local configmanager = require "core.configmanager";

local show_usage = require "util.prosodyctl".show_usage;

local show_warning = require "util.prosodyctl".show_warning;

local dependencies = require "util.dependencies";

local socket = require "socket";

local jid_split = require "util.jid".prepped_split;

local modulemanager = require "core.modulemanager";

local function check(arg)

	if arg[1] == "--help" then

		show_usage([[check]], [[Perform basic checks on your Prosody installation]]);

		return 1;

	end

	local what = table.remove(arg, 1);

	local set = require "util.set";

	local it = require "util.iterators";

	local ok = true;

	local function disabled_hosts(host, conf) return host ~= "*" and conf.enabled ~= false; end

	local function enabled_hosts() return it.filter(disabled_hosts, pairs(configmanager.getconfig())); end

	if not (what == nil or what == "disabled" or what == "config" or what == "dns" or what == "certs") then

		show_warning("Don't know how to check '%s'. Try one of 'config', 'dns', 'certs' or 'disabled'.", what);

		return 1;

	end

	if not what or what == "disabled" then

		local disabled_hosts_set = set.new();

		for host, host_options in it.filter("*", pairs(configmanager.getconfig())) do

			if host_options.enabled == false then

				disabled_hosts_set:add(host);

			end

		end

		if not disabled_hosts_set:empty() then

			local msg = "Checks will be skipped for these disabled hosts: %s";

			if what then msg = "These hosts are disabled: %s"; end

			show_warning(msg, tostring(disabled_hosts_set));

			if what then return 0; end

			print""

		end

	end

	if not what or what == "config" then

		print("Checking config...");

		local deprecated = set.new({

			"anonymous_login",

			"bosh_ports",

			"cross_domain_bosh",

			"cross_domain_websocket",

			"daemonize",

			"disallow_s2s",

			"legacy_ssl_interfaces",

			"legacy_ssl_port",

			"legacy_ssl_ports",

			"legacy_ssl_ssl",

			"no_daemonize",

			"require_encryption",

			"vcard_compatibility",

		});

		local known_global_options = set.new({

			"daemonize",

			"gc",

			"http_default_host",

			"installer_plugin_path",

			"limits",

			"log",

			"network_backend",

			"network_settings",

			"pidfile",

			"plugin_paths",

			"plugin_server",

			"prosodyctl_timeout",

			"prosody_group",

			"prosody_user",

			"statistics",

			"statistics_config",

			"statistics_interval",

			"umask",

			"use_ipv4",

			"use_ipv6",

			"use_libevent",

		});

		local config = configmanager.getconfig();

		-- Check that we have any global options (caused by putting a host at the top)

		if it.count(it.filter("log", pairs(config["*"]))) == 0 then

			ok = false;

			print("");

			print("    No global options defined. Perhaps you have put a host definition at the top")

			print("    of the config file? They should be at the bottom, see https://prosody.im/doc/configure#overview");

		end

		if it.count(enabled_hosts()) == 0 then

			ok = false;

			print("");

			if it.count(it.filter("*", pairs(config))) == 0 then

				print("    No hosts are defined, please add at least one VirtualHost section")

			elseif config["*"]["enabled"] == false then

				print("    No hosts are enabled. Remove enabled = false from the global section or put enabled = true under at least one VirtualHost section")

			else

				print("    All hosts are disabled. Remove enabled = false from at least one VirtualHost section")

			end

		end

		if not config["*"].modules_enabled then

			print("    No global modules_enabled is set?");

			local suggested_global_modules;

			for host, options in enabled_hosts() do --luacheck: ignore 213/host

				if not options.component_module and options.modules_enabled then

					suggested_global_modules = set.intersection(suggested_global_modules or set.new(options.modules_enabled), set.new(options.modules_enabled));

				end

			end

			if suggested_global_modules and not suggested_global_modules:empty() then

				print("    Consider moving these modules into modules_enabled in the global section:")

				print("    "..tostring(suggested_global_modules / function (x) return ("%q"):format(x) end));

			end

			print();

		end

		do -- Check for modules enabled both normally and as components

			local modules = set.new(config["*"]["modules_enabled"]);

			for host, options in enabled_hosts() do

				local component_module = options.component_module;

				if component_module and modules:contains(component_module) then

					print(("    mod_%s is enabled both in modules_enabled and as Component %q %q"):format(component_module, host, component_module));

					print("    This means the service is enabled on all VirtualHosts as well as the Component.");

					print("    Are you sure this what you want? It may cause unexpected behaviour.");

				end

			end

		end

		-- Check for global options under hosts

		local global_options = set.new(it.to_array(it.keys(config["*"])));

		local deprecated_global_options = set.intersection(global_options, deprecated);

		if not deprecated_global_options:empty() then

			print("");

			print("    You have some deprecated options in the global section:");

			print("    "..tostring(deprecated_global_options))

			ok = false;

		end

		for host, options in it.filter(function (h) return h ~= "*" end, pairs(configmanager.getconfig())) do

			local host_options = set.new(it.to_array(it.keys(options)));

			local misplaced_options = set.intersection(host_options, known_global_options);

			for name in pairs(options) do

				if name:match("^interfaces?")

				or name:match("_ports?$") or name:match("_interfaces?$")

				or (name:match("_ssl$") and not name:match("^[cs]2s_ssl$")) then

					misplaced_options:add(name);

				end

			end

			if not misplaced_options:empty() then

				ok = false;

				print("");

				local n = it.count(misplaced_options);

				print("    You have "..n.." option"..(n>1 and "s " or " ").."set under "..host.." that should be");

				print("    in the global section of the config file, above any VirtualHost or Component definitions,")

				print("    see https://prosody.im/doc/configure#overview for more information.")

				print("");

				print("    You need to move the following option"..(n>1 and "s" or "")..": "..table.concat(it.to_array(misplaced_options), ", "));

			end

		end

		for host, options in enabled_hosts() do

			local host_options = set.new(it.to_array(it.keys(options)));

			local subdomain = host:match("^[^.]+");

			if not(host_options:contains("component_module")) and (subdomain == "jabber" or subdomain == "xmpp"

			   or subdomain == "chat" or subdomain == "im") then

				print("");

				print("    Suggestion: If "..host.. " is a new host with no real users yet, consider renaming it now to");

				print("     "..host:gsub("^[^.]+%.", "")..". You can use SRV records to redirect XMPP clients and servers to "..host..".");

				print("     For more information see: https://prosody.im/doc/dns");

			end

		end

		local all_modules = set.new(config["*"].modules_enabled);

		local all_options = set.new(it.to_array(it.keys(config["*"])));

		for host in enabled_hosts() do

			all_options:include(set.new(it.to_array(it.keys(config[host]))));

			all_modules:include(set.new(config[host].modules_enabled));

		end

		for mod in all_modules do

			if mod:match("^mod_") then

				print("");

				print("    Modules in modules_enabled should not have the 'mod_' prefix included.");

				print("    Change '"..mod.."' to '"..mod:match("^mod_(.*)").."'.");

			elseif mod:match("^auth_") then

				print("");

				print("    Authentication modules should not be added to modules_enabled,");

				print("    but be specified in the 'authentication' option.");

				print("    Remove '"..mod.."' from modules_enabled and instead add");

				print("        authentication = '"..mod:match("^auth_(.*)").."'");

				print("    For more information see https://prosody.im/doc/authentication");

			elseif mod:match("^storage_") then

				print("");

				print("    storage modules should not be added to modules_enabled,");

				print("    but be specified in the 'storage' option.");

				print("    Remove '"..mod.."' from modules_enabled and instead add");

				print("        storage = '"..mod:match("^storage_(.*)").."'");

				print("    For more information see https://prosody.im/doc/storage");

			end

		end

		if all_modules:contains("vcard") and all_modules:contains("vcard_legacy") then

			print("");

			print("    Both mod_vcard_legacy and mod_vcard are enabled but they conflict");

			print("    with each other. Remove one.");

		end

		if all_modules:contains("pep") and all_modules:contains("pep_simple") then

			print("");

			print("    Both mod_pep_simple and mod_pep are enabled but they conflict");

			print("    with each other. Remove one.");

		end

		for host, host_config in pairs(config) do --luacheck: ignore 213/host

			if type(rawget(host_config, "storage")) == "string" and rawget(host_config, "default_storage") then

				print("");

				print("    The 'default_storage' option is not needed if 'storage' is set to a string.");

				break;

			end

		end

		local require_encryption = set.intersection(all_options, set.new({

			"require_encryption", "c2s_require_encryption", "s2s_require_encryption"

		})):empty();

		local ssl = dependencies.softreq"ssl";

		if not ssl then

			if not require_encryption then

				print("");

				print("    You require encryption but LuaSec is not available.");

				print("    Connections will fail.");

				ok = false;

			end

		elseif not ssl.loadcertificate then

			if all_options:contains("s2s_secure_auth") then

				print("");

				print("    You have set s2s_secure_auth but your version of LuaSec does ");

				print("    not support certificate validation, so all s2s connections will");

				print("    fail.");

				ok = false;

			elseif all_options:contains("s2s_secure_domains") then

				local secure_domains = set.new();

				for host in enabled_hosts() do

					if config[host].s2s_secure_auth == true then

						secure_domains:add("*");

					else

						secure_domains:include(set.new(config[host].s2s_secure_domains));

					end

				end

				if not secure_domains:empty() then

					print("");

					print("    You have set s2s_secure_domains but your version of LuaSec does ");

					print("    not support certificate validation, so s2s connections to/from ");

					print("    these domains will fail.");

					ok = false;

				end

			end

		elseif require_encryption and not all_modules:contains("tls") then

			print("");

			print("    You require encryption but mod_tls is not enabled.");

			print("    Connections will fail.");

			ok = false;

		end

		print("Done.\n");

	end

	if not what or what == "dns" then

		local dns = require "net.dns";

		pcall(function ()

			local unbound_config = configmanager.get("*", "unbound") or {};

			unbound_config.hoststxt = false; -- don't look at /etc/hosts

			configmanager.set("*", "unbound", unbound_config);

			dns = require"net.unbound".dns;

		end)

		local idna = require "util.encodings".idna;

		local ip = require "util.ip";

		local c2s_ports = set.new(configmanager.get("*", "c2s_ports") or {5222});

		local s2s_ports = set.new(configmanager.get("*", "s2s_ports") or {5269});

		local c2s_tls_ports = set.new(configmanager.get("*", "direct_tls_ports") or {});

		local c2s_srv_required, s2s_srv_required, c2s_tls_srv_required;

		if not c2s_ports:contains(5222) then

			c2s_srv_required = true;

		end

		if not s2s_ports:contains(5269) then

			s2s_srv_required = true;

		end

		if not c2s_tls_ports:empty() then

			c2s_tls_srv_required = true;

		end

		local problem_hosts = set.new();

		local external_addresses, internal_addresses = set.new(), set.new();

		local fqdn = socket.dns.tohostname(socket.dns.gethostname());

		if fqdn then

			do

				local res = dns.lookup(idna.to_ascii(fqdn), "A");

				if res then

					for _, record in ipairs(res) do

						external_addresses:add(record.a);

					end

				end

			end

			do

				local res = dns.lookup(idna.to_ascii(fqdn), "AAAA");

				if res then

					for _, record in ipairs(res) do

						external_addresses:add(record.aaaa);

					end

				end

			end

		end

		local local_addresses = require"util.net".local_addresses() or {};

		for addr in it.values(local_addresses) do

			if not ip.new_ip(addr).private then

				external_addresses:add(addr);

			else

				internal_addresses:add(addr);

			end

		end

		if external_addresses:empty() then

			print("");

			print("   Failed to determine the external addresses of this server. Checks may be inaccurate.");

			c2s_srv_required, s2s_srv_required = true, true;

		end

		local v6_supported = not not socket.tcp6;

		for jid, host_options in enabled_hosts() do

			local all_targets_ok, some_targets_ok = true, false;

			local node, host = jid_split(jid);

			local modules, component_module = modulemanager.get_modules_for_host(host);

			if component_module then

				modules:add(component_module);

			end

			local is_component = not not host_options.component_module;

			print("Checking DNS for "..(is_component and "component" or "host").." "..jid.."...");

			if node then

				print("Only the domain part ("..host..") is used in DNS.")

			end

			local target_hosts = set.new();

			if modules:contains("c2s") then

				local res = dns.lookup("_xmpp-client._tcp."..idna.to_ascii(host)..".", "SRV");

				if res and #res > 0 then