-- RESTful API

--

-- Copyright (c) 2019-2022 Kim Alvefur

--

-- This file is MIT/X11 licensed.

local encodings = require "util.encodings";

local base64 = encodings.base64;

local errors = require "util.error";

local http = require "net.http";

local id = require "util.id";

local jid = require "util.jid";

local json = require "util.json";

local st = require "util.stanza";

local um = require "core.usermanager";

local xml = require "util.xml";

local have_cbor, cbor = pcall(require, "cbor");

local jsonmap = module:require"jsonmap";

local tokens = module:depends("tokenauth");

-- Lower than the default c2s size limit to account for possible JSON->XML size increase

local stanza_size_limit = module:get_option_number("rest_stanza_size_limit", 1024 * 192);

local auth_mechanisms = module:get_option_set("rest_auth_mechanisms", { "Basic", "Bearer" });

local www_authenticate_header;

do

	local header, realm = {}, module.host.."/"..module.name;

	for mech in auth_mechanisms do

		header[#header+1] = ("%s realm=%q"):format(mech, realm);

	end

	www_authenticate_header = table.concat(header, ", ");

end

local function check_credentials(request)

	local auth_type, auth_data = string.match(request.headers.authorization, "^(%S+)%s(.+)$");

	if not (auth_type and auth_data) or not auth_mechanisms:contains(auth_type) then

		return false;

	end

	if auth_type == "Basic" then

		local creds = base64.decode(auth_data);

		if not creds then return false; end

		local username, password = string.match(creds, "^([^:]+):(.*)$");

		if not username then return false; end

		username, password = encodings.stringprep.nodeprep(username), encodings.stringprep.saslprep(password);

		if not username then return false; end

		if not um.test_password(username, module.host, password) then

			return false;

		end

		return { username = username, host = module.host };

	elseif auth_type == "Bearer" then

		if tokens.get_token_session then

			return tokens.get_token_session(auth_data);

		else -- COMPAT w/0.12

			local token_info = tokens.get_token_info(auth_data);

			if not token_info or not token_info.session then

				return false;

			end

			return token_info.session;

		end

	end

	return nil;

end

if module:get_option_string("authentication") == "anonymous" and module:get_option_boolean("anonymous_rest") then

	www_authenticate_header = nil;

	function check_credentials(request) -- luacheck: ignore 212/request

		return {

			username = id.medium():lower();

			host = module.host;

		}

	end

end

local function event_suffix(jid_to)

	local node, _, resource = jid.split(jid_to);

	if node then

		if resource then

			return '/full';

		else

			return '/bare';

		end

	else

		return '/host';

	end

end

-- TODO This ought to be handled some way other than duplicating this

-- core.stanza_router code here.

local function compat_preevents(origin, stanza) --> boolean : handled

	local to = stanza.attr.to;

	local node, host, resource = jid.split(to);

	local to_type, to_self;

	if node then

		if resource then

			to_type = '/full';

		else

			to_type = '/bare';

			if node == origin.username and host == origin.host then

				stanza.attr.to = nil;

				to_self = true;

			end

		end

	else

		if host then

			to_type = '/host';

		else

			to_type = '/bare';

			to_self = true;

		end

	end

	local event_data = { origin = origin; stanza = stanza; to_self = to_self };

	local result = module:fire_event("pre-stanza", event_data);

	if result ~= nil then return true end

	if module:fire_event('pre-' .. stanza.name .. to_type, event_data) then return true; end -- do preprocessing

	return false

end

-- (table, string) -> table

local function amend_from_path(data, path)

	local st_kind, st_type, st_to = path:match("^([mpi]%w+)/(%w+)/(.*)$");

	if not st_kind then return; end

	if st_kind == "iq" and st_type ~= "get" and st_type ~= "set" then

		-- GET /iq/disco/jid

		data = {

			kind = "iq";

			[st_type] = st_type == "ping" or data or {};

		};

	else

		data.kind = st_kind;

		data.type = st_type;

	end

	if st_to and st_to ~= "" then

		data.to = st_to;

	end

	return data;

end

local function parse(mimetype, data, path) --> Stanza, error enum

	mimetype = mimetype and mimetype:match("^[^; ]*");

	if mimetype == "application/xmpp+xml" then

		return xml.parse(data);

	elseif mimetype == "application/json" then

		local parsed, err = json.decode(data);

		if not parsed then

			return parsed, err;

		end

		if path then

			parsed = amend_from_path(parsed, path);

			if not parsed then return nil, "invalid-path"; end

		end

		return jsonmap.json2st(parsed);

	elseif mimetype == "application/cbor" and have_cbor then

		local parsed, err = cbor.decode(data);

		if not parsed then

			return parsed, err;

		end

		return jsonmap.json2st(parsed);

	elseif mimetype == "application/x-www-form-urlencoded"then

		local parsed = http.formdecode(data);

		if type(parsed) == "string" then

			-- This should reject GET /iq/query/to?messagebody

			if path then

				return nil, "invalid-query";

			end

			return parse("text/plain", parsed);

		end

		for i = #parsed, 1, -1 do

			parsed[i] = nil;

		end

		if path then

			parsed = amend_from_path(parsed, path);

			if not parsed then return nil, "invalid-path"; end

		end

		return jsonmap.json2st(parsed);

	elseif mimetype == "text/plain" then

		if not path then

			return st.message({ type = "chat" }, data);

		end

		local parsed = {};

		if path then

			parsed = amend_from_path(parsed, path);

			if not parsed then return nil, "invalid-path"; end

		end

		if parsed.kind == "message" then

			parsed.body = data;

		elseif parsed.kind == "presence" then

			parsed.show = data;

		else

			return nil, "invalid-path";

		end

		return jsonmap.json2st(parsed);

	elseif not mimetype and path then

		local parsed = amend_from_path({}, path);

		if not parsed then return nil, "invalid-path"; end

		return jsonmap.json2st(parsed);

	end

	return nil, "unknown-payload-type";

end

local function decide_type(accept, supported_types)

	-- assumes the accept header is sorted

	local ret = supported_types[1];

	for i = 2, #supported_types do

		if (accept:find(supported_types[i], 1, true) or 1000) < (accept:find(ret, 1, true) or 1000) then

			ret = supported_types[i];

		end

	end

	return ret;

end

local supported_inputs = {

	"application/xmpp+xml",

	"application/json",

	"application/x-www-form-urlencoded",

	"text/plain",

};

local supported_outputs = {

	"application/xmpp+xml",

	"application/json",

	"application/x-www-form-urlencoded",

};

if have_cbor then

	table.insert(supported_inputs, "application/cbor");

	table.insert(supported_outputs, "application/cbor");

end

-- Only { string : string } can be form-encoded, discard the rest

-- (jsonmap also discards anything unknown or unsupported)

local function flatten(t)

	local form = {};

	for k, v in pairs(t) do

		if type(v) == "string" then

			form[k] = v;

		elseif type(v) == "number" then

			form[k] = tostring(v);

		elseif v == true then

			form[k] = "";

		end

	end

	return form;

end

local function encode(type, s)

	if type == "text/plain" then

		return s:get_child_text("body") or "";

	elseif type == "application/xmpp+xml" then

		return tostring(s);

	end

	local mapped, err = jsonmap.st2json(s);

	if not mapped then return mapped, err; end

	if type == "application/json" then

		return json.encode(mapped);

	elseif type == "application/x-www-form-urlencoded" then

		return http.formencode(flatten(mapped));

	elseif type == "application/cbor" then

		return cbor.encode(mapped);

	end

	error "unsupported encoding";

end

local post_errors = errors.init("mod_rest", {

	noauthz = { code = 401; type = "auth"; condition = "not-authorized"; text = "No credentials provided" };

	unauthz = { code = 403; type = "auth"; condition = "not-authorized"; text = "Credentials not accepted" };

	parse = { code = 400; type = "modify"; condition = "not-well-formed"; text = "Failed to parse payload" };

	xmlns = { code = 422; type = "modify"; condition = "invalid-namespace"; text = "'xmlns' attribute must be empty" };

	name = { code = 422; type = "modify"; condition = "unsupported-stanza-type"; text = "Invalid stanza, must be 'message', 'presence' or 'iq'." };

	to = { code = 422; type = "modify"; condition = "improper-addressing"; text = "Invalid destination JID" };

	from = { code = 422; type = "modify"; condition = "invalid-from"; text = "Invalid source JID" };

	from_auth = { code = 403; type = "auth"; condition = "not-authorized"; text = "Not authorized to send stanza with requested 'from'" };

	iq_type = { code = 422; type = "modify"; condition = "invalid-xml"; text = "'iq' stanza must be of type 'get' or 'set'" };

	iq_tags = { code = 422; type = "modify"; condition = "bad-format"; text = "'iq' stanza must have exactly one child tag" };

	mediatype = { code = 415; type = "cancel"; condition = "bad-format"; text = "Unsupported media type" };

	size = { code = 413; type = "modify"; condition = "resource-constraint", text = "Payload too large" };

});

-- GET → iq-get

local function parse_request(request, path)

	if path and request.method == "GET" then

		-- e.g. /version/{to}

		if request.url.query then

			return parse("application/x-www-form-urlencoded", request.url.query, "iq/"..path);

		end

		return parse(nil, nil, "iq/"..path);

	else

		return parse(request.headers.content_type, request.body, path);

	end

end

local function handle_request(event, path)

	local request, response = event.request, event.response;

	local log = request.log or module._log;

	local from;

	local origin;

	local echo = path == "echo";

	if echo then path = nil; end

	if not request.headers.authorization and www_authenticate_header then

		response.headers.www_authenticate = www_authenticate_header;

		return post_errors.new("noauthz");

	else

		origin = check_credentials(request);

		if not origin then

			return post_errors.new("unauthz");

		end

		from = jid.join(origin.username, origin.host, origin.resource);

		origin.full_jid = from;

		origin.type = "c2s";

		origin.log = log;

	end

	if type(request.body) == "string" and #request.body > stanza_size_limit then

		return post_errors.new("size", { size = #request.body; limit = stanza_size_limit });

	end

	local payload, err = parse_request(request, path);

	if not payload then

		-- parse fail

		local ctx = { error = err, type = request.headers.content_type, data = request.body, };

		if err == "unknown-payload-type" then

			return post_errors.new("mediatype", ctx);

		end

		return post_errors.new("parse", ctx);

	end

	if (payload.attr.xmlns or "jabber:client") ~= "jabber:client" then

		return post_errors.new("xmlns");

	elseif payload.name ~= "message" and payload.name ~= "presence" and payload.name ~= "iq" then

		return post_errors.new("name");

	end

	local to = jid.prep(payload.attr.to);

	if payload.attr.to and not to then

		return post_errors.new("to");

	end

	if payload.attr.from then

		local requested_from = jid.prep(payload.attr.from);

		if not requested_from then

			return post_errors.new("from");

		end

		if jid.compare(requested_from, from) then

			from = requested_from;

		else

			return post_errors.new("from_auth");

		end

	end

	payload.attr = {

		from = from,

		to = to,

		id = payload.attr.id or id.medium(),

		type = payload.attr.type,

		["xml:lang"] = payload.attr["xml:lang"],

	};