import { env } from "cloudflare:workers";
import { viewerFromSessionCookie } from "../auth";
import { first } from "../db";
import { randomToken, sha256Hex } from "../crypto";
import { HttpError } from "../errors";
import { limitWrite } from "../limits";
import { hasPermission, loadRepoById, repoPermission } from "../repos";
import { codeKey, labelUrl, siteOrigin } from "./config";
import { CALLBACK_PATH } from "./access";
import { resolveSiteHost } from "./dispatch";
import { claimScratchSite } from "./scratch";
import { html } from "./static";
import { claimPage } from "./claim-page";
import type { SiteMeta } from "./config";
import type { Viewer } from "~/lib/types";

const CODE_TTL_SECONDS = 60;

function page(status: number, title: string, body: string): Response {
  return html(
    status,
    `<!doctype html><meta name="viewport" content="width=device-width"><title>${title}</title>
<body style="font-family:system-ui;max-width:30rem;margin:4rem auto;line-height:1.5"><h1 style="font-size:1.25rem">${title}</h1>${body}</body>`,
  );
}

function escapeHtml(value: string): string {
  return value.replace(/[&<>"']/g, (char) => `&#${char.charCodeAt(0)};`);
}

function signInFirst(): Response {
  return page(
    401,
    "Sign in to continue",
    `<p>Sign in to ${escapeHtml(env.FORGE_NAME)} in this browser, then return to the site and try again.</p><p><a href="/login">Sign in</a></p>`,
  );
}

async function allowed(site: SiteMeta, viewer: Viewer): Promise<boolean> {
  if (!site.repoId) return site.ownerId === viewer.id;
  const repo = await loadRepoById(site.repoId);
  if (!repo) return false;
  const permission = await repoPermission(repo, viewer);
  if (site.audience === "readers") return hasPermission(permission, "read");
  if (hasPermission(permission, "write")) return true;
  const member = await first<{ user_id: string }>(
    "SELECT user_id FROM org_members WHERE org_id = ? AND user_id = ?",
    repo.owner_id,
    viewer.id,
  );
  return member !== null;
}

/** "Sign in with gitfor": the forge is the IdP; it hands the site host a single-use code, never its session. */
async function authorize(request: Request, url: URL): Promise<Response> {
  const viewer = await viewerFromSessionCookie(request);
  if (!viewer) return signInFirst();
  const params = request.method === "POST" ? new URLSearchParams(await request.text()) : url.searchParams;
  const siteId = params.get("site") ?? "";
  const host = (params.get("host") ?? "").toLowerCase();
  const state = params.get("state") ?? "";
  if (!/^[A-Za-z0-9_]{8,100}$/.test(state)) return page(400, "Invalid request", "<p>Missing sign-in state.</p>");
  const resolved = await resolveSiteHost(host.replace(/:\d+$/, ""));
  if (!resolved || resolved.meta.id !== siteId || resolved.meta.access !== "gitfor") {
    return page(400, "Invalid request", "<p>That site does not use gitfor sign-in.</p>");
  }
  if (!(await allowed(resolved.meta, viewer))) {
    return page(403, "Access denied", `<p>@${escapeHtml(viewer.name)} is not allowed to view this site.</p>`);
  }
  if (request.method !== "POST") {
    const fields = [
      ["site", siteId],
      ["host", host],
      ["state", state],
    ]
      .map(([key, value]) => `<input type="hidden" name="${key}" value="${escapeHtml(value)}">`)
      .join("");
    return page(
      200,
      "Continue to site",
      `<p><strong>${escapeHtml(host)}</strong> wants to know you are @${escapeHtml(viewer.name)} on ${escapeHtml(env.FORGE_NAME)}. It will see your username, and nothing else.</p>
<form method="post" action="/sites/authorize">${fields}<button>Continue as @${escapeHtml(viewer.name)}</button></form>`,
    );
  }
  const code = randomToken("sc");
  await env.KV.put(codeKey(await sha256Hex(code)), JSON.stringify({ siteId, host, subject: viewer.name }), {
    expirationTtl: CODE_TTL_SECONDS,
  });
  const target = new URL(CALLBACK_PATH, siteOrigin(host.replace(/:\d+$/, "")));
  target.searchParams.set("code", code);
  target.searchParams.set("state", state);
  return new Response(null, { status: 303, headers: { location: target.toString(), "cache-control": "no-store" } });
}

async function claim(request: Request, url: URL): Promise<Response> {
  const viewer = await viewerFromSessionCookie(request);
  if (!viewer) return signInFirst();
  if (request.method === "GET") {
    // `?token=` is still accepted for links issued before the token moved into the fragment.
    return claimPage(viewer.name, url.searchParams.get("token") ?? "", randomToken("n").replace(/[^A-Za-z0-9]/g, ""));
  }
  await limitWrite(viewer);
  const form = await request.formData();
  try {
    const site = await claimScratchSite(String(form.get("token") ?? ""), viewer, form.get("public") === "on");
    const link = labelUrl(site.label) ?? "";
    return page(
      200,
      "Site claimed",
      `<p>Your site now lives at <a href="${escapeHtml(link)}">${escapeHtml(link)}</a>.</p>`,
    );
  } catch (error) {
    if (error instanceof HttpError)
      return page(error.status, "Could not claim site", `<p>${escapeHtml(error.message)}</p>`);
    throw error;
  }
}

/** Forge-origin routes for sites: the IdP authorize endpoint and the scratch claim page. */
export async function handleSitesForgeRoutes(request: Request, url: URL): Promise<Response | null> {
  if (url.pathname === "/sites/authorize" && (request.method === "GET" || request.method === "POST")) {
    return authorize(request, url);
  }
  if (url.pathname === "/sites/claim" && (request.method === "GET" || request.method === "POST")) {
    return claim(request, url);
  }
  return null;
}