local usermanager = require "core.usermanager";

local array = require "util.array";

local it = require "util.iterators";

local jid = require "util.jid";

local json = require "util.json";

local set = require "util.set";

local st = require "util.stanza";

local statsmanager = require "core.statsmanager";

module:depends("http");

local announce = module:depends("announce");

local invites = module:depends("invites");

local tokens = module:depends("tokenauth");

local mod_pep = module:depends("pep");

local mod_groups = module:depends("groups_internal");

local mod_lastlog2 = module:depends("lastlog2");

local push_errors = module:shared("cloud_notify/push_errors");

local site_name = module:get_option_string("site_name", module.host);

local manual_stats_collection = module:context("*"):get_option("statistics_interval") == "manual";

local json_content_type = "application/json";

local www_authenticate_header = ("Bearer realm=%q"):format(module.host.."/"..module.name);

local xmlns_pubsub = "http://jabber.org/protocol/pubsub";

local xmlns_nick = "http://jabber.org/protocol/nick";

assert(mod_lastlog2.get_last_active, "Newer version of mod_lastlog2 is required to use this module");

local deleted_users = module:open_store("accounts_cleanup");

local function check_credentials(request)

	local auth_type, auth_data = string.match(request.headers.authorization or "", "^(%S+)%s(.+)$");

	if not (auth_type and auth_data) then

		return false;

	end

	if auth_type == "Bearer" then

		return tokens.get_token_session(auth_data);

	end

	return nil;

end

module:default_permission("prosody:admin", ":access-admin-api");

function check_auth(routes)

	local function check_request_auth(event)

		local session = check_credentials(event.request);

		if not session then

			event.response.headers.authorization = www_authenticate_header;

			return false, 401;

		end

		-- FIXME this should probably live in mod_tokenauth or similar

		session.type = "c2s";

		session.full_jid = jid.join(session.username, session.host, session.resource);

		event.session = session;

		if not module:may(":access-admin-api", event) then

			return false, 403;

		end

		return true;

	end

	for route, handler in pairs(routes) do

		routes[route] = function (event, ...)

			local permit, code = check_request_auth(event);

			if not permit then

				return code;

			end

			return handler(event, ...);

		end;

	end

	return routes;

end

local function token_info_to_invite_info(token_info)

	local additional_data = token_info.additional_data;

	local groups = additional_data and additional_data.groups or nil;

	local source = additional_data and additional_data.source or nil;

	local reset = not not (additional_data and additional_data.allow_reset or nil);

	return {

		id = token_info.token;

		type = token_info.type;

		reusable = not not token_info.reusable;

		inviter = token_info.inviter;

		jid = token_info.jid;

		uri = token_info.uri;

		landing_page = token_info.landing_page;

		created_at = token_info.created_at;

		expires = token_info.expires;

		groups = groups;

		source = source;

		reset = reset;

	};

end

function list_invites(event)

	local invites_list = {};

	for token, invite in invites.pending_account_invites() do --luacheck: ignore 213/token

		table.insert(invites_list, token_info_to_invite_info(invite));

	end

	table.sort(invites_list, function (a, b)

		return a.created_at < b.created_at;

	end);

	event.response.headers["Content-Type"] = json_content_type;

	return json.encode_array(invites_list);

end

function get_invite_by_id(event, invite_id)

	local invite = invites.get_account_invite_info(invite_id);

	if not invite then

		return 404;

	end

	event.response.headers["Content-Type"] = json_content_type;

	return json.encode(token_info_to_invite_info(invite));

end

function create_invite_type(event, invite_type)

	local options;

	local request = event.request;

	if request.body and #request.body > 0 then

		if request.headers.content_type ~= json_content_type then

			module:log("warn", "Invalid content type");

			return 400;

		end

		options = json.decode(event.request.body);

		if not options then

			module:log("warn", "Invalid JSON");

			return 400;

		end

	else

		options = {};

	end

	local source = event.session.username .. "@" .. module.host .. "/admin_api";

	local invite;

	if invite_type == "reset" then

		if not options.username then

			return 400;

		end

		invite = invites.create_account_reset(options.username, options.ttl);

	elseif invite_type == "group" then

		if not options.groups then

			return 400;

		end

		invite = invites.create_group(options.groups, {

			source = source;

		}, options.ttl);

	elseif invite_type == "account" then

		invite = invites.create_account(options.username, {

			source = source;

			groups = options.groups;

		}, options.ttl);

	else

		return 400;

	end

	if not invite then

		return 500;

	end

	event.response.headers["Content-Type"] = json_content_type;

	return json.encode(token_info_to_invite_info(invite));

end

function delete_invite(event, invite_id) --luacheck: ignore 212/event

	if not invites.delete_account_invite(invite_id) then

		return 404;

	end

	return 200;

end

local function get_user_avatar_info(username)

	local pep_service = mod_pep.get_pep_service(username);

	local ok, _, avatar_item = pep_service:get_last_item("urn:xmpp:avatar:metadata", true);

	avatar_item = avatar_item and avatar_item:get_child("metadata", "urn:xmpp:avatar:metadata");

	if not ok or not avatar_item then return; end

	local avatar_info = {};

	for avatar in avatar_item:childtags("info") do

		table.insert(avatar_info, {

			bytes = tonumber(avatar.attr.bytes);

			hash = avatar.attr.id;

			type = avatar.attr.type;

			width = tonumber(avatar.attr.width);

			height = tonumber(avatar.attr.height);

		});

	end

	return avatar_info;

end

local function get_user_info(username)

	if not usermanager.user_exists(username, module.host) then

		return nil;

	end

	local display_name;

	do

		local pep_service = mod_pep.get_pep_service(username);

		local ok, _, nick_item = pep_service:get_last_item(xmlns_nick, true);

		if ok and nick_item then

			display_name = nick_item:get_child_text("nick", xmlns_nick);

		end

	end

	local primary_role, secondary_roles, legacy_roles;

	if usermanager.get_user_role then

		primary_role = usermanager.get_user_role(username, module.host);

		secondary_roles = array.collect(it.keys(usermanager.get_user_secondary_roles(username, module.host)));

	elseif usermanager.get_user_roles then -- COMPAT w/0.12

		legacy_roles = array();

		local roles_map = usermanager.get_user_roles(username, module.host);

		for role_name in pairs(roles_map) do

			legacy_roles:push(role_name);

		end

	end

	local enabled = true; -- Assume all enabled if on a version without is_enabled

	if usermanager.user_is_enabled then

		enabled = usermanager.user_is_enabled(username, module.host);

	end

	return {

		username = username;

		display_name = display_name;

		role = primary_role and primary_role.name or nil;

		secondary_roles = secondary_roles;

		roles = legacy_roles; -- COMPAT w/0.12

		enabled = enabled;

		last_active = mod_lastlog2.get_last_active(username);

		deletion_request = not enabled and deleted_users:get(username) or nil;

		avatar_info = get_user_avatar_info(username);

	};

end

local function get_session_debug_info(session)

	local info = {

		full_jid = session.full_jid;

		ip = session.ip;

		since = math.floor(session.conntime);

		status = {

			connected = not not session.conn;

			hibernating = not not session.hibernating;

		};

		features = {

			carbons = not not session.want_carbons;

			encrypted = not not session.secure;

			acks = not not session.smacks;

			resumption = not not session.resumption_token;

			mobile_optimization = not not session.csi_counter;

			push_notifications = not not session.push_identifier;

			history = not not session.mam_requested;

		};

		queues = {};

	};

	-- CSI

	if session.state then

		info.status.active = session.state == "active";

		info.queues.held_stanzas = session.csi_counter or 0;

	end

	-- Smacks queue

	if session.last_requested_h and session.last_acknowledged_stanza then

		info.queues.awaiting_acks = session.last_requested_h - session.last_acknowledged_stanza;

	elseif session.outgoing_stanza_queue then

		-- New mod_smacks

		info.queues.awaiting_acks = session.outgoing_stanza_queue:count_unacked();

	end

	if session.push_identifier then

		info.push_info = {

			id = session.push_identifier;

			wakeup_push_sent = session.first_hibernated_push;

		};

	end

	return info;

end

local function get_user_omemo_info(username)

	local everything_valid = true;

	local any_device = false;

	local omemo_status = {};

	local omemo_devices;

	local pep_service = mod_pep.get_pep_service(username);

	if pep_service and pep_service.nodes then

		local ok, _, device_list = pep_service:get_last_item("eu.siacs.conversations.axolotl.devicelist", true);

		if ok and device_list then

			device_list = device_list:get_child("list", "eu.siacs.conversations.axolotl");

		end

		if device_list then

			omemo_devices = {};

			for device_entry in device_list:childtags("device") do

				any_device = true;

				local device_info = {};

				local device_id = tonumber(device_entry.attr.id or "");

				if device_id then

					device_info.id = device_id;

					local bundle_id = ("eu.siacs.conversations.axolotl.bundles:%d"):format(device_id);

					local have_bundle, _, bundle = pep_service:get_last_item(bundle_id, true);

					if have_bundle and bundle and bundle:get_child("bundle", "eu.siacs.conversations.axolotl") then

						device_info.have_bundle = true;

						local config_ok, bundle_config = pep_service:get_node_config(bundle_id, true);

						if config_ok and bundle_config then

							device_info.bundle_config = bundle_config;

							if bundle_config.max_items == 1

							and bundle_config.access_model == "open"

							and bundle_config.persist_items == true

							and bundle_config.publish_model == "publishers" then

								device_info.valid = true;

							end

						end

					end

				end

				if device_info.valid == nil then

					device_info.valid = false;

					everything_valid = false;

				end

				table.insert(omemo_devices, device_info);

			end

			local config_ok, list_config = pep_service:get_node_config("eu.siacs.conversations.axolotl.devicelist", true);

			if config_ok and list_config then

				omemo_status.config = list_config;

				if list_config.max_items == 1

				and list_config.access_model == "open"

				and list_config.persist_items == true

				and list_config.publish_model == "publishers" then

					omemo_status.config_valid = true;

				end

			end

			if omemo_status.config_valid == nil then

				omemo_status.config_valid = false;

				everything_valid = false;

			end

		end

	end

	omemo_status.valid = everything_valid and any_device;

	return {

		status = omemo_status;

		devices = omemo_devices;

	};

end

local function get_user_debug_info(username)

	local debug_info = {

		time = os.time();

	};

	-- Online sessions

	do

		local user_sessions = prosody.hosts[module.host].sessions[username];

		if user_sessions then

			user_sessions = user_sessions.sessions

		end

		local sessions = {};

		if user_sessions then

			for _, session in pairs(user_sessions) do

				table.insert(sessions, get_session_debug_info(session));

			end

		end

		debug_info.sessions = sessions;

	end

	-- Push registrations

	do

		local store = module:open_store("cloud_notify");

		local services = store:get(username);

		local push_registrations = {};

		if services then

			for identifier, push_info in pairs(services) do

				push_registrations[identifier] = {

					since = push_info.timestamp;