/* SPDX-License-Identifier: GPL-3.0-only */
#include "web_broker_settings.h"

#include <inttypes.h>
#include <stdio.h>
#include <string.h>
#include "admin_ssh_console.h"
#include "esp_timer.h"
#include "freertos/FreeRTOS.h"
#include "secure_random.h"
#include "session_broker.h"
#include "web_cookie_auth.h"
#include "web_httpd_adapter.h"

enum { IDLE, PENDING, OK, FAILED, CANCELLED, CONFLICT };
static const char *const s_states[] = {"idle", "pending", "ok", "failed", "cancelled", "conflict"};
typedef struct {
    uint32_t id;
    web_session_id_t session;
    user_principal_t principal;
    int64_t deadline;
    uint32_t generation, target;
    unsigned state;
} broker_operation_t;
static portMUX_TYPE s_lock = portMUX_INITIALIZER_UNLOCKED;
static broker_operation_t s_operation;
static uint32_t s_next_id;

/* Narrow flat JSON: exact action plus two unsigned decimal integers, no
 * escapes, duplicates, unknown fields, nesting, fractions or exponents. */
static bool parse(const char *body, size_t length, broker_operation_t *operation)
{
    const char *keys[] = {"action", "generation", "target"};
    unsigned seen = 0;
    size_t pos = 0;
#define SPACE() while (pos < length && (body[pos] == ' ' || body[pos] == '\t' || body[pos] == '\r' || body[pos] == '\n')) ++pos
#define TAKE(c) do { SPACE(); if (pos == length || body[pos++] != (c)) return false; } while (0)
    TAKE('{');
    for (unsigned field = 0; field < 3; ++field) {
        if (field) { TAKE(','); }
        TAKE('"');
        size_t start = pos;
        while (pos < length && body[pos] != '"') ++pos;
        if (pos == length) return false;
        unsigned key = 0;
        for (; key < 3; ++key)
            if (strlen(keys[key]) == pos - start && !memcmp(body + start, keys[key], pos - start)) break;
        if (key == 3 || (seen & (1U << key))) return false;
        ++pos; TAKE(':'); SPACE();
        if (key == 0) {
            const char action[] = "\"assign\"";
            if (length - pos < sizeof(action) - 1 || memcmp(body + pos, action, sizeof(action) - 1)) return false;
            pos += sizeof(action) - 1;
        } else {
            uint32_t number = 0;
            start = pos;
            while (pos < length && body[pos] >= '0' && body[pos] <= '9') {
                unsigned digit = (unsigned)(body[pos++] - '0');
                if (number > (UINT32_MAX - digit) / 10U) return false;
                number = number * 10U + digit;
            }
            if (pos == start || (pos - start > 1 && body[start] == '0')) return false;
            if (key == 1) operation->generation = number;
            else operation->target = number;
        }
        seen |= 1U << key;
    }
    TAKE('}'); SPACE();
#undef TAKE
#undef SPACE
    return pos == length && seen == 7 && operation->target &&
        operation->generation && operation->generation != UINT32_MAX;
}

void web_broker_settings_execute(uint32_t id)
{
    broker_operation_t operation;
    taskENTER_CRITICAL(&s_lock);
    operation = s_operation;
    taskEXIT_CRITICAL(&s_lock);
    if (!id || operation.id != id || operation.state != PENDING) {
        secure_wipe(&operation, sizeof(operation));
        return;
    }
    bool current = false;
    esp_err_t error = web_session_store_check_principal(operation.session, &operation.principal, &current);
    unsigned state = CANCELLED;
    if (error == ESP_OK && current && operation.principal.role == USER_ROLE_ADMIN &&
        esp_timer_get_time() < operation.deadline) {
        error = session_broker_assign_writer_current(operation.target, operation.generation);
        state = error == ESP_OK ? OK :
            (error == ESP_ERR_INVALID_STATE || error == ESP_ERR_NOT_FOUND) ? CONFLICT : FAILED;
    }
    taskENTER_CRITICAL(&s_lock);
    if (s_operation.id == id && s_operation.state == PENDING) {
        s_operation.state = state;
        secure_wipe(&s_operation.principal, sizeof(s_operation.principal));
    }
    taskEXIT_CRITICAL(&s_lock);
    secure_wipe(&operation, sizeof(operation));
}

static esp_err_t respond(httpd_req_t *request, const char *status, const char *body)
{
    esp_err_t error = httpd_resp_set_status(request, status);
    if (error == ESP_OK) error = httpd_resp_set_type(request, "application/json; charset=utf-8");
    if (error == ESP_OK) error = httpd_resp_set_hdr(request, "Cache-Control", "no-store");
    if (error == ESP_OK) error = httpd_resp_set_hdr(request, "X-Content-Type-Options", "nosniff");
    if (error == ESP_OK) error = httpd_resp_set_hdr(request, "Referrer-Policy", "no-referrer");
    if (error == ESP_OK) error = httpd_resp_sendstr(request, body);
    return web_httpd_unread_body(request) ? ESP_FAIL : error;
}

esp_err_t web_broker_operation_handler(httpd_req_t *request)
{
    web_session_view_t view = {0};
    bool allowed = false;
    bool mutation = request->method == HTTP_POST;
    esp_err_t error = mutation
        ? web_cookie_auth_require_json(request, 256, &view, &allowed)
        : web_cookie_auth_require(request, false, false, &view, &allowed);
    if (error != ESP_OK || !allowed) goto done;
    if (view.principal.role != USER_ROLE_ADMIN) {
        error = respond(request, "403 Forbidden", "{\"error\":\"admin_required\"}");
        goto done;
    }
    broker_operation_t operation = {0};
    if (mutation) {
        char type[40] = {0}, body[256];
        size_t received = 0;
        bool valid = request->content_len && request->content_len <= sizeof(body) &&
            httpd_req_get_hdr_value_str(request, "Content-Type", type, sizeof(type)) == ESP_OK &&
            (!strcmp(type, "application/json") || !strcmp(type, "application/json; charset=utf-8"));
        for (unsigned reads = 0; valid && received < request->content_len && reads < 4; ++reads) {
            int count = httpd_req_recv(request, body + received, request->content_len - received);
            if (count <= 0 || (size_t)count > request->content_len - received) valid = false;
            else received += (size_t)count;
        }
        valid = valid && received == request->content_len && parse(body, received, &operation);
        secure_wipe(body, sizeof(body));
        if (!valid) {
            error = respond(request, "400 Bad Request", "{\"error\":\"invalid_broker_request\"}");
            goto done;
        }
        operation.session = view.id;
        operation.principal = view.principal;
        operation.deadline = esp_timer_get_time() + 30000000LL;
        operation.state = PENDING;
        taskENTER_CRITICAL(&s_lock);
        bool busy = s_operation.state == PENDING || s_next_id == UINT32_MAX;
        if (!busy) {
            operation.id = ++s_next_id;
            s_operation = operation;
        }
        taskEXIT_CRITICAL(&s_lock);
        if (busy || admin_ssh_console_submit_broker_settings(operation.id) != ESP_OK) {
            taskENTER_CRITICAL(&s_lock);
            if (!busy && s_operation.id == operation.id) secure_wipe(&s_operation, sizeof(s_operation));
            taskEXIT_CRITICAL(&s_lock);
            error = httpd_resp_set_hdr(request, "Retry-After", "1");
            if (error == ESP_OK) error = respond(request, "503 Service Unavailable", "{\"error\":\"busy\"}");
            secure_wipe(&operation, sizeof(operation));
            goto done;
        }
    } else {
        taskENTER_CRITICAL(&s_lock);
        if (s_operation.session == view.id) {
            operation.id = s_operation.id;
            operation.state = s_operation.state;
        }
        taskEXIT_CRITICAL(&s_lock);
    }
    char response[96];
    int written = snprintf(response, sizeof(response), "{\"id\":%" PRIu32 ",\"action\":\"%s\",\"state\":\"%s\"}",
        operation.id, operation.id ? "assign" : "none", s_states[operation.state]);
    error = written < 0 || (size_t)written >= sizeof(response) ? ESP_FAIL :
        respond(request, mutation ? "202 Accepted" : "200 OK", response);
    secure_wipe(&operation, sizeof(operation));
done:
    secure_wipe(&view, sizeof(view));
    web_httpd_wipe_request(request, web_httpd_unread_body(request));
    return error;
}

esp_err_t web_broker_settings_handler(httpd_req_t *request)
{
    web_session_view_t view = {0};
    bool allowed = false;
    esp_err_t error = web_cookie_auth_require(request, false, false, &view, &allowed);
    if (error != ESP_OK || !allowed) goto done;
    if (view.principal.role != USER_ROLE_ADMIN) {
        error = respond(request, "403 Forbidden", "{\"error\":\"admin_required\"}");
        goto done;
    }
    session_broker_management_snapshot_t snapshot;
    error = session_broker_get_management_snapshot(&snapshot);
    if (error != ESP_OK) {
        error = respond(request, "503 Service Unavailable", "{\"error\":\"broker_unavailable\"}");
        goto done;
    }
    /* Eight rows; names are exact bounded bytes as hex, never unescaped JSON.
     * Decimal-string drop counters retain all 64 bits in the browser. */
    char response[2048];
    int written = snprintf(response, sizeof(response),
        "{\"generation\":%" PRIu32 ",\"writer\":%" PRIu32 ",\"clients\":[",
        snapshot.generation, snapshot.writer_id);
    size_t used = 0;
    if (written < 0 || (size_t)written >= sizeof(response)) { error = ESP_FAIL; goto done; }
    used = (size_t)written;
    for (size_t i = 0; i < snapshot.count; ++i) {
        const session_broker_management_client_t *client = &snapshot.clients[i];
        char name[SESSION_BROKER_CLIENT_NAME_MAX * 2 + 1];
        static const char hex[] = "0123456789abcdef";
        size_t n = 0;
        for (; n < SESSION_BROKER_CLIENT_NAME_MAX && client->name[n]; ++n) {
            unsigned byte = (unsigned char)client->name[n];
            name[n * 2] = hex[byte >> 4]; name[n * 2 + 1] = hex[byte & 15];
        }
        name[n * 2] = 0;
        written = snprintf(response + used, sizeof(response) - used,
            "%s{\"id\":%" PRIu32 ",\"type\":%u,\"name_hex\":\"%s\",\"pending\":%u,\"high_water\":%u,\"dropped\":\"%" PRIu64 "\"}",
            i ? "," : "", client->id, (unsigned)client->type, name,
            (unsigned)client->pending, (unsigned)client->high_water, client->dropped);
        if (written < 0 || (size_t)written >= sizeof(response) - used) { error = ESP_FAIL; goto done; }
        used += (size_t)written;
    }
    written = snprintf(response + used, sizeof(response) - used, "]}");
    error = written < 0 || (size_t)written >= sizeof(response) - used ? ESP_FAIL :
        respond(request, "200 OK", response);
done:
    secure_wipe(&view, sizeof(view));
    web_httpd_wipe_request(request, web_httpd_unread_body(request));
    return error;
}