// Copyright (c) 2019-2024 Alexander Medvednikov. All rights reserved.
// Use of this source code is governed by an MIT license
// that can be found in the LICENSE file.
module http

import net
import sync

@[heap]
struct TlsIdleConnTracker {
    mu &sync.Mutex = sync.new_mutex()
mut:
    handles []int
    closing bool
    // closed records handles that close_idle force-closed on Windows. The woken
    // worker consults was_force_closed and relinquishes socket ownership (so its
    // conn.shutdown frees the TLS resources without closing the fd again), keeping
    // the fd closed exactly once. Empty on non-Windows (close_idle only shuts the
    // fd down there, leaving the worker the sole closer).
    closed []int
}

fn (mut t TlsIdleConnTracker) mark_idle(handle int) bool {
    t.mu.lock()
    defer {
        t.mu.unlock()
    }
    if t.closing {
        return false
    }
    // Dedup: the same handle can be marked twice (e.g. a worker marks it for the
    // handshake window and again per keep-alive request, or the OS recycles the
    // fd value). A duplicate would make close_idle shut down / close the same fd
    // twice within its own loop, so only track each handle once.
    if t.handles.index(handle) < 0 {
        t.handles << handle
    }
    return true
}

fn (mut t TlsIdleConnTracker) unmark_idle(handle int) {
    t.mu.lock()
    defer {
        t.mu.unlock()
    }
    idx := t.handles.index(handle)
    if idx >= 0 {
        t.handles.delete(idx)
    }
}

// was_force_closed reports whether close_idle has already closed `handle`
// (Windows force-close to wake a worker blocked in select). The woken worker
// must then relinquish socket ownership before its own conn.shutdown, which
// then frees the TLS resources without closing the fd again: a second close
// would race process-wide SOCKET reuse — the value can be reused by ANY socket
// the process opens, not just this server's accept loop — and could close an
// unrelated socket. Always false on non-Windows, where close_idle only shuts
// the fd down and the worker remains the sole closer.
fn (mut t TlsIdleConnTracker) was_force_closed(handle int) bool {
    $if windows {
        t.mu.lock()
        defer {
            t.mu.unlock()
        }
        return t.closed.index(handle) >= 0
    } $else {
        return false
    }
}

fn (mut t TlsIdleConnTracker) close_idle() {
    t.mu.lock()
    defer {
        t.mu.unlock()
    }
    t.closing = true
    handles := t.handles.clone()
    t.handles.clear()
    $if windows {
        // On Windows, net.shutdown(SD_BOTH) does not unblock a worker blocked in
        // select() — only closesocket() (net.close, below) does — so we must
        // force-close idle handles to wake their workers. Record ownership of
        // those closes here, under the lock, so a worker that wakes (or exits for
        // another reason) sees it via was_force_closed and relinquishes socket
        // ownership instead of closing the fd again. Without that the fd would be
        // closed twice, and between
        // the two closes the SOCKET value can be reused by any socket the process
        // opens, so the second close could hit an unrelated socket.
        t.closed << handles
    }
    // Hold the lock across the loop. On non-Windows, was_force_closed is always
    // false, so the worker remains the sole closer (via conn.shutdown); holding
    // the lock blocks its unmark_idle until our net.shutdown below has run, so
    // the worker cannot close the fd — and let the OS recycle the value — before
    // we shut it down. (Releasing the lock here would reopen exactly that race.)
    // On Windows the woken worker skips its close regardless, so the held lock
    // only briefly delays it and is otherwise harmless.
    for handle in handles {
        net.shutdown(handle)
        $if windows {
            net.close(handle) or {}
        }
    }
}