub size: u64,

    pub language: Option<&'static str>,

    /// Highlighted lines, as markup.

    pub lines: Vec<String>,

    pub markdown: Option<String>,

    /// Why the file is not shown (binary, too large).

    pub note: Option<String>,

}

#[derive(Template)]

#[template(path = "drop.html")]

pub struct DropPage {

    shell: Shell,

    repo: RepoShell,

    title: String,

    description: String,

    secret: bool,

    files: Vec<ShownFile>,

    can_edit: bool,

    can_delete: bool,

    /// Signed in and not its owner: may fork it (#280).

    can_fork: bool,

    /// The iframe that puts it on another site (#280).

    embed: String,

    /// Its comments, rendered, and whether the viewer may delete each (#280).

    comments: Vec<ShownComment>,

    /// Its stars, and whether the viewer gave one (#280).

    stars: i64,

    starred: bool,

    signed_in: bool,

    /// The drop it was forked from, if it still exists: its address.

    forked_from: Option<String>,

    clone_url: String,

    /// What the files are shown at, and whether that is the default bookmark.

    target: String,

    at_default: bool,

    created_ms: i64,

    updated_ms: i64,

}

/// A drop as another site frames it (#280): its files, a link back, no

/// chrome, no scripts.

#[derive(Template)]

#[template(path = "drop_embed.html")]

pub struct EmbedPage {

    title: String,

    owner: String,

    /// The drop's address, whole, to open it on the hub.

    url: String,

    site: String,

    site_url: String,

    assets: &'static str,

    files: Vec<ShownFile>,

}

/// What an embedded drop may do: be framed anywhere, show its styles and

/// images, and nothing else (no scripts, no forms).

const EMBED_POLICY: &str =

    "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; frame-ancestors *; base-uri 'none'; form-action 'none'";

/// `GET /{owner}/drops/{id}/embed` (#280): the drop to put in an iframe on

/// another site; readable by whoever may read the drop.

pub async fn embed(State(app): State<Shared>, viewer: Viewer, Path((owner, id)): Path<(String, String)>) -> Result<Response, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/drops/{id}/embed"), &viewer);

    let row = lookup(&app, &shell, &viewer, &owner, &id).await?;

    let (target, files) = drops::files(&app, &row, "").await.map_err(|e| Error::from_repo(shell.clone(), e))?;

    let url = drops::url_of(&row);

    let title = drops::shown_title(&row, &files);

    let label = target.label.clone();

    let files = shown(files, &format!("{url}/file/{label}/"), &format!("{url}/raw/{label}/"));

    let base = app.config.base_url().trim_end_matches('/').to_string();

    let page = EmbedPage {

        title,

        owner: row.owner.clone(),

        url: format!("{base}{url}"),

        site: shell.site.clone(),

        site_url: base,

        assets: shell.assets(),

        files,

    };

    let html = page.render().map_err(|e| Error::bad(shell.clone(), e.to_string()))?;

    Ok((

        [(axum::http::header::CONTENT_TYPE, "text/html; charset=utf-8"), (axum::http::header::CONTENT_SECURITY_POLICY, EMBED_POLICY)],

        html,

    )

        .into_response())

}

/// A comment as the drop's page shows it.

pub struct ShownComment {

    pub id: i64,

    pub author: String,

    pub created_ms: i64,

    pub html: String,

    pub may_delete: bool,

}

#[derive(Template)]

#[template(path = "drop_form.html")]

pub struct DropForm {

    shell: Shell,

    editing: bool,

    action: String,

    cancel: String,

    title: String,

    description: String,

    secret: bool,

    files: Vec<(String, String)>,

    /// Files the form does not edit: not text, or too large.

    kept: Vec<String>,

    message: String,

    delegation: Option<String>,

    error: Option<String>,

}

/// `GET /drops`: your own Drops page.

pub async fn mine(State(app): State<Shared>, viewer: Viewer) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/drops", &viewer);

    let me = require(&viewer, &shell)?;

    Ok(Redirect::to(&format!("/{}/drops", me.account.username)).into_response())

}

#[derive(Deserialize, Default)]

pub struct ListQuery {

    #[serde(default)]

    deleted: Option<String>,

}

/// `GET /{owner}/drops`.

pub async fn list(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(owner): Path<String>,

    Query(q): Query<ListQuery>,

) -> Result<Page<DropsPage>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/drops"), &viewer);

    let db_err = |e| Error::from_db(shell.clone(), e);

    let Some(account) = db::accounts::account_by_name(&app.db, &owner).await.map_err(db_err)? else {

        return Err(Error::not_found(shell));

    };

    let rows = db::repos::drops_of(&app.db, &account.username).await.map_err(db_err)?;

    let mut lines = Vec::new();

    for row in rows.into_iter().filter(|r| drops::listed_to(viewer.account(), r)) {

        let files = drops::files(&app, &row, "").await.map(|(_, f)| f).unwrap_or_default();

        lines.push(DropLine {

            url: drops::url_of(&row),

            title: drops::shown_title(&row, &files),

            description: row.description.clone(),

            secret: row.visibility() != hub_api::Visibility::Public,

            files: files.into_iter().map(|f| f.path).collect(),

            updated_ms: row.updated_ms,

        });

    }

    let is_me = viewer.account().is_some_and(|a| a.id == account.id);

    let notice = q.deleted.map(|_| "The drop was deleted.".to_string());

    Ok(Page(DropsPage { shell, owner: account.username, is_me, drops: lines, notice }))

}

/// The drop `{owner}/drops/{id}` for the viewer, or 404.

async fn lookup(app: &Shared, shell: &Shell, viewer: &Viewer, owner: &str, id: &str) -> Result<db::repos::RepoRow, Error> {

    let row = drops::find(app, owner, id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let row = row.ok_or_else(|| Error::not_found(shell.clone()))?;

    let role = crate::auth::roles::role_for(&app.db, viewer.account(), &row).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    if !crate::auth::roles::allows(role, Access::Read) {

        return Err(Error::not_found(shell.clone()));

    }

    Ok(row)

}

/// A file's anchor on the drop page: `file-` and its path, plain.

fn anchor_of(path: &str) -> String {

    format!("file-{}", path.trim_matches('/').replace(|c: char| !c.is_ascii_alphanumeric() && c != '.' && c != '_', "-"))

}

fn shown(files: Vec<DropFile>, base_file: &str, base_raw: &str) -> Vec<ShownFile> {

    files

        .into_iter()

        .map(|f| {

            let language = highlight::language(&f.path);

            let anchor = anchor_of(&f.path);

            let lower = f.path.to_lowercase();

            let (lines, md, note) = match &f.text {

                Some(text) if lower.ends_with(".md") || lower.ends_with(".markdown") => {

                    (vec![], Some(markdown::render(text, base_file, base_raw)), None)

                }

                Some(text) => (highlight::lines(&f.path, text), None, None),

                None if crate::web::mime_of(&f.path).starts_with("image/") => (vec![], None, Some("An image.".to_string())),

                None => (vec![], None, Some("Not shown: a binary file, or too large to show here.".to_string())),

            };

            ShownFile { path: f.path, anchor, size: f.size, language, lines, markdown: md, note }

        })

        .collect()

}

async fn page(app: &Shared, viewer: &Viewer, owner: &str, id: &str, r: &str) -> Result<Page<DropPage>, Error> {

    let path = if r.is_empty() { format!("/{owner}/drops/{id}") } else { format!("/{owner}/drops/{id}/tree/{r}") };

    let shell = Shell::new(app, &path, viewer);

    let row = lookup(app, &shell, viewer, owner, id).await?;

    let (target, files) = drops::files(app, &row, r).await.map_err(|e| Error::from_repo(shell.clone(), e))?;

    let url = drops::url_of(&row);

    let title = drops::shown_title(&row, &files);

    let label = target.label.clone();

    let files = shown(files, &format!("{url}/file/{label}/"), &format!("{url}/raw/{label}/"));

    let (can_edit, can_delete) = (drops::may_edit(viewer.account(), &row), drops::may_delete(viewer.account(), &row));

    let role = if can_edit { crate::auth::Role::Admin } else { crate::auth::Role::Read };

    let can_fork = viewer.account().is_some_and(|a| a.username != row.owner && !a.blocked());

    let forked_from = match row.forked_from {

        Some(id) => db::repos::get_by_id(&app.db, id).await.ok().flatten().filter(|r| r.is_drop()).map(|r| drops::url_of(&r)),

        None => None,

    };

    let comments = db::repos::drop_comments(&app.db, row.id)

        .await

        .unwrap_or_default()

        .into_iter()

        .map(|c| ShownComment {

            may_delete: may_delete_comment(viewer, &row, &c),

            id: c.id,

            html: markdown::render(&c.body, "", ""),

            author: c.author,

            created_ms: c.created_ms,

        })

        .collect();

    let embed = format!(

        "<iframe src=\"{}{}/embed\" width=\"100%\" height=\"400\" style=\"border:0\" title=\"{}\"></iframe>",

        app.config.base_url().trim_end_matches('/'),

        drops::url_of(&row),

        title.replace('"', """)

    );

    let stars = db::repos::counts(&app.db, row.id).await.map(|(s, _)| s).unwrap_or(0);

    let starred = match viewer.account() {

        Some(a) => db::repos::starred(&app.db, a.id, row.id).await.unwrap_or(false),

        None => false,

    };

    Ok(Page(DropPage {

        embed,

        comments,

        stars,

        starred,

        signed_in: viewer.account().is_some(),

        can_fork,

        forked_from,

        repo: RepoShell::new(app, &row, "code").with_role(role),

        title,

        description: row.description.clone(),

        secret: row.visibility() != hub_api::Visibility::Public,

        files,

        can_edit,

        can_delete,

        clone_url: format!("{}{url}", app.config.base_url()),

        at_default: label == row.default_bookmark,

        target: label,

        created_ms: row.created_ms,

        updated_ms: row.updated_ms,

        shell,

    }))

}

/// `GET /{owner}/drops/{id}`.

pub async fn show(State(app): State<Shared>, viewer: Viewer, Path((owner, id)): Path<(String, String)>) -> Result<Page<DropPage>, Error> {

    page(&app, &viewer, &owner, &id, "").await

}

/// `GET /{owner}/drops/{id}/tree/{r}`: the files at a bookmark, tag or

/// change (where a change page's links go).

pub async fn show_at(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, id, r)): Path<(String, String, String)>,

) -> Result<Page<DropPage>, Error> {

    page(&app, &viewer, &owner, &id, &r).await

}

/// The form's fields: repeated `name` and `content` pairs, in order.

struct Submitted {

    csrf: String,

    title: String,

    description: String,

    secret: bool,

    message: String,

    files: Vec<NewFile>,

}

fn submitted(pairs: Vec<(String, String)>) -> Submitted {

    let mut s = Submitted {

        csrf: String::new(),

        title: String::new(),

        description: String::new(),

        secret: false,

        message: String::new(),

        files: vec![],

    };

    for (k, v) in pairs {

        match k.as_str() {

            "_csrf" => s.csrf = v,

            "title" => s.title = v,

            "description" => s.description = v,

            "visibility" => s.secret = v == "secret",

            "message" => s.message = v,

            "name" => s.files.push(NewFile { name: v, content: String::new() }),

            "content" => match s.files.last_mut() {

                Some(f) if f.content.is_empty() => f.content = v,

                _ => s.files.push(NewFile { name: String::new(), content: v }),

            },

            _ => {}

        }

    }

    // A row left empty is no file.

    s.files.retain(|f| !f.name.trim().is_empty() || !f.content.trim().is_empty());

    s

}

fn form_files(files: &[NewFile]) -> Vec<(String, String)> {

    let mut out: Vec<(String, String)> = files.iter().map(|f| (f.name.clone(), f.content.clone())).collect();

    out.push((String::new(), String::new()));

    out

}

/// `GET /drops/new`.

pub async fn new_form(State(app): State<Shared>, viewer: Viewer) -> Result<Page<DropForm>, Error> {

    let shell = Shell::new(&app, "/drops/new", &viewer);

    let me = require(&viewer, &shell)?;

    let delegation = crate::web::edit::signer_for(&app, me.account.id).await.err();

    Ok(Page(DropForm {

        cancel: format!("/{}/drops", me.account.username),

        shell,

        editing: false,

        action: "/drops/new".into(),

        title: String::new(),

        description: String::new(),

        secret: false,

        files: form_files(&[]),

        kept: vec![],

        message: String::new(),

        delegation,

        error: None,

    }))

}

/// `POST /drops/new`.

pub async fn create(State(app): State<Shared>, viewer: Viewer, Form(pairs): Form<Vec<(String, String)>>) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/drops/new", &viewer);

    let me = require(&viewer, &shell)?;

    let f = submitted(pairs);

    csrf(&viewer, &f.csrf, &shell)?;

    match drops::create(&app, &me.account, &f.title, &f.description, f.secret, &f.files).await {

        Ok(row) => Ok(Redirect::to(&drops::url_of(&row)).into_response()),

        Err(drops::DropError::Bad(msg)) => {

            let delegation = crate::web::edit::signer_for(&app, me.account.id).await.err();

            Ok(Page(DropForm {

                cancel: format!("/{}/drops", me.account.username),

                shell,

                editing: false,

                action: "/drops/new".into(),

                title: f.title,

                description: f.description,

                secret: f.secret,

                files: form_files(&f.files),

                kept: vec![],

                message: String::new(),

                delegation,

                error: Some(msg),

            })

            .into_response())

        }

        Err(e) => Err(Error { status: axum::http::StatusCode::INTERNAL_SERVER_ERROR, ..Error::bad(shell, e.to_string()) }),

    }

}

/// The drop, when the viewer may change it (its owner) or, `deleting`,

/// delete it (its owner or a site administrator).

async fn writable(

    app: &Shared,

    shell: &Shell,

    viewer: &Viewer,

    owner: &str,

    id: &str,

    deleting: bool,

) -> Result<db::repos::RepoRow, Error> {

    let row = lookup(app, shell, viewer, owner, id).await?;

    let may = if deleting { drops::may_delete(viewer.account(), &row) } else { drops::may_edit(viewer.account(), &row) };

    if !may {

        return Err(Error::not_found(shell.clone()));

    }

    Ok(row)

}

async fn edit_page(

    app: &Shared,

    shell: Shell,

    viewer: &Viewer,

    row: &db::repos::RepoRow,

    wanted: Option<&Submitted>,

    error: Option<String>,

) -> Result<Page<DropForm>, Error> {

    let me = require(viewer, &shell)?;

    let (_, current) = drops::files(app, row, "").await.map_err(|e| Error::from_repo(shell.clone(), e))?;

    let kept: Vec<String> = current.iter().filter(|f| f.text.is_none()).map(|f| f.path.clone()).collect();

    let files = match wanted {

        Some(w) => form_files(&w.files),

        None => form_files(

            &current

                .iter()

                .filter_map(|f| f.text.as_ref().map(|t| NewFile { name: f.path.clone(), content: t.clone() }))

                .collect::<Vec<_>>(),

        ),

    };

    let delegation = crate::web::edit::signer_for(app, me.account.id).await.err();

    let url = drops::url_of(row);

    Ok(Page(DropForm {

        shell,

        editing: true,

        action: format!("{url}/edit"),

        cancel: url,

        title: wanted.map(|w| w.title.clone()).unwrap_or_else(|| row.title.clone()),

        description: wanted.map(|w| w.description.clone()).unwrap_or_else(|| row.description.clone()),

        secret: wanted.map(|w| w.secret).unwrap_or(row.visibility() != hub_api::Visibility::Public),

        files,

        kept,

        message: wanted.map(|w| w.message.clone()).unwrap_or_default(),

        delegation,

        error,

    }))

}

/// `GET /{owner}/drops/{id}/edit`.

pub async fn edit_form(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, id)): Path<(String, String)>,

) -> Result<Page<DropForm>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/drops/{id}/edit"), &viewer);

    require(&viewer, &shell)?;

    let row = writable(&app, &shell, &viewer, &owner, &id, false).await?;

    edit_page(&app, shell, &viewer, &row, None, None).await

}

/// `POST /{owner}/drops/{id}/edit`: the files as the form has them, as

/// one change (only what differs), and the title, description and

/// visibility.

pub async fn save(