// Copyright (c) 2019-2026 Alexander Medvednikov. All rights reserved.
// Use of this source code is governed by a GPL license that can be found in the LICENSE file.
module main

import time
import net
import net.http
import net.urllib
import crypto.hmac
import crypto.sha256
import encoding.hex
import x.json2 as json

pub struct WebhookIssuePayload {
    action string
    repo   string
    title  string
    author string
}

pub struct WebhookPrPayload {
    action string
    repo   string
    number int
    title  string
    author string
    head   string
    base   string
}

pub struct WebhookCommentPayload {
    action string
    repo   string
    target string // 'issue' or 'pr'
    number int
    author string
    text   string
}

pub struct WebhookReleasePayload {
    action string
    repo   string
    tag    string
    author string
}

pub struct WebhookPushPayload {
    repo   string
    ref    string
    author string
}

struct Webhook {
    id int @[primary; sql: serial]
mut:
    repo_id       int
    url           string
    secret        string
    events        string // comma-separated: push,issue,pr,comment,release
    is_active     bool
    created_at    int
    last_status   int
    last_delivery int
}

struct WebhookDelivery {
    id int @[primary; sql: serial]
mut:
    webhook_id    int
    event         string
    status_code   int
    response_body string
    created_at    int
}

fn (w &Webhook) has_event(name string) bool {
    if w.events == '' {
        return true
    }
    for ev in w.events.split(',') {
        if ev.trim_space() == name {
            return true
        }
    }
    return false
}

fn (w &Webhook) event_list() []string {
    mut out := []string{}
    for ev in w.events.split(',') {
        t := ev.trim_space()
        if t != '' {
            out << t
        }
    }
    return out
}

fn (mut app App) add_webhook(repo_id int, url string, secret string, events string) ! {
    wh := Webhook{
        repo_id:    repo_id
        url:        url
        secret:     secret
        events:     events
        is_active:  true
        created_at: int(time.now().unix())
    }
    sql app.db {
        insert wh into Webhook
    }!
}

fn (mut app App) list_repo_webhooks(repo_id int) []Webhook {
    return sql app.db {
        select from Webhook where repo_id == repo_id order by id desc
    } or { []Webhook{} }
}

fn (mut app App) find_webhook_by_id(id int) ?Webhook {
    rows := sql app.db {
        select from Webhook where id == id limit 1
    } or { []Webhook{} }
    if rows.len == 0 {
        return none
    }
    return rows.first()
}

fn (mut app App) delete_webhook(id int) ! {
    sql app.db {
        delete from Webhook where id == id
    }!
    sql app.db {
        delete from WebhookDelivery where webhook_id == id
    }!
}

fn (mut app App) delete_repo_webhooks(repo_id int) ! {
    whs := app.list_repo_webhooks(repo_id)
    for wh in whs {
        app.delete_webhook(wh.id) or {}
    }
}

fn (mut app App) toggle_webhook(id int, active bool) ! {
    sql app.db {
        update Webhook set is_active = active where id == id
    }!
}

fn (mut app App) record_webhook_delivery(webhook_id int, event string, status int, body string) {
    d := WebhookDelivery{
        webhook_id:    webhook_id
        event:         event
        status_code:   status
        response_body: body
        created_at:    int(time.now().unix())
    }
    sql app.db {
        insert d into WebhookDelivery
    } or { return }
    sql app.db {
        update Webhook set last_status = status, last_delivery = d.created_at where id == webhook_id
    } or { return }
}

fn (mut app App) recent_webhook_deliveries(webhook_id int, limit int) []WebhookDelivery {
    return sql app.db {
        select from WebhookDelivery where webhook_id == webhook_id order by id desc limit limit
    } or { []WebhookDelivery{} }
}

// dispatch_webhook fires a webhook delivery in a background spawn.
// payload is any serializable value; it's JSON-encoded with `json.encode`.
fn (mut app App) dispatch_webhook[T](repo_id int, event string, payload T) {
    body := json.encode(payload)
    app.fan_out_webhook(repo_id, event, body)
}

fn (mut app App) fan_out_webhook(repo_id int, event string, body string) {
    hooks := app.list_repo_webhooks(repo_id)
    for wh in hooks {
        if !wh.is_active {
            continue
        }
        if !wh.has_event(event) {
            continue
        }
        spawn app.deliver_webhook(wh, event, body)
    }
}

// is_blocked_ipv4 reports whether the dotted-quad IPv4 string falls in a range
// a webhook must never reach: unspecified (0/8), loopback (127/8), private
// (10/8, 172.16/12, 192.168/16), CGNAT (100.64/10), link-local (169.254/16,
// which includes the cloud metadata address 169.254.169.254), and
// multicast/reserved (>=224). Unparseable input is treated as blocked.
fn is_blocked_ipv4(ip string) bool {
    parts := ip.split('.')
    if parts.len != 4 {
        return true
    }
    mut o := [4]int{}
    for i in 0 .. 4 {
        if parts[i] == '' {
            return true
        }
        n := parts[i].int()
        if n < 0 || n > 255 {
            return true
        }
        o[i] = n
    }
    return o[0] == 0 || o[0] == 10 || o[0] == 127 || (o[0] == 169 && o[1] == 254)
        || (o[0] == 172 && o[1] >= 16 && o[1] <= 31) || (o[0] == 192 && o[1] == 168)
        || (o[0] == 100 && o[1] >= 64 && o[1] <= 127) || o[0] >= 224
}

// is_blocked_ipv6 reports whether the IPv6 text (no brackets) is loopback (::1),
// unspecified (::), unique-local (fc00::/7), link-local (fe80::/10), or an
// IPv4-mapped address (e.g. ::ffff:127.0.0.1) pointing at a blocked IPv4.
fn is_blocked_ipv6(ip_in string) bool {
    ip := ip_in.to_lower()
    if ip == '::1' || ip == '::' {
        return true
    }
    // IPv4-mapped/-compatible forms end in a dotted quad.
    if ip.contains('.') {
        tail := ip.all_after_last(':')
        if tail.contains('.') {
            return is_blocked_ipv4(tail)
        }
    }
    if ip.starts_with('fc') || ip.starts_with('fd') {
        return true
    }
    if ip.starts_with('fe8') || ip.starts_with('fe9') || ip.starts_with('fea')
        || ip.starts_with('feb') {
        return true
    }
    return false
}

// is_safe_webhook_url validates a webhook destination before any server-side
// request is made: the scheme must be http(s), the host must resolve, and none
// of the resolved addresses may be loopback/private/link-local. Resolving here
// blocks hostnames that point at internal IPs; it cannot fully defeat DNS
// rebinding between this check and delivery, but it closes the common SSRF
// vectors (literal internal IPs, localhost, cloud metadata endpoints).
fn is_safe_webhook_url(raw string) bool {
    u := urllib.parse(raw) or { return false }
    scheme := u.scheme.to_lower()
    if scheme != 'http' && scheme != 'https' {
        return false
    }
    host := u.hostname()
    if host == '' {
        return false
    }
    lhost := host.to_lower()
    if lhost == 'localhost' || lhost.ends_with('.localhost') {
        return false
    }
    port := if u.port() != '' {
        u.port()
    } else if scheme == 'https' {
        '443'
    } else {
        '80'
    }
    addrs := net.resolve_addrs('${host}:${port}', .unspec, .tcp) or { return false }
    if addrs.len == 0 {
        return false
    }
    for a in addrs {
        s := a.str()
        match a.family() {
            .ip {
                if is_blocked_ipv4(s.all_before_last(':')) {
                    return false
                }
            }
            .ip6 {
                if is_blocked_ipv6(s.find_between('[', ']')) {
                    return false
                }
            }
            else {
                return false
            }
        }
    }
    return true
}

fn (mut app App) deliver_webhook(wh Webhook, event string, body string) {
    // Re-validate at delivery time: this is the authoritative SSRF gate. It
    // also protects webhooks created before this check existed and catches
    // hosts whose DNS now points at an internal address.
    if !is_safe_webhook_url(wh.url) {
        app.record_webhook_delivery(wh.id, event, 0,
            'blocked: destination resolves to a disallowed (internal/loopback) address')
        return
    }
    mut signature := ''
    if wh.secret != '' {
        sig_bytes := hmac.new(wh.secret.bytes(), body.bytes(), sha256.sum, sha256.block_size)
        signature = 'sha256=' + hex.encode(sig_bytes)
    }
    mut req := http.new_request(.post, wh.url, body)
    req.header.add(.content_type, 'application/json')
    req.header.add_custom('X-Gitly-Event', event) or {}
    if signature != '' {
        req.header.add_custom('X-Gitly-Signature', signature) or {}
    }
    req.read_timeout = 10 * time.second
    req.write_timeout = 10 * time.second
    resp := req.do() or {
        app.record_webhook_delivery(wh.id, event, 0, err.str())
        return
    }
    preview := if resp.body.len > 500 { resp.body[..500] } else { resp.body }
    app.record_webhook_delivery(wh.id, event, resp.status_code, preview)
}