# url.py - HTTP handling for mercurial

#

# Copyright 2005, 2006, 2007, 2008 Olivia Mackall <olivia@selenic.com>

# Copyright 2006, 2007 Alexis S. L. Carvalho <alexis@cecm.usp.br>

# Copyright 2006 Vadim Gelfer <vadim.gelfer@gmail.com>

#

# This software may be used and distributed according to the terms of the

# GNU General Public License version 2 or any later version.

import base64

import socket

from .i18n import _

from . import (

    encoding,

    error,

    httpconnection as httpconnectionmod,

    keepalive,

    pycompat,

    sslutil,

    urllibcompat,

    util,

)

from .utils import (

    stringutil,

    urlutil,

)

httplib = util.httplib

stringio = util.stringio

urlerr = util.urlerr

urlreq = util.urlreq

def escape(s, quote=None):

    """Replace special characters "&", "<" and ">" to HTML-safe sequences.

    If the optional flag quote is true, the quotation mark character (")

    is also translated.

    This is the same as cgi.escape in Python, but always operates on

    bytes, whereas cgi.escape in Python 3 only works on unicodes.

    """

    s = s.replace(b"&", b"&")

    s = s.replace(b"<", b"&lt;")

    s = s.replace(b">", b">")

    if quote:

        s = s.replace(b'"', b""")

    return s

class passwordmgr:

    def __init__(self, ui, passwddb):

        self.ui = ui

        self.passwddb = passwddb

    def add_password(self, realm, uri, user, passwd):

        return self.passwddb.add_password(realm, uri, user, passwd)

    def find_user_password(self, realm, authuri):

        assert isinstance(realm, (type(None), str))

        assert isinstance(authuri, str)

        authinfo = self.passwddb.find_user_password(realm, authuri)

        user, passwd = authinfo

        user, passwd = pycompat.bytesurl(user), pycompat.bytesurl(passwd)

        if user and passwd:

            self._writedebug(user, passwd)

            return (pycompat.strurl(user), pycompat.strurl(passwd))

        if not user or not passwd:

            res = httpconnectionmod.readauthforuri(self.ui, authuri, user)

            if res:

                group, auth = res

                user, passwd = auth.get(b'username'), auth.get(b'password')

                self.ui.debug(b"using auth.%s.* for authentication\n" % group)

        if not user or not passwd:

            u = urlutil.url(pycompat.bytesurl(authuri))

            u.query = None

            if not self.ui.interactive():

                raise error.Abort(

                    _(b'http authorization required for %s')

                    % urlutil.hidepassword(bytes(u))

                )

            self.ui.write(

                _(b"http authorization required for %s\n")

                % urlutil.hidepassword(bytes(u))

            )

            self.ui.write(_(b"realm: %s\n") % pycompat.bytesurl(realm))

            if user:

                self.ui.write(_(b"user: %s\n") % user)

            else:

                user = self.ui.prompt(_(b"user:"), default=None)

            if not passwd:

                passwd = self.ui.getpass()

        # As of Python 3.8, the default implementation of

        # AbstractBasicAuthHandler.retry_http_basic_auth() assumes the user

        # is set if pw is not None. This means (None, str) is not a valid

        # return type of find_user_password().

        if user is None:

            return None, None

        self.passwddb.add_password(realm, authuri, user, passwd)

        self._writedebug(user, passwd)

        return (pycompat.strurl(user), pycompat.strurl(passwd))

    def _writedebug(self, user, passwd):

        msg = _(b'http auth: user %s, password %s\n')

        self.ui.debug(msg % (user, passwd and b'*' * len(passwd) or b'not set'))

    def find_stored_password(self, authuri):

        return self.passwddb.find_user_password(None, authuri)

class proxyhandler(urlreq.proxyhandler):

    def __init__(self, ui):

        proxyurl = ui.config(b"http_proxy", b"host") or encoding.environ.get(

            b'http_proxy'

        )

        # XXX proxyauthinfo = None

        if proxyurl:

            # proxy can be proper url or host[:port]

            if not (

                proxyurl.startswith(b'http:') or proxyurl.startswith(b'https:')

            ):

                proxyurl = b'http://' + proxyurl + b'/'

            proxy = urlutil.url(proxyurl)

            if not proxy.user:

                proxy.user = ui.config(b"http_proxy", b"user")

                proxy.passwd = ui.config(b"http_proxy", b"passwd")

            # see if we should use a proxy for this url

            no_list = [b"localhost", b"127.0.0.1"]

            no_list.extend(

                [p.lower() for p in ui.configlist(b"http_proxy", b"no")]

            )

            no_list.extend(

                [

                    p.strip().lower()

                    for p in encoding.environ.get(b"no_proxy", b'').split(b',')

                    if p.strip()

                ]

            )

            # "http_proxy.always" config is for running tests on localhost

            if ui.configbool(b"http_proxy", b"always"):

                self.no_list = []

            else:

                self.no_list = no_list

            # Keys and values need to be str because the standard library

            # expects them to be.

            proxyurl = str(proxy)

            proxies = {'http': proxyurl, 'https': proxyurl}

            ui.debug(

                b'proxying through %s\n' % urlutil.hidepassword(bytes(proxy))

            )

        else:

            proxies = {}

        urlreq.proxyhandler.__init__(self, proxies)

        self.ui = ui

    def proxy_open(self, req, proxy, type_):

        host = pycompat.bytesurl(urllibcompat.gethost(req)).split(b':')[0]

        for e in self.no_list:

            if host == e:

                return None

            if e.startswith(b'*.') and host.endswith(e[2:]):

                return None

            if e.startswith(b'.') and host.endswith(e[1:]):

                return None

        return urlreq.proxyhandler.proxy_open(self, req, proxy, type_)

def _gen_sendfile(orgsend):

    def _sendfile(self, data):

        # send a file

        if isinstance(data, httpconnectionmod.httpsendfile):

            # if auth required, some data sent twice, so rewind here

            data.seek(0)

            for chunk in util.filechunkiter(data):

                orgsend(self, chunk)

        else:

            orgsend(self, data)

    return _sendfile

has_https = util.safehasattr(urlreq, b'httpshandler')

class httpconnection(keepalive.HTTPConnection):

    # must be able to send big bundle as stream.

    send = _gen_sendfile(keepalive.HTTPConnection.send)

# Large parts of this function have their origin from before Python 2.6

# and could potentially be removed.

def _generic_start_transaction(handler, h, req):

    tunnel_host = req._tunnel_host

    if tunnel_host:

        if tunnel_host[:7] not in ['http://', 'https:/']:

            tunnel_host = 'https://' + tunnel_host

        new_tunnel = True

    else:

        tunnel_host = urllibcompat.getselector(req)

        new_tunnel = False

    if new_tunnel or tunnel_host == urllibcompat.getfullurl(req):  # has proxy

        u = urlutil.url(pycompat.bytesurl(tunnel_host))

        if new_tunnel or u.scheme == b'https':  # only use CONNECT for HTTPS

            h.realhostport = b':'.join([u.host, (u.port or b'443')])

            h.headers = req.headers.copy()

            h.headers.update(handler.parent.addheaders)

            return

    h.realhostport = None

    h.headers = None

def _generic_proxytunnel(self: "httpsconnection"):

    headers = self.headers  # pytype: disable=attribute-error

    proxyheaders = {

        pycompat.bytestr(x): pycompat.bytestr(headers[x])

        for x in headers

        if x.lower().startswith('proxy-')

    }

    realhostport = self.realhostport  # pytype: disable=attribute-error

    self.send(b'CONNECT %s HTTP/1.0\r\n' % realhostport)

    for header in proxyheaders.items():

        self.send(b'%s: %s\r\n' % header)

    self.send(b'\r\n')

    # majority of the following code is duplicated from

    # httplib.HTTPConnection as there are no adequate places to

    # override functions to provide the needed functionality.

    # pytype: disable=attribute-error

    res = self.response_class(self.sock, method=self._method)

    # pytype: enable=attribute-error

    while True:

        # pytype: disable=attribute-error

        version, status, reason = res._read_status()

        # pytype: enable=attribute-error

        if status != httplib.CONTINUE:

            break

        # skip lines that are all whitespace

        list(iter(lambda: res.fp.readline().strip(), b''))

    if status == 200:

        # skip lines until we find a blank line

        list(iter(res.fp.readline, b'\r\n'))

    else:

        self.close()

        raise socket.error(

            "Tunnel connection failed: %d %s" % (status, reason.strip())

        )

class httphandler(keepalive.HTTPHandler):

    def http_open(self, req):

        return self.do_open(httpconnection, req)

    def _start_transaction(self, h, req):

        _generic_start_transaction(self, h, req)

        return keepalive.HTTPHandler._start_transaction(self, h, req)

class logginghttpconnection(keepalive.HTTPConnection):

    def __init__(self, createconn, *args, **kwargs):

        keepalive.HTTPConnection.__init__(self, *args, **kwargs)

        self._create_connection = createconn

class logginghttphandler(httphandler):

    """HTTP handler that logs socket I/O."""

    def __init__(self, logfh, name, observeropts, timeout=None):

        super(logginghttphandler, self).__init__(timeout=timeout)

        self._logfh = logfh

        self._logname = name

        self._observeropts = observeropts

    # do_open() calls the passed class to instantiate an HTTPConnection. We

    # pass in a callable method that creates a custom HTTPConnection instance

    # whose callback to create the socket knows how to proxy the socket.

    def http_open(self, req):

        return self.do_open(self._makeconnection, req)

    def _makeconnection(self, *args, **kwargs):

        def createconnection(*args, **kwargs):

            sock = socket.create_connection(*args, **kwargs)

            return util.makeloggingsocket(

                self._logfh, sock, self._logname, **self._observeropts

            )

        return logginghttpconnection(createconnection, *args, **kwargs)

if has_https:

    class httpsconnection(keepalive.HTTPConnection):

        response_class = keepalive.HTTPResponse

        default_port = httplib.HTTPS_PORT

        # must be able to send big bundle as stream.

        send = _gen_sendfile(keepalive.safesend)

        getresponse = keepalive.wrapgetresponse(httplib.HTTPConnection)

        def __init__(

            self,

            host,

            port=None,

            key_file=None,

            cert_file=None,

            *args,

            **kwargs

        ):

            keepalive.HTTPConnection.__init__(self, host, port, *args, **kwargs)

            self.key_file = key_file

            self.cert_file = cert_file

        def connect(self):

            self.sock = socket.create_connection((self.host, self.port))

            host = self.host

            realhostport = self.realhostport  # pytype: disable=attribute-error

            if realhostport:  # use CONNECT proxy

                _generic_proxytunnel(self)

                host = realhostport.rsplit(b':', 1)[0]

            self.sock = sslutil.wrapsocket(

                self.sock,

                self.key_file,

                self.cert_file,

                ui=self.ui,  # pytype: disable=attribute-error

                serverhostname=host,

            )

            sslutil.validatesocket(self.sock)

    class httpshandler(keepalive.KeepAliveHandler, urlreq.httpshandler):

        def __init__(self, ui, timeout=None):

            keepalive.KeepAliveHandler.__init__(self, timeout=timeout)

            urlreq.httpshandler.__init__(self)

            self.ui = ui

            self.pwmgr = passwordmgr(self.ui, self.ui.httppasswordmgrdb)

        def _start_transaction(self, h, req):

            _generic_start_transaction(self, h, req)

            return keepalive.KeepAliveHandler._start_transaction(self, h, req)

        def https_open(self, req):

            # urllibcompat.getfullurl() does not contain credentials

            # and we may need them to match the certificates.

            url = urllibcompat.getfullurl(req)

            user, password = self.pwmgr.find_stored_password(url)

            res = httpconnectionmod.readauthforuri(self.ui, url, user)

            if res:

                group, auth = res