malice

use axum::response::Json;

use axum::{

    extract::Request,

    http::{HeaderMap, Method, StatusCode, header},

    middleware::Next,

    response::{IntoResponse, Response},

};

use serde_json::json;

pub const COOKIE_NAME: &str = "malice_session";

const COOKIE_MAX_AGE: u32 = 2_592_000;

/// Parse the opaque session id from the `Cookie` header.

///

/// Returns `None` when the cookie is absent or malformed. The value is

/// restricted to a safe alphabet so it can be used as a file name.

pub fn session_sid(headers: &HeaderMap) -> Option<String> {

    for value in headers.get_all(header::COOKIE) {

        let Ok(raw) = value.to_str() else {

            continue;

        };

        for part in raw.split(';') {

            let part = part.trim();

            let Some((name, val)) = part.split_once('=') else {

                continue;

            };

            if name.trim() != COOKIE_NAME {

                continue;

            }

            let val = val.trim().trim_matches('"');

            if valid_sid(val) {

                return Some(val.to_owned());

            }

        }

    }

    None

}

pub fn valid_sid(value: &str) -> bool {

    !value.is_empty()

        && value.len() <= 128

        && value

            .chars()

            .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_')

}

pub fn set_cookie_value(sid: &str, secure: bool) -> String {

    let mut cookie =

        format!("{COOKIE_NAME}={sid}; Path=/; HttpOnly; SameSite=Lax; Max-Age={COOKIE_MAX_AGE}");

    if secure {

        cookie.push_str("; Secure");

    }

    cookie

}

pub fn clear_cookie_value(secure: bool) -> String {

    let mut cookie = format!("{COOKIE_NAME}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0");

    if secure {

        cookie.push_str("; Secure");

    }

    cookie

}

/// Reject cross-origin mutating API requests. Port is part of an origin:

/// another app on the same host must not be able to drive this user's cookie.

/// The dev proxy preserves Host, so its forwarded requests remain same-origin.

pub async fn csrf_guard(request: Request, next: Next) -> Response {

    let method = request.method().clone();

    let path = request.uri().path().to_owned();

    let is_api = path == "/api" || path.starts_with("/api/");

    let is_mutating = method != Method::GET && method != Method::HEAD && method != Method::OPTIONS;

    if !(is_api && is_mutating) {

        return next.run(request).await;

    }

    let headers = request.headers();

    // Host only: X-Forwarded-Host is client-controlled and must not decide

    // same-origin. The Host the backend received is what the browser used,

    // which is exactly what Origin must match.

    let host = headers

        .get(header::HOST)

        .and_then(|value| value.to_str().ok())

        .unwrap_or("");

    let origin = headers

        .get(header::ORIGIN)

        .and_then(|value| value.to_str().ok());

    let referer = headers

        .get(header::REFERER)

        .and_then(|value| value.to_str().ok());

    let allowed = match (origin, referer) {

        (Some(value), _) => same_authority(value, host),

        (None, Some(value)) => same_authority(value, host),

        (None, None) => true,

    };

    if !allowed {

        return (

            StatusCode::FORBIDDEN,

            Json(json!({"message": "origin check failed"})),

        )

            .into_response();

    }

    next.run(request).await

}

fn same_authority(source: &str, host: &str) -> bool {

    source.parse::<axum::http::Uri>().ok().is_some_and(|uri| {

        matches!(uri.scheme_str(), Some("http" | "https"))

            && uri

                .authority()

                .is_some_and(|authority| authority.as_str().eq_ignore_ascii_case(host))

    })

}