//! Administrator runtime diagnostics and maintenance for the native uncached runtime.
use crate::{ApiError, AppState, auth::AuthUser};
use axum::{
    Extension, Json, Router,
    extract::State,
    http::{HeaderMap, StatusCode},
    routing::get,
};
use serde_json::{Value, json};
pub fn routes() -> Router<AppState> {
    Router::new()
        .route("/system/infos", get(infos))
        .route("/system/latestRelease", get(latest_release))
        .route("/system/optimize", get(optimize))
        .route("/system/clear-cache", get(clear))
}
fn admin(user: &AuthUser) -> Result<(), ApiError> {
    if user.is_admin {
        Ok(())
    } else {
        Err(ApiError(
            StatusCode::FORBIDDEN,
            "This action is unauthorized.",
        ))
    }
}
async fn infos(
    State(state): State<AppState>,
    Extension(user): Extension<AuthUser>,
    headers: HeaderMap,
) -> Result<Json<Value>, ApiError> {
    admin(&user)?;
    let settings = crate::settings::all(&state.db).await?;
    let guard = std::env::var("AUTH_GUARD")
        .or_else(|_| std::env::var("AUTHENTICATION_GUARD"))
        .unwrap_or_else(|_| "web-guard".into());
    let mut common = json!({"Date":chrono::Utc::now().to_rfc2822(),"userAgent":headers.get("user-agent").and_then(|v|v.to_str().ok()),"Version":format!("twofauth-rs {}",env!("CARGO_PKG_VERSION")),"API target":"2FAuth 8.0.3","Environment":std::env::var("APP_ENV").unwrap_or_else(|_|"production".into()),"Install path":format!("/{}",std::env::var("APP_SUBDIRECTORY").unwrap_or_default().trim_matches('/')),"Debug":std::env::var("APP_DEBUG").unwrap_or_else(|_|"false".into()),"Cache driver":"none","Log channel":"tracing","Log level":std::env::var("RUST_LOG").unwrap_or_else(|_|"info".into()),"DB driver":"sqlite","Operating system":std::env::consts::OS,"interface":"native Rust","Auth guard":guard,"webauthn user verification":std::env::var("WEBAUTHN_USER_VERIFICATION").unwrap_or_else(|_|"preferred".into()),"Trusted proxies":std::env::var("TRUSTED_PROXIES").ok().filter(|s|!s.is_empty()).unwrap_or_else(||"none".into()),"lastRadarScan":settings["lastRadarScan"]});
    if guard == "reverse-proxy-guard" {
        let config = crate::proxy_auth::ProxyConfig::from_env();
        common["Auth proxy logout url"] = json!(std::env::var("PROXY_LOGOUT_URL").ok());
        common["Auth proxy header for user"] = json!(config.user_header);
        common["Auth proxy header for email"] = json!(config.email_header);
    }
    Ok(Json(json!({"common":common})))
}
fn release_number(tag: &str) -> Option<[u64; 3]> {
    let pattern = regex::Regex::new(r"(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)")
        .expect("fixed version regex");
    let groups = pattern.captures(tag)?;
    Some([
        groups[1].parse().ok()?,
        groups[2].parse().ok()?,
        groups[3].parse().ok()?,
    ])
}
async fn record_release(db: &sqlx::SqlitePool, data: &Value) -> Result<Value, ApiError> {
    let mut tx = db.begin().await?;
    sqlx::query("INSERT INTO options(key,value) VALUES('lastRadarScan',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").bind(chrono::Utc::now().timestamp().to_string()).execute(&mut *tx).await?;
    let mut result = json!(false);
    if let Some(tag) = data["tag_name"].as_str()
        && let Some(number) = release_number(tag)
    {
        if number > [8, 0, 3] && data["prerelease"] == false && data["draft"] == false {
            sqlx::query("INSERT INTO options(key,value) VALUES('latestRelease',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").bind(tag).execute(&mut *tx).await?;
            result = json!(tag);
        } else {
            sqlx::query("DELETE FROM options WHERE key='latestRelease'")
                .execute(&mut *tx)
                .await?;
        }
    }
    tx.commit().await?;
    Ok(result)
}
async fn fetch_release() -> Option<Value> {
    let mut builder = reqwest::Client::builder()
        .user_agent(concat!("twofauth-rs/", env!("CARGO_PKG_VERSION")))
        .timeout(std::time::Duration::from_secs(10));
    if let Ok(proxy) = std::env::var("PROXY_FOR_OUTGOING_REQUESTS")
        && !proxy.is_empty()
    {
        builder = builder.proxy(reqwest::Proxy::all(proxy).ok()?);
    }
    let client = builder.build().ok()?;
    for attempt in 0..3 {
        if let Ok(response) = client
            .get("https://api.github.com/repos/Bubka/2FAuth/releases/latest")
            .send()
            .await
            && let Ok(mut response) = response.error_for_status()
        {
            if response
                .content_length()
                .is_some_and(|len| len > 1024 * 1024)
            {
                return None;
            }
            let mut bytes = Vec::new();
            while let Some(chunk) = response.chunk().await.ok()? {
                if bytes.len() + chunk.len() > 1024 * 1024 {
                    return None;
                }
                bytes.extend_from_slice(&chunk);
            }
            // A successful non-JSON response still records a completed scan, matching upstream.
            return Some(serde_json::from_slice(&bytes).unwrap_or(Value::Null));
        }
        if attempt < 2 {
            tokio::time::sleep(std::time::Duration::from_millis(100)).await;
        }
    }
    None
}
async fn latest_release(
    State(state): State<AppState>,
    Extension(user): Extension<AuthUser>,
) -> Result<Json<Value>, ApiError> {
    admin(&user)?;
    let result = match fetch_release().await {
        Some(data) => record_release(&state.db, &data).await?,
        None => Value::Null,
    };
    Ok(Json(json!({"newRelease":result})))
}
// Configuration is read per request; routes/events are compiled in the binary and
// frontend assets are read directly. There are no generated cache files to stale.
async fn optimize(Extension(user): Extension<AuthUser>) -> Result<Json<Value>, ApiError> {
    admin(&user)?;
    Ok(Json(
        json!({"config-exit-code":0,"route-exit-code":0,"event-exit-code":0,"view-exit-code":0}),
    ))
}
async fn clear(Extension(user): Extension<AuthUser>) -> Result<Json<Value>, ApiError> {
    admin(&user)?;
    Ok(Json(json!({"exit-code":0})))
}
#[cfg(test)]
mod tests {
    use super::*;
    use axum::{body::Body, http::Request};
    use tower::ServiceExt;
    #[tokio::test]
    async fn release_scan_updates_cache_and_clears_old_version() {
        let db = sqlx::sqlite::SqlitePoolOptions::new()
            .max_connections(1)
            .connect("sqlite::memory:")
            .await
            .unwrap();
        crate::db::init(&db).await.unwrap();
        assert_eq!(
            record_release(
                &db,
                &json!({"tag_name":"v8.1.0","prerelease":false,"draft":false})
            )
            .await
            .unwrap(),
            json!("v8.1.0")
        );
        let value: String =
            sqlx::query_scalar("SELECT value FROM options WHERE key='latestRelease'")
                .fetch_one(&db)
                .await
                .unwrap();
        assert_eq!(value, "v8.1.0");
        assert_eq!(
            record_release(
                &db,
                &json!({"tag_name":"v8.0.3","prerelease":false,"draft":false})
            )
            .await
            .unwrap(),
            json!(false)
        );
        let count: i64 =
            sqlx::query_scalar("SELECT count(*) FROM options WHERE key='latestRelease'")
                .fetch_one(&db)
                .await
                .unwrap();
        assert_eq!(count, 0);
        assert_eq!(
            record_release(
                &db,
                &json!({"tag_name":"v9.0.0-beta","prerelease":true,"draft":false})
            )
            .await
            .unwrap(),
            json!(false)
        );
    }
    #[tokio::test]
    async fn diagnostic_and_cache_routes_require_admin_and_report_actual_runtime() {
        let db = sqlx::sqlite::SqlitePoolOptions::new()
            .max_connections(1)
            .connect("sqlite::memory:")
            .await
            .unwrap();
        crate::db::init(&db).await.unwrap();
        let state = AppState {
            db,
            cipher: None,
            encrypt_db: std::sync::atomic::AtomicBool::new(false).into(),
        };
        for is_admin in [false, true] {
            let app = routes()
                .layer(Extension(AuthUser { id: 1, is_admin }))
                .with_state(state.clone());
            for path in ["/system/infos", "/system/optimize", "/system/clear-cache"] {
                let response = app
                    .clone()
                    .oneshot(Request::builder().uri(path).body(Body::empty()).unwrap())
                    .await
                    .unwrap();
                assert_eq!(
                    response.status(),
                    if !is_admin {
                        StatusCode::FORBIDDEN
                    } else {
                        StatusCode::OK
                    }
                );
            }
        }
    }
}