//! Radar from a workstation (spec §8.6): a browser cannot pin the
//! instance's certificate, so `spectra open` serves a loopback proxy that
//! forwards to the pinned server over TLS. It answers only loopback `Host`
//! and `Origin`, so no other site can reach the server through it, and
//! passes responses (the SSE stream included) through as they come.

use crate::client::{Client, Endpoint};
use axum::body::{Body, Bytes};
use axum::extract::{Request, State};
use axum::http::{header, HeaderMap, StatusCode};
use axum::response::{IntoResponse, Response};
use http_body_util::{BodyExt, Full};
use std::sync::Arc;

struct Proxy {
    upstream: Client,
    /// `127.0.0.1:PORT` and `localhost:PORT`.
    hosts: Vec<String>,
}

/// The proxy's routes, forwarding to `upstream` as the browser at
/// `127.0.0.1:port` asks.
pub fn router(upstream: Endpoint, port: u16) -> axum::Router {
    let p = Arc::new(Proxy { upstream: Client::at(upstream, None), hosts: vec![format!("127.0.0.1:{port}"), format!("localhost:{port}")] });
    axum::Router::new().fallback(forward).with_state(p)
}

/// The sign-in link the server made, pointed at the proxy instead.
pub fn local_link(url: &str, port: u16) -> String {
    let rest = url.split_once("://").map(|(_, r)| r).unwrap_or(url);
    let path = rest.find('/').map(|i| &rest[i..]).unwrap_or("/");
    format!("http://127.0.0.1:{port}{path}")
}

fn ours(p: &Proxy, headers: &HeaderMap) -> bool {
    let host = headers.get(header::HOST).and_then(|h| h.to_str().ok()).unwrap_or("");
    if !p.hosts.iter().any(|h| h == host) {
        return false;
    }
    match headers.get(header::ORIGIN).and_then(|o| o.to_str().ok()) {
        None => true,
        Some(o) => p.hosts.iter().any(|h| o == format!("http://{h}")),
    }
}

async fn forward(State(p): State<Arc<Proxy>>, req: Request) -> Response {
    if !ours(&p, req.headers()) {
        return (StatusCode::FORBIDDEN, "this proxy serves its own page only").into_response();
    }
    let (parts, body) = req.into_parts();
    let body: Bytes = match body.collect().await {
        Ok(b) => b.to_bytes(),
        Err(_) => return StatusCode::BAD_REQUEST.into_response(),
    };
    let path = parts.uri.path_and_query().map(|p| p.as_str()).unwrap_or("/");
    let mut up = hyper::Request::builder().method(parts.method.clone()).uri(path);
    for (k, v) in parts.headers.iter() {
        // The proxy has checked the origin itself; hop-by-hop headers stay here.
        if matches!(k.as_str(), "host" | "origin" | "connection" | "keep-alive" | "transfer-encoding" | "upgrade" | "referer") {
            continue;
        }
        up = up.header(k, v);
    }
    let up = match up.header(header::HOST, "spectra").header(header::CONNECTION, "close").body(Full::new(body)) {
        Ok(r) => r,
        Err(_) => return StatusCode::BAD_REQUEST.into_response(),
    };
    match p.upstream.forward(up).await {
        Ok(resp) => {
            let (parts, incoming) = resp.into_parts();
            let mut out = Response::new(Body::new(incoming));
            *out.status_mut() = parts.status;
            for (k, v) in parts.headers.iter() {
                if !matches!(k.as_str(), "connection" | "transfer-encoding" | "keep-alive") {
                    out.headers_mut().append(k, v.clone());
                }
            }
            out
        }
        Err(e) => (StatusCode::BAD_GATEWAY, format!("Spectra on the server did not answer: {e:#}")).into_response(),
    }
}

#[cfg(test)]
mod tests {
    #[test]
    fn the_link_points_at_the_proxy() {
        assert_eq!(super::local_link("http://127.0.0.1:7350/signin?code=abc", 7351), "http://127.0.0.1:7351/signin?code=abc");
    }
}