import { audit } from '../helpers/audit.ts'
import { maskSensitiveProps } from '../helpers/common.ts'
import { mayOnPage } from './pages.ts'
import { COMMENT_MAX_LENGTH, COMMENT_MIN_LENGTH } from '../models/comments.ts'
import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify'
import type { CommentsProviderInput } from '../models/comments.ts'
import type { RulePageRef } from '../helpers/pageRules.ts'

const siteIdParam = {
  type: 'object',
  properties: {
    siteId: {
      type: 'string',
      format: 'uuid'
    }
  },
  required: ['siteId']
}

const pageIdParam = {
  type: 'object',
  properties: {
    siteId: { type: 'string', format: 'uuid' },
    pageId: { type: 'string', format: 'uuid' }
  },
  required: ['siteId', 'pageId']
}

const commentIdParam = {
  type: 'object',
  properties: {
    siteId: { type: 'string', format: 'uuid' },
    commentId: { type: 'string', format: 'uuid' }
  },
  required: ['siteId', 'commentId']
}

/**
 * A roughly-shaped email address, for the one a guest has to leave.
 *
 * Deliberately not a proof that the address exists — nothing here sends to it. It is what Akismet is
 * given and what a future moderation screen would show, and the check is here so that a required
 * field cannot be satisfied with a space.
 */
const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/

/**
 * Comments API Routes
 *
 * Two halves, and they answer to different permissions.
 *
 * **The configuration half** — `GET`/`PUT /sites/:siteId/comments` — is the admin area's Comments
 * screen: which provider this site uses and how it is configured. `manage:sites`, like every other
 * per-site configuration screen.
 *
 * **The comments themselves** are the built-in provider, and carry NO route-level `permissions`: what
 * governs them is `read:comments`, `write:comments` and `manage:comments`, which are PAGE rule
 * permissions and cannot be enforced by a hook that only reads the group-wide list. Every one of these
 * routes resolves the page first and asks `mayOnPage` about it — see `helpers/pageRules.ts` for how a
 * rule is chosen.
 */
async function routes(app: FastifyInstance) {
  /**
   * GET SITE COMMENTS CONFIGURATION
   */
  app.get<{ Params: { siteId: string } }>(
    '/sites/:siteId/comments',
    {
      config: {
        permissions: ['manage:sites']
      },
      schema: {
        summary: 'Get the comments configuration of a site',
        description:
          'The provider this site uses, plus one entry per provider that could be selected — the wiki’s own first, then every module installed in `modules/comments` — each with the values this site has configured for it.\n\nSensitive props are masked: the built-in provider’s Akismet key comes back as a fixed placeholder, and sending that placeholder back keeps the stored key.',
        tags: ['Comments'],
        params: siteIdParam,
        response: {
          200: {
            description: 'Comments configuration of the site',
            type: 'object',
            properties: {
              provider: {
                type: 'string',
                description:
                  'Key of the selected provider, or an empty string when this site has picked none. This is what is stored rather than what is in force: `isAllowed` is the other half.'
              },
              isAllowed: {
                type: 'boolean',
                description:
                  'Whether the site allows comments at all — the switch under General → Features. False makes the selection below have no effect, which is worth saying on the screen that edits it.'
              },
              providers: {
                type: 'array',
                items: { $ref: 'CommentsProvider#' }
              }
            }
          }
        }
      }
    },
    async (req, reply) => {
      const site = await WIKI.models.sites.getSiteById({ id: req.params.siteId })
      if (!site) {
        return reply.notFound('Site does not exist.')
      }
      const providers = WIKI.models.comments.getSiteProviders(req.params.siteId)
      return {
        // -> What is STORED. The screen edits the selection whether or not the site-wide switch is
        //    on, and says so through `isAllowed` rather than by reporting nothing selected.
        provider: WIKI.models.comments.selectedProvider(req.params.siteId),
        isAllowed: WIKI.models.comments.isAllowed(req.params.siteId),
        // -> Masking is the last thing that happens on the way out, here and nowhere earlier: the
        //    model hands out the real values because that is what the spam check reads its key from
        providers: providers.map((provider) => ({
          ...provider,
          config: maskSensitiveProps(provider.props, provider.config)
        }))
      }
    }
  )

  /**
   * UPDATE SITE COMMENTS CONFIGURATION
   */
  app.put<{
    Params: { siteId: string }
    Body: { provider?: string; providers?: CommentsProviderInput[] }
  }>(
    '/sites/:siteId/comments',
    {
      config: {
        permissions: ['manage:sites']
      },
      schema: {
        summary: 'Update the comments configuration of a site',
        description:
          'Selects the provider and writes whatever configuration came with it. The providers not mentioned keep what they had, so trying another one and coming back finds a form that is still filled in.\n\nEverything is validated before any of it is written, so a rejected request changes nothing. A saved change applies to the next page view, on every instance.',
        tags: ['Comments'],
        params: siteIdParam,
        body: {
          type: 'object',
          properties: {
            provider: {
              type: 'string',
              maxLength: 255,
              description:
                'Key of the provider to use, or an empty string to turn comments off for this site.'
            },
            providers: {
              type: 'array',
              items: { $ref: 'CommentsProviderInput#' }
            }
          }
        },
        response: {
          200: {
            description: 'Comments configuration updated successfully',
            type: 'object',
            properties: {
              ok: { type: 'boolean' },
              message: { type: 'string' }
            }
          }
        }
      }
    },
    async (req, reply) => {
      const site = await WIKI.models.sites.getSiteById({ id: req.params.siteId })
      if (!site) {
        return reply.notFound('Site does not exist.')
      }
      if (
        req.body.provider !== undefined &&
        req.body.provider.length > 0 &&
        !WIKI.models.comments.getDefinition(req.body.provider)
      ) {
        return reply.badRequest(`There is no comments provider called "${req.body.provider}".`)
      }
      // -> Validated as a whole first: the screen saves every provider at once, and a partially
      //    applied configuration is worse than a refused one
      for (const patch of req.body.providers ?? []) {
        const invalid = WIKI.models.comments.validateProvider(patch)
        if (invalid) {
          return reply.badRequest(invalid)
        }
      }

      await WIKI.models.comments.updateSiteConfig(req.params.siteId, req.body)

      /*
        Which provider was selected and which fields were touched — never the values. An Akismet key
        is exactly the kind of thing `meta` must not carry, and the rest of it names an account at a
        third party rather than anything about this wiki.
      */
      await audit(req, 'admin', 'updateComments', {
        siteId: req.params.siteId,
        provider: req.body.provider,
        changedProviders: (req.body.providers ?? []).map((patch) => ({
          key: patch.key,
          changedFields: Object.keys(patch.config ?? {})
        }))
      })

      return { ok: true, message: 'Comments configuration updated successfully.' }
    }
  )

  /**
   * LIST COMMENTS OF A PAGE
   */
  /*
    No route-level `permissions`: `read:comments` is granted by a group's page RULES, which the hook
    in `index.ts` cannot see. Checked against this page below instead.
  */
  app.get<{ Params: { siteId: string; pageId: string } }>(
    '/sites/:siteId/pages/:pageId/comments',
    {
      schema: {
        summary: 'List the comments of a page',
        description:
          'Every comment on the page, oldest first and flat — the one level of nesting is assembled by the client from `parentId`, which keeps a reply beside the comment it answers however old that comment is.\n\nOnly for a site using the built-in provider; a site whose discussions live at a third party answers 404 here. Needs `read:comments` on the page, which the guests group may hold.\n\n`mentions` resolves the handles written in these comments, so that a mention is drawn as a link to the right person without a lookup per `@`.',
        tags: ['Comments'],
        params: pageIdParam,
        response: {
          200: {
            description: 'The comments on this page',
            type: 'object',
            properties: {
              comments: {
                type: 'array',
                items: { $ref: 'Comment#' }
              },
              mentions: {
                type: 'array',
                items: { $ref: 'MentionTarget#' }
              },
              total: {
                type: 'integer',
                description:
                  'How many comments the page has. The same as the length of `comments` unless the page has more than the list caps at, which is the one case where the count beside the Talk tab must not be taken from the list.'
              }
            }
          }
        }
      }
    },
    async (req, reply) => {
      const page = await requireBuiltInPage(req, reply)
      if (!page) {
        return reply
      }
      if (!mayOnPage(req, 'read:comments', page)) {
        return reply.forbidden('You are not allowed to read the comments of this page.')
      }
      const comments = await WIKI.models.comments.listForPage(page.id)
      const [mentions, total] = await Promise.all([
        WIKI.models.comments.resolveMentions(comments.map((c) => c.content)),
        WIKI.models.comments.countForPage(page.id)
      ])
      return { comments, mentions, total }
    }
  )

  /**
   * POST A COMMENT
   */
  // -> No route-level permissions: `write:comments` is a page rule. See the note above.
  app.post<{
    Params: { siteId: string; pageId: string }
    Body: { content: string; parentId?: string; authorName?: string; authorEmail?: string }
  }>(
    '/sites/:siteId/pages/:pageId/comments',
    {
      schema: {
        summary: 'Post a comment on a page',
        description:
          'Needs `write:comments` on the page. A rule may grant it to the guests group, in which case a name and an email address are required of whoever is posting — the email is stored but never served, and is what the spam check is given.\n\nThe site’s posting cooldown applies to everybody who is not a moderator, counted per account and per address for a guest; going over it answers 429 with `Retry-After`. With an Akismet key configured, a comment Akismet calls spam is refused.',
        tags: ['Comments'],
        params: pageIdParam,
        body: {
          type: 'object',
          required: ['content'],
          properties: {
            content: {
              type: 'string',
              minLength: COMMENT_MIN_LENGTH,
              maxLength: COMMENT_MAX_LENGTH,
              description: 'Markdown source. Raw HTML in it is escaped rather than rendered.'
            },
            parentId: {
              type: 'string',
              format: 'uuid',
              description:
                'The comment being answered. Replying to a reply attaches the answer to that reply’s own parent — the thread is one level deep.'
            },
            authorName: {
              type: 'string',
              minLength: 1,
              maxLength: 255,
              description:
                'Required of a guest, ignored for a signed-in author (the account has one).'
            },
            authorEmail: {
              type: 'string',
              maxLength: 255,
              description: 'Required of a guest. Stored, never served.'
            }
          }
        },
        response: {
          201: {
            description: 'The comment as it was stored',
            $ref: 'Comment#'
          }
        }
      }
    },
    async (req, reply) => {
      const page = await requireBuiltInPage(req, reply)
      if (!page) {
        return reply
      }
      if (!page.allowComments) {
        return reply.forbidden('Comments are turned off for this page.')
      }
      if (!mayOnPage(req, 'write:comments', page)) {
        return reply.forbidden('You are not allowed to comment on this page.')
      }

      const user = req.session?.authenticated ? req.session.user : null
      let authorName = user?.name ?? ''
      let authorEmail = user?.email ?? ''
      if (!user) {
        /*
          A guest. Both fields are required here rather than left to the schema, because they are
          required only of a guest: a signed-in author has a name and an address on their account, and
          a form that asked them for both again would be asking them to type something the wiki
          already knows and would then have two answers for.
        */
        authorName = (req.body.authorName ?? '').trim()
        authorEmail = (req.body.authorEmail ?? '').trim()
        if (authorName.length < 1) {
          return reply.badRequest('A name is required to comment as a guest.')
        }
        if (!EMAIL_PATTERN.test(authorEmail)) {
          return reply.badRequest('A valid email address is required to comment as a guest.')
        }
      }

      const cooldown = await consumeCooldown(req, page)
      if (cooldown > 0) {
        reply.header('Retry-After', String(cooldown))
        return reply.tooManyRequests(
          `You are posting too quickly. Try again in ${cooldown} second(s).`
        )
      }

      const origin = `${req.protocol}://${req.hostname}`
      const isSpam = await WIKI.models.comments.isSpam(req.params.siteId, {
        content: req.body.content,
        authorName,
        authorEmail,
        authorIP: req.ip,
        userAgent: req.headers['user-agent'] ?? '',
        referrer: req.headers.referer ?? '',
        permalink: `${origin}/${page.path}`,
        isGuest: !user
      })
      if (isSpam) {
        /*
          Refused rather than held: there is no moderation queue yet, and a comment nobody can see
          and nobody is told about is worse than one that was turned away with a reason. `meta` on
          the row is where a queue would go when there is one.
        */
        return reply.badRequest('This comment was flagged as spam and was not posted.')
      }

      let comment
      try {
        comment = await WIKI.models.comments.create({
          pageId: page.id,
          parentId: req.body.parentId ?? null,
          content: req.body.content,
          authorId: user?.id ?? null,
          authorName,
          authorEmail: user ? '' : authorEmail,
          authorIP: req.ip
        })
      } catch (err: any) {
        return reply.badRequest(err.message)
      }

      await audit(req, 'comment', 'createComment', {
        commentId: comment.id,
        pageId: page.id,
        path: page.path,
        locale: page.locale,
        isReply: Boolean(comment.parentId),
        isGuest: comment.isGuest
      })
      // -> The email is a guest's alone: an account's
      //    comment stores none, and `authorId` is what identifies it
      await WIKI.models.hooks.emit('comment:new', {
        id: comment.id,
        parentId: comment.parentId,
        pageId: page.id,
        path: page.path,
        locale: page.locale,
        siteId: req.params.siteId,
        authorId: comment.authorId,
        metadata: {
          authorName: comment.authorName,
          authorEmail: user ? null : authorEmail,
          authorIP: req.ip,
          isGuest: comment.isGuest,
          pageTitle: page.title
        },
        content: comment.content
      })

      reply.code(201)
      return comment
    }
  )

  /**
   * EDIT A COMMENT
   */
  // -> No route-level permissions: the two that matter here are page rules. See the note above.
  app.put<{ Params: { siteId: string; commentId: string }; Body: { content: string } }>(
    '/sites/:siteId/comments/:commentId',
    {
      schema: {
        summary: 'Edit a comment',
        description:
          'Whoever holds `manage:comments` on the page may edit any comment on it; everybody else may edit their own, and only while they still hold `write:comments` there.\n\nA guest cannot edit at all: there is no session that identifies them as the author, so `their own` has nothing to mean.',
        tags: ['Comments'],
        params: commentIdParam,
        body: {
          type: 'object',
          required: ['content'],
          properties: {
            content: {
              type: 'string',
              minLength: COMMENT_MIN_LENGTH,
              maxLength: COMMENT_MAX_LENGTH
            }
          }
        },
        response: {
          200: {
            description: 'The comment as it now stands',
            $ref: 'Comment#'
          }
        }
      }
    },
    async (req, reply) => {
      const comment = await requireWritableComment(req, reply)
      if (!comment) {
        return reply
      }
      const updated = await WIKI.models.comments.update(comment.id, req.body.content)
      if (!updated) {
        return reply.notFound('This comment does not exist.')
      }
      await audit(req, 'comment', 'updateComment', {
        commentId: comment.id,
        pageId: comment.pageId,
        path: comment.path,
        isOwn: comment.authorId === req.session?.user?.id
      })
      // -> `actorId` beside `authorId`, since a moderator editing somebody else's comment is exactly
      //    the case a subscriber is likely to be watching for
      await WIKI.models.hooks.emit('comment:edit', {
        id: comment.id,
        parentId: comment.parentId,
        pageId: comment.pageId,
        path: comment.path,
        locale: comment.locale,
        siteId: req.params.siteId,
        authorId: comment.authorId,
        actorId: req.session?.user?.id ?? null,
        metadata: {
          authorName: updated.authorName,
          authorEmail: comment.authorEmail || null,
          authorIP: comment.authorIP || null,
          isGuest: updated.isGuest
        },
        content: updated.content
      })
      return updated
    }
  )

  /**
   * DELETE A COMMENT
   */
  // -> No route-level permissions: the two that matter here are page rules. See the note above.
  app.delete<{ Params: { siteId: string; commentId: string } }>(
    '/sites/:siteId/comments/:commentId',
    {
      schema: {
        summary: 'Delete a comment',
        description:
          'Same rule as editing: `manage:comments` on the page deletes any comment, `write:comments` deletes your own.\n\nThe replies underneath go with it. A reply exists to answer something, and left behind it is half of a conversation nobody can read.',
        tags: ['Comments'],
        params: commentIdParam,
        response: {
          200: {
            description: 'Comment deleted successfully',
            type: 'object',
            properties: {
              ok: { type: 'boolean' },
              deleted: {
                type: 'integer',
                description: 'How many comments went, the replies underneath included.'
              }
            }
          }
        }
      }
    },
    async (req, reply) => {
      const comment = await requireWritableComment(req, reply)
      if (!comment) {
        return reply
      }
      const deleted = await WIKI.models.comments.remove(comment.id)
      await audit(req, 'comment', 'deleteComment', {
        commentId: comment.id,
        pageId: comment.pageId,
        path: comment.path,
        deleted,
        isOwn: comment.authorId === req.session?.user?.id
      })
      // -> One event for the comment asked about, not one per reply the cascade took with it:
      //    `deleted` says how many went
      await WIKI.models.hooks.emit('comment:delete', {
        id: comment.id,
        parentId: comment.parentId,
        pageId: comment.pageId,
        path: comment.path,
        locale: comment.locale,
        siteId: req.params.siteId,
        authorId: comment.authorId,
        actorId: req.session?.user?.id ?? null,
        deleted,
        metadata: {
          authorEmail: comment.authorEmail || null,
          authorIP: comment.authorIP || null,
          isGuest: comment.authorId === null
        }
      })
      return { ok: true, deleted }
    }
  )

  /**
   * SEARCH MENTIONABLE USERS
   */
  app.get<{ Params: { siteId: string }; Querystring: { q?: string } }>(
    '/sites/:siteId/comments/mentions',
    {
      schema: {
        summary: 'Find users to mention in a comment',
        description:
          'What the `@` in a comment box completes against: users who have set a handle, matched on the handle or the display name.\n\nNeeds a signed-in session, and nothing else — a handle and a display name are what every comment already shows, but answering this to anybody at all would make it a way to enumerate the wiki’s users. A guest who knows a handle can still type it; it resolves when the comment is drawn.',
        tags: ['Comments'],
        params: siteIdParam,
        querystring: {
          type: 'object',
          properties: {
            q: {
              type: 'string',
              maxLength: 64,
              description: 'What has been typed after the `@`. Empty lists the first few handles.'
            }
          }
        },
        response: {
          200: {
            description: 'Users that can be mentioned',
            type: 'array',
            items: { $ref: 'MentionTarget#' }
          }
        }
      }
    },
    async (req, reply) => {
      if (!req.session?.authenticated) {
        return reply.unauthorized('You must be signed in to look up users to mention.')
      }
      return WIKI.models.comments.searchHandles(req.query.q ?? '')
    }
  )
}

/**
 * The page a request is about, once it is established that this site's comments are the wiki's own.
 *
 * Both questions answer 404 rather than anything more specific. A site using Disqus has no comments
 * here to have an opinion about, and a page id that is not on this site is not this caller's to be
 * told about.
 *
 * @returns The page, or null once it has sent the reply itself
 */
async function requireBuiltInPage(
  req: FastifyRequest<{ Params: { siteId: string; pageId: string } }>,
  reply: FastifyReply
) {
  if (!WIKI.models.comments.usesBuiltIn(req.params.siteId)) {
    reply.notFound('This site does not use the built-in comments provider.')
    return null
  }
  const page = await WIKI.models.comments.pageRef(req.params.siteId, req.params.pageId)
  if (!page) {
    reply.notFound('This page does not exist.')
    return null
  }
  // -> Carrying the site, since everything below asks a page rule about this page and a rule may be
  //    limited to particular sites
  return { ...page, siteId: req.params.siteId }
}

/**
 * The comment a request is about, once it is established that the caller may change it.
 *
 * `manage:comments` on the page is the moderator's answer and covers anything on it. Otherwise it has
 * to be the caller's own comment AND they have to still hold `write:comments` there — a rule that was
 * taken away takes the editing of what was written under it with it.
 *
 * @returns The comment, or null once it has sent the reply itself
 */
async function requireWritableComment(
  req: FastifyRequest<{ Params: { siteId: string; commentId: string } }>,
  reply: FastifyReply
) {
  if (!WIKI.models.comments.usesBuiltIn(req.params.siteId)) {
    reply.notFound('This site does not use the built-in comments provider.')
    return null
  }
  const comment = await WIKI.models.comments.getWithPage(req.params.commentId, req.params.siteId)
  if (!comment) {
    reply.notFound('This comment does not exist.')
    return null
  }
  const page = {
    siteId: req.params.siteId,
    path: comment.path,
    locale: comment.locale,
    tags: comment.tags ?? []
  }
  if (mayOnPage(req, 'manage:comments', page)) {
    return comment
  }
  const userId = req.session?.authenticated ? req.session.user?.id : null
  if (!userId || comment.authorId !== userId || !mayOnPage(req, 'write:comments', page)) {
    reply.forbidden('You are not allowed to modify this comment.')
    return null
  }
  return comment
}

/**
 * Count this post against the site's cooldown, and say how long is left of it.
 *
 * Per account, and per address for a guest — an office behind one address shares a counter only where
 * the wiki has no better way of telling two people apart, which is exactly the case the cooldown is
 * for. The counter is the same postgres-backed one the login limit uses, so two instances behind a
 * load balancer agree about it.
 *
 * Moderators are exempt, along with `manage:system` as everywhere: `manage:comments` on this page is
 * the permission to clean up after other people, and answering five threads in a row is what that
 * looks like.
 *
 * @returns Seconds the caller must wait, or 0 when the post may go ahead
 */
async function consumeCooldown(
  req: FastifyRequest<{ Params: { siteId: string; pageId: string } }>,
  page: RulePageRef
): Promise<number> {
  const seconds = WIKI.models.comments.cooldownFor(req.params.siteId)
  if (seconds < 1 || mayOnPage(req, 'manage:comments', page)) {
    return 0
  }
  // -> The address is the fallback for a session with no user on it as well as for a guest: a key
  //    ending in `undefined` would be one counter shared by everybody it happened to
  const who = (req.session?.authenticated ? req.session.user?.id : null) ?? `ip:${req.ip}`
  const verdict = await WIKI.models.rateLimits.consume(`comment:${req.params.siteId}:${who}`, {
    /*
      One post per window, and a ban as long as the window. Two attempts inside the cooldown are one
      post and one refusal, and the refusal does not push the ban further out — a banned key stops
      counting, so the wait is measured from the last post that was actually accepted plus whatever
      the client spent retrying.
    */
    max: 1,
    windowSeconds: seconds,
    banSeconds: seconds
  })
  return verdict.allowed ? 0 : verdict.retryAfter
}

export default routes