//! The bridge (spec §18.1): a loopback proxy that signs as the owner, for a
//! program that cannot sign itself (the VS Code extension). It answers only
//! requests that carry its per-run token, from its own loopback host and
//! with no `Origin`, so no web page can use it, and it signs each with the
//! owner's key before forwarding it to the daemon, wherever that is.

use crate::client::{sign_headers, Client};
use axum::body::{Body, Bytes};
use axum::extract::{Request, State};
use axum::http::{header, StatusCode};
use axum::response::{IntoResponse, Response};
use http_body_util::{BodyExt, Full};
use std::sync::Arc;

struct Bridge {
    upstream: Client,
    token: String,
    hosts: Vec<String>,
}

/// The bridge's routes, forwarding to `upstream` (which signs) for the
/// holder of `token`, at `127.0.0.1:port`.
pub fn router(upstream: Client, token: String, port: u16) -> axum::Router {
    let b = Arc::new(Bridge { upstream, token, hosts: vec![format!("127.0.0.1:{port}"), format!("localhost:{port}")] });
    axum::Router::new().fallback(forward).with_state(b)
}

/// A fresh random token.
pub fn token() -> String {
    let mut b = [0u8; 32];
    rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut b);
    hex::encode(b)
}

fn refuse(status: StatusCode, why: &str) -> Response {
    (status, axum::Json(serde_json::json!({ "title": why }))).into_response()
}

async fn forward(State(b): State<Arc<Bridge>>, req: Request) -> Response {
    let h = req.headers();
    let host = h.get(header::HOST).and_then(|v| v.to_str().ok()).unwrap_or("");
    if !b.hosts.iter().any(|x| x == host) || h.contains_key(header::ORIGIN) {
        return refuse(StatusCode::FORBIDDEN, "the bridge serves the program that started it, not web pages");
    }
    let given = h.get(header::AUTHORIZATION).and_then(|v| v.to_str().ok()).and_then(|v| v.strip_prefix("Bearer ")).unwrap_or("");
    if !subtle_eq(given.as_bytes(), b.token.as_bytes()) {
        return refuse(StatusCode::UNAUTHORIZED, "the bridge's token is missing or wrong");
    }
    let (parts, body) = req.into_parts();
    let body: Bytes = match body.collect().await {
        Ok(x) => x.to_bytes(),
        Err(_) => return refuse(StatusCode::BAD_REQUEST, "an unreadable body"),
    };
    let path = parts.uri.path_and_query().map(|p| p.as_str()).unwrap_or("/").to_string();
    let method = parts.method.as_str().to_string();
    let mut up = hyper::Request::builder()
        .method(parts.method.clone())
        .uri(&path)
        .header(header::HOST, "spectra")
        .header(header::CONNECTION, "close");
    for k in [header::CONTENT_TYPE, header::ACCEPT, header::IF_NONE_MATCH] {
        if let Some(v) = parts.headers.get(&k) {
            up = up.header(k, v);
        }
    }
    if let Some(pair) = b.upstream.signer() {
        for (k, v) in sign_headers(pair, &format!("{method} {path}"), &body) {
            up = up.header(k, v);
        }
    }
    let up = match up.body(Full::new(body)) {
        Ok(r) => r,
        Err(_) => return refuse(StatusCode::BAD_REQUEST, "not a request the bridge can pass on"),
    };
    match b.upstream.forward(up).await {
        Ok(resp) => {
            let (parts, incoming) = resp.into_parts();
            let mut out = Response::new(Body::new(incoming));
            *out.status_mut() = parts.status;
            for (k, v) in parts.headers.iter() {
                if !matches!(k.as_str(), "connection" | "transfer-encoding" | "keep-alive") {
                    out.headers_mut().append(k, v.clone());
                }
            }
            out
        }
        Err(e) => refuse(StatusCode::BAD_GATEWAY, &format!("Spectra did not answer: {e:#}")),
    }
}

/// Compare in time that does not depend on where the first difference is.
fn subtle_eq(a: &[u8], b: &[u8]) -> bool {
    if a.len() != b.len() {
        return false;
    }
    a.iter().zip(b).fold(0u8, |acc, (x, y)| acc | (x ^ y)) == 0
}

#[cfg(test)]
mod tests {
    #[test]
    fn tokens_are_fresh_and_compared_whole() {
        assert_ne!(super::token(), super::token());
        assert!(super::subtle_eq(b"abc", b"abc"));
        assert!(!super::subtle_eq(b"abc", b"abd"));
        assert!(!super::subtle_eq(b"abc", b"ab"));
    }
}