// Copyright (c) 2019-2024 Alexander Medvednikov. All rights reserved.
// Use of this source code is governed by an MIT license
// that can be found in the LICENSE file.
module http

import net.ssl
import strings

fn (req &Request) ssl_do(port int, method Method, host_name string, path string, data string, header Header) !Response {
	$if windows && !no_vschannel ? {
		return vschannel_ssl_do(req, port, method, host_name, path, data, header)
	}
	return net_ssl_do(req, port, method, host_name, path, data, header)
}

fn net_ssl_do(req &Request, port int, method Method, host_name string, path string, data string, header Header) !Response {
	mut retries := 0
	req_headers := req.build_request_headers_with(method, host_name, port, path, data, header)
	$if trace_http_request ? {
		eprint('> ')
		eprint(req_headers)
		eprintln('')
	}
	// Advertise ALPN `h2` (with an `http/1.1` fallback) when HTTP/2 is enabled.
	// This is the default for https requests, so ordinary get()/fetch() calls
	// advertise ALPN and use HTTP/2 when the server selects it; callers can opt
	// out with `enable_http2: false`. The HTTP/2 read path feeds the same
	// streaming callbacks and honors the stop limits, so they do not force
	// HTTP/1.1.
	alpn := if req.enable_http2 { ['h2', 'http/1.1'] } else { []string{} }
	for {
		mut ssl_conn := ssl.new_ssl_conn(
			verify:                 req.verify
			cert:                   req.cert
			cert_key:               req.cert_key
			validate:               req.validate
			in_memory_verification: req.in_memory_verification
			alpn_protocols:         alpn
		)!
		ssl_conn.dial(host_name, port) or {
			retries++
			if is_no_need_retry_error(err.code()) || retries >= req.max_retries {
				return err
			}
			continue
		}
		// Propagate the request's read timeout into the SSL backend.
		// Without this, mbedtls keeps its init-time default and openssl falls back to no
		// timeout at all on a stalled socket — see issue surfaced by macOS arm64 + tcc CI hangs.
		if req.read_timeout > 0 {
			ssl_conn.set_read_timeout(req.read_timeout)
		}
		// If the server negotiated HTTP/2 via ALPN, speak it; otherwise fall
		// back to the existing HTTP/1.1 path unchanged.
		if req.enable_http2 && ssl_conn.negotiated_alpn() == 'h2' {
			return req.h2_do(mut ssl_conn, method, host_name, port, path, data, header)!
		}
		return req.do_request(req_headers, mut ssl_conn)!
	}
	return error('http.net_ssl_do: exhausted retries')
}

// h2_do runs a single request over an HTTP/2 connection on an already-dialled,
// ALPN-negotiated `h2` TLS socket, and returns the response as a net.http
// Response. The request's streaming callbacks (on_progress / on_progress_body)
// and stop limits are adapted onto the H2 chunk hook so they fire per DATA
// frame, matching the HTTP/1.1 streaming semantics as closely as is possible
// on the framed wire (on_progress receives DATA payloads rather than raw
// network reads).
fn (req &Request) h2_do(mut ssl_conn ssl.SSLConn, method Method, host_name string, port int, path string, data string, header Header) !Response {
	defer {
		ssl_conn.shutdown() or {}
	}
	mut conn := new_h2_conn(ssl_conn)
	return req.h2_exchange(mut conn, method, host_name, port, path, data, header)!
}

// h2_exchange runs a single request over an already-established H2Conn and
// converts the result to a net.http Response. It is transport-agnostic: the
// caller is responsible for building the H2Conn over whatever ALPN-negotiated
// `h2` transport (net.ssl on most platforms, SChannel on default Windows) and
// for tearing it down afterwards. The request's streaming callbacks and stop
// limits are adapted onto the H2 chunk hook, as documented on h2_do.
fn (req &Request) h2_exchange(mut conn H2Conn, method Method, host_name string, port int, path string, data string, header Header) !Response {
	base := req.to_h2_request(method, h2_authority(host_name, port), path, data, header)
	on_progress := req.on_progress
	on_progress_body := req.on_progress_body
	mut on_data := H2DataFn(unsafe { nil })
	if on_progress != unsafe { nil } || on_progress_body != unsafe { nil } {
		on_data = fn [req, on_progress, on_progress_body] (chunk []u8, body_so_far u64, body_expected u64, status int) ! {
			if on_progress != unsafe { nil } {
				on_progress(req, chunk, body_so_far)!
			}
			if on_progress_body != unsafe { nil } {
				on_progress_body(req, chunk, body_so_far, body_expected, status)!
			}
		}
	}
	h2req := H2ClientRequest{
		method:               base.method
		scheme:               base.scheme
		authority:            base.authority
		path:                 base.path
		headers:              base.headers
		body:                 base.body
		on_data:              on_data
		stop_copying_limit:   req.stop_copying_limit
		stop_receiving_limit: req.stop_receiving_limit
	}
	h2resp := conn.do(h2req)!
	if req.on_finish != unsafe { nil } {
		req.on_finish(req, u64(h2resp.body.len))!
	}
	return h2_response_to_http(h2resp)
}

fn read_from_ssl_connection_cb(con voidptr, buf &u8, bufsize int) !int {
	mut ssl_conn := unsafe { &ssl.SSLConn(con) }
	return ssl_conn.socket_read_into_ptr(buf, bufsize)
}

fn (req &Request) do_request(req_headers string, mut ssl_conn ssl.SSLConn) !Response {
	defer {
		ssl_conn.shutdown() or {}
	}
	ssl_conn.write_string(req_headers) or { return err }
	mut content := strings.new_builder(4096)
	response_info := req.receive_all_data_from_cb_in_builder(mut content, voidptr(ssl_conn),
		read_from_ssl_connection_cb)!
	response_text := content.str()
	$if trace_http_response ? {
		eprint('< ')
		eprint(response_text)
		eprintln('')
	}
	if req.on_finish != unsafe { nil } {
		req.on_finish(req, u64(response_text.len))!
	}
	return parse_received_response(response_text, response_info)
}

// h1_exchange_ssl sends an already-built HTTP/1.x request over an open TLS
// connection and reads one response, leaving the connection open (unlike
// do_request, which shuts the connection down). The bool result reports
// whether the response was precisely framed, so the connection can safely
// carry another request (see ReceivedResponseInfo.reusable).
fn (req &Request) h1_exchange_ssl(mut ssl_conn ssl.SSLConn, raw string) !(Response, bool) {
	ssl_conn.write_string(raw) or {
		return error('http.transport: TLS connection write failed: ${err.msg()}')
	}
	mut content := strings.new_builder(4096)
	response_info := req.receive_all_data_from_cb_in_builder(mut content, voidptr(ssl_conn),
		read_from_ssl_connection_cb)!
	response_text := content.str()
	$if trace_http_response ? {
		eprint('< ')
		eprint(response_text)
		eprintln('')
	}
	if req.on_finish != unsafe { nil } {
		req.on_finish(req, u64(response_text.len))!
	}
	resp := parse_received_response(response_text, response_info)!
	return resp, response_info.reusable
}