malice

use std::sync::Arc;

use axum::{

    Router,

    extract::{DefaultBodyLimit, Multipart, Query, State},

    http::{HeaderMap, HeaderName, HeaderValue, StatusCode, header},

    middleware,

    middleware::Next,

    response::{IntoResponse, Response, Sse, sse::Event as SseEvent},

    routing::{any, get, post},

};

use futures_util::StreamExt;

use macltok::Retain;

use malice_core::{

    feed::subscribe,

    login::{LoginInput, sanitise_auth_error},

    request::{Reply, Request, dispatch},

};

use serde::{Deserialize, Serialize};

use tower_http::{

    services::{ServeDir, ServeFile},

    trace::TraceLayer,

};

use crate::{

    csrf::{csrf_guard, session_sid, set_cookie_value},

    error::{ApiError, json_ok, no_content},

    state::{AppState, RestoreError, UserSession},

};

#[derive(Debug, Deserialize)]

struct RoomIdBody {

    #[serde(default)]

    room_id: String,

}

#[derive(Debug, Deserialize)]

struct SendBody {

    #[serde(default)]

    room_id: String,

    #[serde(default)]

    body: String,

}

#[derive(Debug, Deserialize)]

struct PaginateBody {

    #[serde(default)]

    room_id: String,

}

#[derive(Debug, Deserialize)]

struct JoinBody {

    #[serde(default)]

    room: String,

}

#[derive(Debug, Deserialize)]

struct CreateBody {

    #[serde(default)]

    name: String,

    #[serde(default)]

    topic: Option<String>,

}

#[derive(Debug, Deserialize)]

struct ReactBody {

    #[serde(default)]

    room_id: String,

    #[serde(default)]

    event_id: String,

    #[serde(default)]

    key: String,

}

#[derive(Debug, Deserialize)]

struct ReadBody {

    #[serde(default)]

    room_id: String,

    #[serde(default)]

    event_id: String,

}

#[derive(Debug, Deserialize)]

struct MembersQuery {

    #[serde(default)]

    room_id: String,

}

#[derive(Debug, Deserialize)]

struct RecoverBody {

    recovery_key: String,

}

#[derive(Debug, Deserialize)]

struct VerifyBody {

    action: String,

}

#[derive(Debug, Deserialize)]

struct MediaQuery {

    mxc: String,

}

#[derive(Debug, Deserialize)]

struct MessageMediaQuery {

    media_id: String,

    size: String,

}

#[derive(Debug, Deserialize)]

struct TypingBody {

    #[serde(default)]

    room_id: String,

    #[serde(default)]

    typing: bool,

}

#[derive(Debug, Serialize)]

struct SoftLogoutInfo {

    user_id: String,

    homeserver: String,

}

#[derive(Debug, Serialize)]

struct SessionResponse {

    user_id: Option<String>,

    #[serde(skip_serializing_if = "Option::is_none")]

    soft_logout: Option<SoftLogoutInfo>,

}

async fn auth(

    state: &AppState,

    headers: &HeaderMap,

) -> Result<(Arc<UserSession>, String), ApiError> {

    let Some(sid) = session_sid(headers) else {

        return Err(ApiError::unauthorized("not signed in"));

    };

    match state.get_or_restore(&sid).await {

        Ok(user) => Ok((user, sid)),

        Err(RestoreError::NotFound) => Err(ApiError::unauthorized_stale(

            "session expired; sign in again",

            state.cookie_secure(),

        )),

        Err(RestoreError::SoftLoggedOut { .. }) => Err(ApiError::unauthorized(

            "signed out by the server, sign in again",

        )),

        Err(RestoreError::Stale(message)) => {

            state.remove_session(&sid, Retain::Nothing).await;

            Err(ApiError::unauthorized_stale(message, state.cookie_secure()))

        }

        Err(RestoreError::Unavailable(message)) => {

            Err(ApiError::new(StatusCode::BAD_GATEWAY, message))

        }

    }

}

/// commands answer when they're done, so the browser gets the outcome in the response

fn respond(result: Result<Reply, malice_core::error::CoreError>) -> Response {

    match result {

        Ok(Reply::Done) => no_content(None),

        Ok(Reply::Json(value)) => json_ok(&value, None),

        Ok(Reply::Avatar {

            bytes,

            content_type,

        }) => (

            [

                (axum::http::header::CONTENT_TYPE, content_type),

                (axum::http::header::CACHE_CONTROL, "private, max-age=3600"),

                (axum::http::header::X_CONTENT_TYPE_OPTIONS, "nosniff"),

            ],

            bytes,

        )

            .into_response(),

        Ok(Reply::Attachment {

            bytes,

            content_type,

        }) => (

            [

                (

                    axum::http::header::CONTENT_TYPE,

                    content_type.unwrap_or("application/octet-stream"),

                ),

                (

                    axum::http::header::CONTENT_DISPOSITION,

                    if content_type.is_some() {

                        "inline"

                    } else {

                        "attachment"

                    },

                ),

                (axum::http::header::CACHE_CONTROL, "private, max-age=3600"),

                (axum::http::header::X_CONTENT_TYPE_OPTIONS, "nosniff"),

                (axum::http::header::CONTENT_SECURITY_POLICY, "sandbox"),

            ],

            bytes,

        )

            .into_response(),

        Err(error) => ApiError::from(error).into_response(),

    }

}

async fn get_session(State(state): State<AppState>, headers: HeaderMap) -> Response {

    let Some(sid) = session_sid(&headers) else {

        return json_ok(

            &SessionResponse {

                user_id: None,

                soft_logout: None,

            },

            None,

        );

    };

    match state.get_or_restore(&sid).await {

        Ok(user) => json_ok(

            &SessionResponse {

                user_id: Some(user.user_id.clone()),

                soft_logout: None,

            },

            None,

        ),

        Err(RestoreError::NotFound) => json_ok(

            &SessionResponse {

                user_id: None,

                soft_logout: None,

            },

            None,

        ),

        Err(RestoreError::SoftLoggedOut {

            user_id,

            homeserver,

        }) => json_ok(

            &SessionResponse {

                user_id: None,

                soft_logout: Some(SoftLogoutInfo {

                    user_id,

                    homeserver,

                }),

            },

            None,

        ),

        Err(RestoreError::Stale(message)) => {

            state.remove_session(&sid, Retain::Nothing).await;

            ApiError::unauthorized_stale(message, state.cookie_secure()).into_response()

        }

        Err(RestoreError::Unavailable(message)) => {

            ApiError::new(StatusCode::BAD_GATEWAY, message).into_response()

        }

    }

}

async fn post_login(

    State(state): State<AppState>,

    headers: HeaderMap,

    body: axum::Json<LoginInput>,

) -> Response {

    let input = match body.0.validate(state.allow_http_homeserver()) {

        Ok(input) => input,

        Err(error) => return ApiError::from(error).into_response(),

    };

    let cookie_sid = session_sid(&headers);

    let password = input.password.clone();

    match state

        .login(

            cookie_sid.as_deref(),

            input.homeserver,

            input.username,

            input.password,

        )

        .await

    {

        Ok(user) => json_ok(

            &serde_json::json!({ "user_id": user.user_id }),

            Some(set_cookie_value(&user.sid, state.cookie_secure())),

        ),

        Err(message) => {

            let status = if message.contains("starting sync engine")

                || message.contains("could not save the session")

                || message.contains("another engine is using this session")

            {

                StatusCode::BAD_GATEWAY

            } else {

                StatusCode::UNAUTHORIZED

            };

            ApiError::new(status, sanitise_auth_error(&message, &password)).into_response()

        }

    }

}

async fn post_logout(State(state): State<AppState>, headers: HeaderMap) -> Response {

    if let Some(sid) = session_sid(&headers) {

        state.logout(&sid).await;

    }

    no_content(Some(crate::csrf::clear_cookie_value(state.cookie_secure())))

}

async fn get_rooms(State(state): State<AppState>, headers: HeaderMap) -> Response {

    let (user, _) = match auth(&state, &headers).await {

        Ok(pair) => pair,

        Err(error) => return error.into_response(),

    };

    respond(dispatch(&user.handle, &user.mirror, Request::Rooms).await)

}

async fn get_members(

    State(state): State<AppState>,

    headers: HeaderMap,

    Query(query): Query<MembersQuery>,

) -> Response {

    let (user, _) = match auth(&state, &headers).await {

        Ok(pair) => pair,

        Err(error) => return error.into_response(),

    };

    respond(

        dispatch(

            &user.handle,

            &user.mirror,

            Request::Members {

                room_id: query.room_id,

            },

        )

        .await,

    )

}

async fn rooms_open(

    State(state): State<AppState>,

    headers: HeaderMap,

    body: axum::Json<RoomIdBody>,

) -> Response {

    let (user, _) = match auth(&state, &headers).await {

        Ok(pair) => pair,

        Err(error) => return error.into_response(),

    };

    respond(

        dispatch(

            &user.handle,

            &user.mirror,

            Request::Open {

                room_id: body.0.room_id,

            },

        )

        .await,

    )

}

async fn rooms_close(

    State(state): State<AppState>,

    headers: HeaderMap,

    body: axum::Json<RoomIdBody>,

) -> Response {

    let (user, _) = match auth(&state, &headers).await {

        Ok(pair) => pair,

        Err(error) => return error.into_response(),

    };

    respond(

        dispatch(

            &user.handle,

            &user.mirror,

            Request::Close {

                room_id: body.0.room_id,

            },

        )

        .await,

    )

}

async fn rooms_send(

    State(state): State<AppState>,

    headers: HeaderMap,

    body: axum::Json<SendBody>,

) -> Response {

    let (user, _) = match auth(&state, &headers).await {

        Ok(pair) => pair,

        Err(error) => return error.into_response(),

    };

    respond(

        dispatch(

            &user.handle,

            &user.mirror,

            Request::Send {

                room_id: body.0.room_id,

                body: body.0.body,

            },

        )

        .await,

    )

}

async fn rooms_upload(

    State(state): State<AppState>,

    headers: HeaderMap,

    mut upload: Multipart,

) -> Response {

    let (user, _) = match auth(&state, &headers).await {

        Ok(pair) => pair,

        Err(error) => return error.into_response(),

    };

    let mut room_id = None;

    let mut file = None;

    loop {

        let field = match upload.next_field().await {

            Ok(Some(field)) => field,

            Ok(None) => break,

            Err(_) => return ApiError::bad_request("invalid upload form").into_response(),

        };

        match field.name() {

            Some("room_id") if room_id.is_none() => {

                room_id = match field.text().await {

                    Ok(value) => Some(value),

                    Err(_) => return ApiError::bad_request("invalid room_id").into_response(),

                };

            }

            Some("file") if file.is_none() => {

                let filename = field.file_name().unwrap_or("attachment").to_owned();

                let mimetype = field

                    .content_type()

                    .unwrap_or("application/octet-stream")

                    .to_owned();

                let bytes = match field.bytes().await {

                    Ok(bytes) => bytes,

                    Err(_) => return ApiError::bad_request("invalid file").into_response(),

                };

                if bytes.is_empty() || bytes.len() > 20 * 1024 * 1024 {

                    return ApiError::bad_request("file must be between 1 byte and 20 MiB")

                        .into_response();

                }

                file = Some((filename, mimetype, bytes));

            }

            _ => return ApiError::bad_request("unexpected upload field").into_response(),

        }

    }

    let Some(room_id) = room_id else {

        return ApiError::bad_request("room_id is required").into_response();

    };

    let Some((filename, mimetype, bytes)) = file else {

        return ApiError::bad_request("file is required").into_response();

    };

    respond(

        dispatch(

            &user.handle,

            &user.mirror,

            Request::upload(room_id, filename, mimetype, bytes.to_vec()),

        )

        .await,

    )

}

async fn rooms_paginate(

    State(state): State<AppState>,

    headers: HeaderMap,

    body: axum::Json<PaginateBody>,

) -> Response {

    let (user, _) = match auth(&state, &headers).await {

        Ok(pair) => pair,

        Err(error) => return error.into_response(),

    };

    respond(

        dispatch(

            &user.handle,

            &user.mirror,

            Request::Paginate {

                room_id: body.0.room_id,

            },

        )

        .await,

    )

}

async fn rooms_join(

    State(state): State<AppState>,

    headers: HeaderMap,

    body: axum::Json<JoinBody>,

) -> Response {

    let (user, _) = match auth(&state, &headers).await {

        Ok(pair) => pair,

        Err(error) => return error.into_response(),

    };

    respond(

        dispatch(

            &user.handle,

            &user.mirror,

            Request::Join { room: body.0.room },

        )

        .await,

    )

}

async fn rooms_create(

    State(state): State<AppState>,

    headers: HeaderMap,

    body: axum::Json<CreateBody>,

) -> Response {

    let (user, _) = match auth(&state, &headers).await {

        Ok(pair) => pair,