jelq

public
an http based roguelike rpg about jelqing
Star0
Watch0
4 commits 1 branch 0 tags 0 releases1.3 MiB
use std::{
    collections::HashMap,
    convert::Infallible,
    fmt::Write as _,
    io::Write as _,
    sync::{Arc, Mutex},
    time::Instant,
};

use axum::{
    Json, Router,
    body::{Body, Bytes},
    extract::{Path, Query, Request, State},
    http::{HeaderMap, HeaderName, HeaderValue, Method, StatusCode, Uri, Version, header},
    middleware::{self, Next},
    response::{Html, IntoResponse, Redirect, Response},
    routing::any,
};
use flate2::{Compression, write::GzEncoder};
use hyper_util::rt::TokioIo;
use rand::Rng;
use serde::Deserialize;
use serde_json::{Value, json};
use tokio::io::AsyncWriteExt;
use tower::ServiceExt;

use crate::{
    game::{
        ELDER_LAST_MODIFIED, FORUM_THREAD, Floor, Grip, LUBRICANTS, Lube, MAX_STAMINA, MM_PER_INCH,
        PatchOp, RUN_ALLOW, Run, SUSPICION_LIMIT, Technique, forum_thread, shaft,
    },
    problem::{PROBLEM_BASE, Problem, reason},
    secret,
};

const REL_BASE: &str = "https://jelq.dev/rels/";
const COOKIE_ATTRIBUTES: &str = "Max-Age=31536000; Path=/; HttpOnly; SameSite=Strict";
const THERAPY: &str = "Your options are listed in the Allow header. There are more of them than you think. You could also try being honest. It is not in the Allow header because it is not a method.";
const MAX_URI: usize = 512;
const MAX_HEADER: usize = 1024;

#[derive(Default)]
pub struct AppState {
    runs: Mutex<HashMap<String, Run>>,
}

impl AppState {
    pub fn insert(&self, run: Run) {
        self.runs.lock().unwrap().insert(run.id.clone(), run);
    }
}

type Shared = Arc<AppState>;

#[derive(Clone)]
struct Compress;

/// Which household hazards stand between the request and the run.
#[derive(Clone, Copy, PartialEq, Eq)]
enum Scope {
    Home,
    Pockets,
}

pub fn app() -> Router {
    router(Arc::default())
}

pub fn router(state: Shared) -> Router {
    let api = api(state);
    let ui = Router::new()
        .route("/ui", any(|| async { Redirect::permanent("/ui/") }))
        .route("/ui/", any(ui))
        .route("/ui/send", any(ui_send))
        .with_state(api.clone());
    api.merge(ui)
}

fn api(state: Shared) -> Router {
    Router::new()
        .route("/", any(index))
        .route("/runs", any(runs))
        .route("/runs/{id}", any(run))
        .route("/runs/{id}/length", any(length))
        .route("/runs/{id}/foreskin", any(foreskin))
        .route("/runs/{id}/inventory", any(inventory))
        .route("/runs/{id}/inventory/{item}", any(item))
        .route("/runs/{id}/techniques", any(techniques))
        .route("/runs/{id}/drawer", any(drawer))
        .route("/runs/{id}/branches/{choice}", any(branch))
        .route("/runs/{id}/floor", any(floor))
        .route("/runs/{id}/shop", any(shop))
        .route("/runs/{id}/shop/{item}", any(buy))
        .route("/runs/{id}/portal", any(portal))
        .route("/runs/{id}/elder", any(elder))
        .route("/runs/{id}/grip", any(grip))
        .route("/runs/{id}/diagnosis", any(diagnosis))
        .route("/forum/threads/{year}", any(thread))
        .route("/graveyard", any(graveyard))
        .route("/leaderboard", any(leaderboard))
        .fallback(not_found)
        .layer(middleware::from_fn(chrome))
        .with_state(state)
}

fn reject(request: &Request) -> Option<Problem> {
    if request.version() < Version::HTTP_11 {
        return Some(Problem::new(
            StatusCode::HTTP_VERSION_NOT_SUPPORTED,
            "pdf",
            "HTTP/1.0 is the version the original jelqing PDF was written for. The server has read it.",
        ));
    }
    if request.uri().to_string().len() > MAX_URI {
        return Some(Problem::new(
            StatusCode::URI_TOO_LONG,
            "uri-too-long",
            "The URI is longer than anything else here.",
        ));
    }
    if request.headers().values().any(|v| v.len() > MAX_HEADER) {
        return Some(Problem::new(
            StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE,
            "head-too-large",
            "Head too large.",
        ));
    }
    let expectation = request.headers().get(header::EXPECT)?;
    if expectation.as_bytes().eq_ignore_ascii_case(b"100-continue") {
        return None;
    }
    Some(Problem::new(
        StatusCode::EXPECTATION_FAILED,
        "expectations",
        format!(
            "Expect: {} cannot be met.",
            expectation.to_str().unwrap_or("that")
        ),
    ))
}

async fn compress(response: Response) -> Response {
    let (mut parts, body) = response.into_parts();
    let Ok(bytes) = axum::body::to_bytes(body, usize::MAX).await else {
        return Response::from_parts(parts, Body::empty());
    };
    let mut encoder = GzEncoder::new(Vec::new(), Compression::default());
    if encoder.write_all(&bytes).is_err() {
        return Response::from_parts(parts, Body::from(bytes));
    }
    let Ok(gzipped) = encoder.finish() else {
        return Response::from_parts(parts, Body::from(bytes));
    };
    parts
        .headers
        .insert(header::CONTENT_ENCODING, HeaderValue::from_static("gzip"));
    parts.headers.remove(header::CONTENT_LENGTH);
    parts
        .headers
        .append(header::VARY, HeaderValue::from_static("Accept-Encoding"));
    Response::from_parts(parts, Body::from(gzipped))
}

async fn chrome(request: Request, next: Next) -> Response {
    let gzip = header_str(request.headers(), header::ACCEPT_ENCODING)
        .is_some_and(|e| e.to_ascii_lowercase().contains("gzip"));
    let mut response = match reject(&request) {
        Some(problem) => problem.into_response(),
        None => next.run(request).await,
    };
    if gzip && response.extensions().get::<Compress>().is_some() {
        response = compress(response).await;
    }
    let headers = response.headers_mut();
    headers.insert(header::SERVER, HeaderValue::from_static("jelqd/0.6.9"));
    headers.insert("x-powered-by", HeaderValue::from_static("blood"));
    headers.insert(
        header::CACHE_CONTROL,
        HeaderValue::from_static("no-store, private"),
    );
    response
}

fn header_str(headers: &HeaderMap, name: HeaderName) -> Option<&str> {
    headers.get(name).and_then(|v| v.to_str().ok())
}

fn cookie<'a>(headers: &'a HeaderMap, name: &str) -> Option<&'a str> {
    headers
        .get_all(header::COOKIE)
        .iter()
        .filter_map(|v| v.to_str().ok())
        .flat_map(|v| v.split(';'))
        .filter_map(|pair| pair.trim().split_once('='))
        .find(|(key, _)| *key == name)
        .map(|(_, value)| value)
}

fn unsupported(method: &Method, allow: &'static str) -> Response {
    if *method == Method::CONNECT {
        return StatusCode::NOT_IMPLEMENTED.into_response();
    }
    let known = matches!(
        method.as_str(),
        "GET" | "HEAD" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS" | "TRACE" | "JELQ"
    );
    if method.as_str() == "BREW" {
        return Problem::new(
            StatusCode::IM_A_TEAPOT,
            "brew",
            "The server is a teapot. RFC 2324 is clear on this. It is not yet short and stout.",
        )
        .into_response();
    }
    if method.as_str().eq_ignore_ascii_case("jelq") {
        return Problem::new(
            StatusCode::NOT_IMPLEMENTED,
            "not-implemented",
            format!(
                "The server does not implement {method}. Methods are case-sensitive. JELQ is shouted for a reason."
            ),
        )
        .into_response();
    }
    if !known {
        return Problem::new(
            StatusCode::NOT_IMPLEMENTED,
            "not-implemented",
            format!("The server does not implement {method}."),
        )
        .into_response();
    }
    Problem::new(
        StatusCode::METHOD_NOT_ALLOWED,
        "method-not-allowed",
        format!("{method} is not supported here."),
    )
    .header(header::ALLOW, allow)
    .into_response()
}

fn options(allow: &'static str, patchable: bool) -> Response {
    let mut response = (
        StatusCode::OK,
        [(header::ALLOW, allow)],
        Json(json!({ "detail": THERAPY })),
    )
        .into_response();
    if patchable {
        response.headers_mut().insert(
            "accept-patch",
            HeaderValue::from_static("application/json-patch+json"),
        );
    }
    response
}

fn trace(method: &Method, uri: &Uri, version: Version, headers: &HeaderMap) -> Response {
    let mut message = format!("{method} {uri} {version:?}\r\n");
    for (name, value) in headers {
        let _ = write!(
            message,
            "{name}: {}\r\n",
            value.to_str().unwrap_or("<binary>")
        );
    }
    message.push_str("\r\n");
    (
        StatusCode::OK,
        [(header::CONTENT_TYPE, "message/http")],
        message,
    )
        .into_response()
}

fn links(run: &Run) -> String {
    let id = &run.id;
    let mut links = vec![format!("</runs/{id}>; rel=\"{REL_BASE}run\"")];
    for rel in [
        "floor",
        "length",
        "foreskin",
        "inventory",
        "techniques",
        "drawer",
        "grip",
        "diagnosis",
    ] {
        links.push(format!("</runs/{id}/{rel}>; rel=\"{REL_BASE}{rel}\""));
    }
    if run.floor.shop_open() {
        links.push(format!("</runs/{id}/shop>; rel=\"{REL_BASE}shop\""));
    }
    links.join(", ")
}

fn finish(run: &Run, mut response: Response) -> Response {
    let status = response.status();
    if status == StatusCode::NOT_MODIFIED {
        return response;
    }
    let mut stats = vec![
        (
            "x-self-reported-length",
            format!("{:.2}", run.self_reported()),
        ),
        ("x-girth", format!("{:.2}", run.girth)),
        (
            "x-foreskin",
            run.foreskin.map_or("gone".into(), |f| format!("{f:.2}")),
        ),
        ("x-eq", run.eq.to_string()),
        ("x-stamina", format!("{}/{MAX_STAMINA}", run.stamina)),
        (
            "x-suspicion",
            format!("{}/{SUSPICION_LIMIT}", run.suspicion),
        ),
        ("x-shame", run.total_shame().to_string()),
        ("x-cash", run.cash.to_string()),
        ("x-floor", run.floor.number().to_string()),
        ("link", links(run)),
    ];
    if let Some(observer) = run.observed {
        stats.push(("x-observed-by", observer.into()));
    }
    if run.mom_present {
        stats.push(("via", "1.1 mom".into()));
        stats.push(("vary", "Mom".into()));
    }
    // RFC 9111 obsoleted Warning, which is why nobody heeds it.
    if run.eq > 70 && run.ended.is_none() {
        stats.push(("warning", "199 - \"it is turning purple\"".into()));
    }
    stats.push((
        "set-cookie",
        format!(
            "shame={}; {COOKIE_ATTRIBUTES}",
            secret::sign("shame", &run.total_shame().to_string())
        ),
    ));
    if run.items.ruler {
        stats.push((
            "set-cookie",
            format!("ruler={}; {COOKIE_ATTRIBUTES}", secret::sign("ruler", "1")),
        ));
    }
    let headers = response.headers_mut();
    for (name, value) in stats {
        headers.append(name, HeaderValue::from_str(&value).expect("visible ascii"));
    }
    let bodiless = status.is_informational() || status == StatusCode::NO_CONTENT;
    if run.items.ring && !bodiless {
        response.extensions_mut().insert(Compress);
    }
    response
}

fn gone(run: &Run) -> Response {
    let ending = run.ended.as_ref().expect("only called on ended runs");
    Problem::new(StatusCode::GONE, "run-ended", "This run has ended.")
        .with("cause", format!("{PROBLEM_BASE}{}", ending.cause))
        .with("turn", ending.turn)
        .with("graveyard", "/graveyard")
        .into_response()
}

fn captive_portal(run: &Run) -> Response {
    Problem::new(
        StatusCode::NETWORK_AUTHENTICATION_REQUIRED,
        "captive-portal",
        "The network requires authentication. The hotel would like you to agree to some terms.",
    )
    .with("portal", format!("/runs/{}/portal", run.id))
    .header(
        header::LINK,
        format!("</runs/{}/portal>; rel=\"{REL_BASE}portal\"", run.id),
    )
    .into_response()
}

fn with_run(
    state: &AppState,
    id: &str,
    headers: &HeaderMap,
    scope: Scope,
    handle: impl FnOnce(&mut Run) -> Response,
) -> Response {
    let mut runs = state.runs.lock().unwrap();
    let Some(run) = runs.get_mut(id) else {
        return Problem::new(
            StatusCode::NOT_FOUND,
            "no-such-run",
            format!("There is no run {id}. There may never have been."),
        )
        .into_response();
    };
    if run.ended.is_some() {
        return gone(run);
    }
    run.observed = None;
    if scope == Scope::Home {
        if run.floor == Floor::Hotel && !run.wifi_accepted {
            return finish(run, captive_portal(run));
        }
        if run.floor.has_mom()
            && run.mom_present
            && let Err(problem) = run.answer_door(header_str(headers, header::AUTHORIZATION))
        {
            return finish(run, problem.into_response());
        }
    }
    let response = handle(run);
    finish(run, response)
}

fn respond<T: IntoResponse, E: IntoResponse>(result: Result<T, E>) -> Response {
    match result {
        Ok(ok) => ok.into_response(),
        Err(err) => err.into_response(),
    }
}

async fn runs(
    State(state): State<Shared>,
    method: Method,
    Query(query): Query<HashMap<String, String>>,
    headers: HeaderMap,
) -> Response {
    if method != Method::POST {
        return unsupported(&method, "POST");
    }
    let seeded = query.contains_key("seed");
    let seed = match query.get("seed").map(|s| s.parse::<u64>()) {
        None => rand::rng().random(),
        Some(Ok(seed)) => seed,
        Some(Err(_)) => {
            return Problem::new(
                StatusCode::BAD_REQUEST,
                "bad-seed",
                "The seed must be an unsigned 64-bit integer.",
            )
            .into_response();
        }
    };
    let shame = cookie(&headers, "shame")
        .and_then(|s| secret::verify("shame", s))
        .and_then(|s| s.parse().ok())
        .unwrap_or(0);
    let id = format!("{:08x}", rand::rng().random::<u32>());
    let mut run = Run::new(id.clone(), secret::mix_seed(seed), shame);
    run.seeded = seeded;
    let response = (
        StatusCode::CREATED,
        [
            (header::LOCATION, format!("/runs/{id}")),
            (header::ETAG, run.etag()),
            (HeaderName::from_static("x-seed"), seed.to_string()),
        ],
        Json(run.view()),
    )
        .into_response();
    let response = finish(&run, response);
    state.insert(run);
    response
}

#[allow(clippy::too_many_arguments)]
async fn run(
    State(state): State<Shared>,
    Path(id): Path<String>,
    method: Method,
    uri: Uri,
    version: Version,
    Query(query): Query<HashMap<String, String>>,
    headers: HeaderMap,
    body: Bytes,
) -> Response {
    let now = Instant::now();
    with_run(&state, &id, &headers, Scope::Home, |run| {
        match method.as_str() {
            "GET" | "HEAD" => {
                let accept = header_str(&headers, header::ACCEPT).unwrap_or_default();
                if accept.contains("reassurance") {
                    return Problem::new(
                        StatusCode::NOT_ACCEPTABLE,
                        "no-reassurance",
                        "The server does not produce reassurance.",
                    )
                    .into_response();
                }
                (
                    StatusCode::OK,
                    [(header::ETAG, run.etag())],
                    Json(run.view()),
                )
                    .into_response()
            }
            "JELQ" => jelq(run, &query, &headers, now),
            "PUT" => run.put().into_response(),
            "PATCH" => patch(run, &headers, &body),
            "DELETE" => {
                run.end("abandoned", "The run was abandoned.");
                StatusCode::NO_CONTENT.into_response()
            }
            "OPTIONS" => options(RUN_ALLOW, true),
            "TRACE" => {
                run.shame += 1;
                trace(&method, &uri, version, &headers)
            }
            _ => unsupported(&method, RUN_ALLOW),
        }
    })
}

fn jelq(
    run: &mut Run,
    query: &HashMap<String, String>,
    headers: &HeaderMap,
    now: Instant,
) -> Response {
    let techniques_href = format!("/runs/{}/techniques", run.id);
    let Some(names) = query.get("technique").filter(|n| !n.trim().is_empty()) else {
        return Problem::new(
            StatusCode::BAD_REQUEST,
            "technique-required",
            "No technique was specified.",
        )
        .with("techniques", techniques_href)
        .into_response();
    };
    let mut techniques = Vec::new();
    for name in names.split(',').map(str::trim).filter(|n| !n.is_empty()) {
        let Some(technique) = Technique::parse(name) else {
            return Problem::new(
                StatusCode::BAD_REQUEST,
                "unknown-technique",
                format!("{name} is not a technique."),
            )
            .with("techniques", techniques_href)
            .into_response();
        };
        techniques.push(technique);
    }
    let intensity = match query.get("intensity").map(|i| i.parse::<i32>()) {
        None => 5,
        Some(Ok(i)) if (1..=10).contains(&i) => i,
        Some(_) => {
            return Problem::new(
                StatusCode::BAD_REQUEST,
                "intensity-out-of-range",
                "Intensity is measured from 1 to 10.",
            )
            .into_response();
        }
    };
    let lube = match Lube::from_content_type(header_str(headers, header::CONTENT_TYPE)) {
        Ok(lube) => lube,
        Err(problem) => return problem.into_response(),
    };
    respond(run.jelq(&techniques, intensity, lube, now))
}

fn patch(run: &mut Run, headers: &HeaderMap, body: &[u8]) -> Response {
    let content_type = header_str(headers, header::CONTENT_TYPE).unwrap_or_default();
    if !content_type.starts_with("application/json-patch+json") {
        return Problem::new(
            StatusCode::UNSUPPORTED_MEDIA_TYPE,
            "patch-format",
            "Patches are accepted as application/json-patch+json.",
        )
        .header(
            HeaderName::from_static("accept-patch"),
            "application/json-patch+json",
        )
        .into_response();
    }
    match serde_json::from_slice::<Vec<PatchOp>>(body) {
        Ok(ops) => respond(run.patch(&ops)),
        Err(_) => Problem::new(
            StatusCode::BAD_REQUEST,
            "malformed-patch",
            "The patch could not be parsed.",
        )
        .into_response(),
    }
}

fn millimetres(inches: f64) -> usize {
    (inches * MM_PER_INCH).round() as usize
}

fn parse_inch_range(range: &str, total: f64) -> Option<(f64, f64)> {
    let (start, end) = range.strip_prefix("inches=")?.split_once('-')?;
    let start: f64 = start.trim().parse().ok()?;
    let end: f64 = match end.trim() {
        "" => total,
        end => end.parse().ok()?,
    };
    (start >= 0.0 && start < total && start <= end).then_some((start, end.min(total)))
}

fn length_response(run: &Run, headers: &HeaderMap) -> Response {
    let inches = if run.items.ruler {
        run.current_length()
    } else {
        run.self_reported()
    };
    let body = shaft(millimetres(inches));
    let content_type = (
        header::CONTENT_TYPE,
        "text/plain; charset=us-ascii".to_owned(),
    );
    let accept_ranges = (header::ACCEPT_RANGES, "inches".to_owned());

    if let Some(range) = header_str(headers, header::RANGE)
        && range.starts_with("inches=")
    {
        let Some((start, end)) = parse_inch_range(range, inches) else {
            return Problem::new(
                StatusCode::RANGE_NOT_SATISFIABLE,
                "range-not-satisfiable",
                format!("The requested range is not available. {inches:.2} inches are."),
            )
            .header(header::CONTENT_RANGE, format!("inches */{inches:.2}"))
            .into_response();
        };
        let from = millimetres(start).min(body.len() - 1);
        let to = millimetres(end).clamp(from + 1, body.len());
        let content_range = (
            header::CONTENT_RANGE,
            format!("inches {start:.2}-{end:.2}/{inches:.2}"),
        );
        return (
            StatusCode::PARTIAL_CONTENT,
            [content_type, accept_ranges, content_range],
            body[from..to].to_owned(),
        )
            .into_response();
    }

    if run.items.ruler {
        return (StatusCode::OK, [content_type, accept_ranges], body).into_response();
    }
    let chunks: Vec<Result<Bytes, Infallible>> = body
        .into_bytes()
        .chunks(16)
        .map(|c| Ok(Bytes::copy_from_slice(c)))
        .collect();
    let body = Body::from_stream(futures_util::stream::iter(chunks));
    (StatusCode::OK, [content_type, accept_ranges], body).into_response()
}

async fn length(
    State(state): State<Shared>,
    Path(id): Path<String>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    const ALLOW: &str = "GET, HEAD, OPTIONS";
    with_run(&state, &id, &headers, Scope::Home, |run| {
        match method.as_str() {
            "GET" | "HEAD" => length_response(run, &headers),
            "OPTIONS" => options(ALLOW, false),
            _ => unsupported(&method, ALLOW),
        }
    })
}

async fn foreskin(
    State(state): State<Shared>,
    Path(id): Path<String>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    const ALLOW: &str = "GET, HEAD, DELETE, OPTIONS";
    with_run(&state, &id, &headers, Scope::Home, |run| {
        match method.as_str() {
            "GET" | "HEAD" => match run.foreskin {
                Some(f) => (
                    StatusCode::OK,
                    [(header::ETAG, run.etag())],
                    Json(json!({ "foreskin": (f * 100.0).round() / 100.0 })),
                )
                    .into_response(),
                None => Problem::new(
                    StatusCode::GONE,
                    "foreskin-gone",
                    "The foreskin is gone. It will not be returning.",
                )
                .into_response(),
            },
            "DELETE" => respond(run.delete_foreskin(header_str(&headers, header::IF_MATCH))),
            "OPTIONS" => options(ALLOW, false),
            _ => unsupported(&method, ALLOW),
        }
    })
}

async fn inventory(
    State(state): State<Shared>,
    Path(id): Path<String>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    const ALLOW: &str = "GET, HEAD, OPTIONS";
    with_run(&state, &id, &headers, Scope::Pockets, |run| {
        match method.as_str() {
            "GET" | "HEAD" => {
                let listed: Vec<Value> = run
                    .inventory()
                    .into_iter()
                    .map(|(name, _)| {
                        json!({ "name": name, "href": format!("/runs/{}/inventory/{name}", run.id) })
                    })
                    .collect();
                Json(json!({
                    "items": listed,
                    "ice_packs": run.items.ice_packs,
                    "cash": run.cash,
                    "excuses": run.excuses(),
                }))
                .into_response()
            }
            "OPTIONS" => options(ALLOW, false),
            _ => unsupported(&method, ALLOW),
        }
    })
}

async fn item(
    State(state): State<Shared>,
    Path((id, name)): Path<(String, String)>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    const ALLOW: &str = "GET, HEAD, DELETE, OPTIONS";
    with_run(&state, &id, &headers, Scope::Pockets, |run| {
        let Some((name, description)) = run.inventory().into_iter().find(|(n, _)| *n == name)
        else {
            return Problem::new(
                StatusCode::NOT_FOUND,
                "no-such-item",
                "You do not have that.",
            )
            .into_response();
        };
        match method.as_str() {
            "GET" | "HEAD" => {
                Json(json!({ "name": name, "description": description })).into_response()
            }
            "DELETE" => respond(run.drop_item(name)),
            "OPTIONS" => options(ALLOW, false),
            _ => unsupported(&method, ALLOW),
        }
    })
}

async fn techniques(
    State(state): State<Shared>,
    Path(id): Path<String>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    const ALLOW: &str = "GET, HEAD, OPTIONS";
    with_run(&state, &id, &headers, Scope::Home, |run| {
        match method.as_str() {
            "GET" | "HEAD" => {
                let listed: Vec<Value> = Technique::ALL
                    .into_iter()
                    .map(|t| t.describe(run.forum_read))
                    .collect();
                Json(json!({
                    "usage": format!("JELQ /runs/{}?technique=<name>[,<name>]&intensity=<1-10>", run.id),
                    "lubricant": "Declared with Content-Type.",
                    "lubricants": LUBRICANTS,
                    "eq_band": [50, 70],
                    "techniques": listed,
                }))
                .into_response()
            }
            "OPTIONS" => options(ALLOW, false),
            _ => unsupported(&method, ALLOW),
        }
    })
}

async fn drawer(
    State(state): State<Shared>,
    Path(id): Path<String>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    with_run(&state, &id, &headers, Scope::Home, |run| {
        match method.as_str() {
            "POST" => respond(run.search_drawer()),
            "OPTIONS" => options("POST, OPTIONS", false),
            _ => unsupported(&method, "POST, OPTIONS"),
        }
    })
}

async fn branch(
    State(state): State<Shared>,
    Path((id, choice)): Path<(String, String)>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    with_run(&state, &id, &headers, Scope::Home, |run| {
        match method.as_str() {
            "POST" => respond(run.choose(&choice)),
            "OPTIONS" => options("POST, OPTIONS", false),
            _ => unsupported(&method, "POST, OPTIONS"),
        }
    })
}

async fn floor(
    State(state): State<Shared>,
    Path(id): Path<String>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    const ALLOW: &str = "GET, HEAD, POST, OPTIONS";
    with_run(&state, &id, &headers, Scope::Pockets, |run| {
        match method.as_str() {
            "GET" | "HEAD" => Json(run.floor_view()).into_response(),
            "POST" => respond(run.advance()),
            "OPTIONS" => options(ALLOW, false),
            _ => unsupported(&method, ALLOW),
        }
    })
}

async fn shop(
    State(state): State<Shared>,
    Path(id): Path<String>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    const ALLOW: &str = "GET, HEAD, OPTIONS";
    with_run(&state, &id, &headers, Scope::Home, |run| {
        match method.as_str() {
            "GET" | "HEAD" => respond(run.shop_view().map(Json)),
            "OPTIONS" => options(ALLOW, false),
            _ => unsupported(&method, ALLOW),
        }
    })
}

async fn buy(
    State(state): State<Shared>,
    Path((id, item)): Path<(String, String)>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    with_run(&state, &id, &headers, Scope::Home, |run| {
        match method.as_str() {
            "POST" => respond(run.buy(&item)),
            "OPTIONS" => options("POST, OPTIONS", false),
            _ => unsupported(&method, "POST, OPTIONS"),
        }
    })
}

async fn portal(
    State(state): State<Shared>,
    Path(id): Path<String>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    const ALLOW: &str = "GET, HEAD, POST, OPTIONS";
    with_run(&state, &id, &headers, Scope::Pockets, |run| {
        match method.as_str() {
            "GET" | "HEAD" => Json(json!({
                "terms": "By connecting you agree that the hotel is not responsible for anything that happens in this room, and that it does not want to know.",
                "accept": { "href": format!("/runs/{}/portal", run.id), "method": "POST" },
            }))
            .into_response(),
            "POST" => respond(run.accept_terms()),
            "OPTIONS" => options(ALLOW, false),
            _ => unsupported(&method, ALLOW),
        }
    })
}

async fn elder(
    State(state): State<Shared>,
    Path(id): Path<String>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    const ALLOW: &str = "GET, HEAD, OPTIONS";
    with_run(&state, &id, &headers, Scope::Home, |run| {
        match method.as_str() {
            "GET" | "HEAD" => respond(run.elder(
                header_str(&headers, header::PROXY_AUTHORIZATION),
                header_str(&headers, header::IF_MODIFIED_SINCE),
            )),
            "OPTIONS" => options(ALLOW, false),
            _ => unsupported(&method, ALLOW),
        }
    })
}

fn requested_grip(headers: &HeaderMap) -> Option<Grip> {
    let connection = header_str(headers, header::CONNECTION)?.to_ascii_lowercase();
    if !connection.split(',').any(|token| token.trim() == "upgrade") {
        return None;
    }
    header_str(headers, header::UPGRADE)?
        .split(',')
        .find_map(|protocol| Grip::parse(protocol.trim()))
}

async fn grip(
    State(state): State<Shared>,
    Path(id): Path<String>,
    mut request: Request,
) -> Response {
    const ALLOW: &str = "GET, HEAD, OPTIONS";
    let method = request.method().clone();
    let headers = request.headers().clone();
    let wanted = requested_grip(&headers);
    let upgrade = wanted.map(|_| hyper::upgrade::on(&mut request));
    let detail = match header_str(&headers, header::UPGRADE) {
        Some(protocol) if wanted.is_none() => {
            format!("The server does not know the {protocol} grip. Grips are protocols.")
        }
        _ => "Grips are protocols. Change grip by upgrading the connection.".to_owned(),
    };
    let response = with_run(&state, &id, &headers, Scope::Home, |run| {
        match (method.as_str(), wanted) {
            ("GET" | "HEAD", Some(grip)) => {
                run.set_grip(grip);
                (
                    StatusCode::SWITCHING_PROTOCOLS,
                    [
                        (header::UPGRADE, grip.name()),
                        (header::CONNECTION, "upgrade"),
                    ],
                )
                    .into_response()
            }
            ("GET" | "HEAD", None) => (
                StatusCode::OK,
                [(header::UPGRADE, "overhand, underhand")],
                Json(json!({
                    "grip": run.grip.name(),
                    "detail": detail,
                })),
            )
                .into_response(),
            ("OPTIONS", _) => options(ALLOW, false),
            _ => unsupported(&method, ALLOW),
        }
    });
    if response.status() == StatusCode::SWITCHING_PROTOCOLS
        && let (Some(upgrade), Some(grip)) = (upgrade, wanted)
    {
        tokio::spawn(async move {
            if let Ok(upgraded) = upgrade.await {
                let mut io = TokioIo::new(upgraded);
                let line = format!("You are now jelqing {}.\r\n", grip.name());
                let _ = io.write_all(line.as_bytes()).await;
                let _ = io.shutdown().await;
            }
        });
    }
    response
}

async fn diagnosis(
    State(state): State<Shared>,
    Path(id): Path<String>,
    method: Method,
    headers: HeaderMap,
) -> Response {
    const ALLOW: &str = "GET, HEAD, OPTIONS";
    with_run(&state, &id, &headers, Scope::Pockets, |run| {
        match method.as_str() {
            "GET" | "HEAD" => respond(run.diagnose(
                header_str(&headers, header::AUTHORIZATION),
                header_str(&headers, header::IF_NONE_MATCH),
            )),
            "OPTIONS" => options(ALLOW, false),
            _ => unsupported(&method, ALLOW),
        }
    })
}

async fn thread(Path(year): Path<String>, method: Method) -> Response {
    if method != Method::GET && method != Method::HEAD {
        return unsupported(&method, "GET, HEAD");
    }
    match year.parse::<u32>() {
        Ok(2009) => (
            [(header::LAST_MODIFIED, ELDER_LAST_MODIFIED)],
            Json(forum_thread()),
        )
            .into_response(),
        Ok(y) if y > 2009 => Problem::new(
            StatusCode::NOT_FOUND,
            "no-thread",
            "Nobody has posted since 2009.",
        )
        .with("thread", FORUM_THREAD)
        .into_response(),
        _ => Problem::new(
            StatusCode::NOT_FOUND,
            "no-thread",
            "The forum did not exist yet. The problem did.",
        )
        .with("thread", FORUM_THREAD)
        .into_response(),
    }
}

async fn graveyard(State(state): State<Shared>, method: Method) -> Response {
    if method != Method::GET && method != Method::HEAD {
        return unsupported(&method, "GET, HEAD");
    }
    let runs = state.runs.lock().unwrap();
    let dead: Vec<Value> = runs
        .values()
        .filter_map(|run| {
            let ending = run.ended.as_ref()?;
            Some(json!({
                "id": run.id,
                "cause": format!("{PROBLEM_BASE}{}", ending.cause),
                "detail": ending.detail,
                "turn": ending.turn,
            }))
        })
        .collect();
    Json(json!({ "runs": dead })).into_response()
}

async fn leaderboard(
    State(state): State<Shared>,
    method: Method,
    Query(query): Query<HashMap<String, String>>,
    headers: HeaderMap,
) -> Response {
    if method != Method::GET && method != Method::HEAD {
        return unsupported(&method, "GET, HEAD");
    }
    let truthful = match query.get("sort").map(String::as_str) {
        None | Some("self-reported-length") => false,
        Some("content-length") => match cookie(&headers, "ruler") {
            Some(ruler) if secret::verify("ruler", ruler) == Some("1") => true,
            Some(_) => {
                return Problem::new(
                    StatusCode::BAD_REQUEST,
                    "exaggeration",
                    "The server has measured. Lying is not a technique.",
                )
                .with("cookie", "ruler")
                .into_response();
            }
            None => {
                return Problem::new(
                    StatusCode::FORBIDDEN,
                    "ruler-required",
                    "Sorting by the truth requires a Ruler.",
                )
                .into_response();
            }
        },
        Some(_) => {
            return Problem::new(
                StatusCode::BAD_REQUEST,
                "unknown-sort",
                "The leaderboard sorts by self-reported-length or content-length.",
            )
            .into_response();
        }
    };
    let include_seeded = query.get("seeded").is_some_and(|s| s == "include");
    let runs = state.runs.lock().unwrap();
    let mut entries: Vec<&Run> = runs
        .values()
        .filter(|run| include_seeded || !run.seeded)
        .collect();
    let key = |r: &Run| {
        if truthful {
            r.current_length()
        } else {
            r.self_reported()
        }
    };
    entries.sort_by(|a, b| key(b).total_cmp(&key(a)));
    let entries: Vec<Value> = entries
        .into_iter()
        .map(|run| {
            let mut entry = json!({
                "id": run.id,
                "status": run.status(),
                "floor": run.floor.number(),
                "self_reported_length": (run.self_reported() * 100.0).round() / 100.0,
                "ranked": !run.seeded,
            });
            if truthful {
                entry["content_length"] = json!(millimetres(run.current_length()));
            }
            entry
        })
        .collect();
    Json(json!({ "entries": entries })).into_response()
}

async fn index(method: Method, headers: HeaderMap) -> Response {
    if method != Method::GET && method != Method::HEAD {
        return unsupported(&method, "GET, HEAD");
    }
    let wants_html =
        header_str(&headers, header::ACCEPT).is_some_and(|accept| accept.contains("text/html"));
    if wants_html {
        return (
            StatusCode::SEE_OTHER,
            [(header::LOCATION, "/ui/"), (header::VARY, "Accept")],
        )
            .into_response();
    }
    (
        [(header::VARY, "Accept")],
        Json(json!({
            "detail": "This is jelqd. It is a roguelike. It is played over HTTP.",
            "start": { "href": "/runs", "method": "POST" },
            "leaderboard": "/leaderboard",
            "graveyard": "/graveyard",
            "forum": FORUM_THREAD,
            "ui": "/ui/",
        })),
    )
        .into_response()
}

async fn ui(method: Method) -> Response {
    if method != Method::GET && method != Method::HEAD {
        return unsupported(&method, "GET, HEAD");
    }
    Html(include_str!("ui.html")).into_response()
}

#[derive(Deserialize)]
struct Envelope {
    method: String,
    path: String,
    #[serde(default)]
    headers: Vec<(String, String)>,
    #[serde(default)]
    body: String,
}

fn bad_envelope(detail: &str) -> Response {
    Problem::new(StatusCode::BAD_REQUEST, "bad-envelope", detail).into_response()
}

// Browsers hide 3xx responses from fetch and refuse TRACE, Upgrade, and Expect, so the page
// replays requests in-process to show the player exactly what the API said.
async fn ui_send(State(api): State<Router>, headers: HeaderMap, body: Bytes) -> Response {
    let Ok(envelope) = serde_json::from_slice::<Envelope>(&body) else {
        return bad_envelope("The envelope could not be parsed.");
    };
    if !envelope.path.starts_with('/') || envelope.path.starts_with("/ui") {
        return bad_envelope("The path must be an API path.");
    }
    let Ok(method) = Method::from_bytes(envelope.method.as_bytes()) else {
        return bad_envelope("That is not a method.");
    };
    let mut request = Request::builder().method(method).uri(&envelope.path);
    for (name, value) in envelope.headers.iter().filter(|(_, v)| !v.is_empty()) {
        request = request.header(name, value);
    }
    for cookie in headers.get_all(header::COOKIE) {
        request = request.header(header::COOKIE, cookie);
    }
    let Ok(request) = request.body(Body::from(envelope.body)) else {
        return bad_envelope("The request could not be built. A header may be malformed.");
    };
    let Ok(response) = api.oneshot(request).await;
    let (parts, body) = response.into_parts();
    let bytes = axum::body::to_bytes(body, 1 << 20)
        .await
        .unwrap_or_default();
    let listed: Vec<(String, String)> = parts
        .headers
        .iter()
        .map(|(name, value)| {
            (
                name.to_string(),
                value.to_str().unwrap_or("<binary>").to_owned(),
            )
        })
        .collect();
    let mut response = Json(json!({
        "status": parts.status.as_u16(),
        "reason": reason(parts.status),
        "headers": listed,
        "body": String::from_utf8_lossy(&bytes),
    }))
    .into_response();
    for cookie in parts.headers.get_all(header::SET_COOKIE) {
        response
            .headers_mut()
            .append(header::SET_COOKIE, cookie.clone());
    }
    response
}

async fn not_found() -> Problem {
    Problem::new(
        StatusCode::NOT_FOUND,
        "not-found",
        "The resource does not exist. This is not about you.",
    )
}