// Package githttp implements the git "smart HTTP" wire protocol on top of
// go-git's server transport sessions. go-git ships the upload-pack/receive-pack
// session logic and the pkt-line/packp encoders, but not a net/http handler, so
// this package supplies the framing that stock `git` expects:
//
//	GET  <repo>/info/refs?service=git-upload-pack   -> ref advertisement
//	GET  <repo>/info/refs?service=git-receive-pack  -> ref advertisement
//	POST <repo>/git-upload-pack                      -> pack negotiation (clone/fetch)
//	POST <repo>/git-receive-pack                     -> ref updates (push)
//
// Only protocol v0 is implemented. A client that sends "Git-Protocol: version=2"
// gets no v2 response and transparently falls back to v0. go-git's server does
// not support shallow (--depth) clones.
package githttp

import (
	"bytes"
	"compress/gzip"
	"context"
	"errors"
	"fmt"
	"io"
	"net/http"

	"github.com/go-git/go-git/v5/plumbing"
	"github.com/go-git/go-git/v5/plumbing/format/pktline"
	"github.com/go-git/go-git/v5/plumbing/protocol/packp"
	"github.com/go-git/go-git/v5/plumbing/storer"
	"github.com/go-git/go-git/v5/plumbing/transport"
	"github.com/go-git/go-git/v5/plumbing/transport/server"
)

// maxBody bounds a POST body (the packfile for push, or the negotiation for
// fetch) to guard against a malicious or runaway client.
const maxBody = 256 << 20 // 256 MiB

// Service identifies a git smart-HTTP service.
type Service string

const (
	UploadPack  Service = "git-upload-pack"  // clone / fetch
	ReceivePack Service = "git-receive-pack" // push
)

// fixedLoader is a go-git transport loader that always serves one storer,
// ignoring the requested endpoint. gitweb resolves the repo before dispatch, so
// each request already has its storer.
type fixedLoader struct{ s storer.Storer }

func (l fixedLoader) Load(*transport.Endpoint) (storer.Storer, error) { return l.s, nil }

func newUploadSession(s storer.Storer) (transport.UploadPackSession, error) {
	return server.NewServer(fixedLoader{s}).NewUploadPackSession(&transport.Endpoint{}, nil)
}

// NewReceivePackSession returns a receive-pack session bound to s. It is
// exported so the push write-back path (which must run the session against a
// private, writable storer) can reuse the same construction.
func NewReceivePackSession(s storer.Storer) (transport.ReceivePackSession, error) {
	return server.NewServer(fixedLoader{s}).NewReceivePackSession(&transport.Endpoint{}, nil)
}

// InfoRefs writes the ref advertisement for svc over s, in smart-HTTP form:
// the "# service=<svc>" banner and a flush, followed by the pkt-line ref list
// (with capabilities). The caller must not have written a body yet.
func InfoRefs(w http.ResponseWriter, s storer.Storer, svc Service) error {
	var ar *packp.AdvRefs
	var err error
	switch svc {
	case UploadPack:
		sess, e := newUploadSession(s)
		if e != nil {
			return e
		}
		defer sess.Close()
		ar, err = sess.AdvertisedReferencesContext(context.Background())
	case ReceivePack:
		sess, e := NewReceivePackSession(s)
		if e != nil {
			return e
		}
		defer sess.Close()
		ar, err = sess.AdvertisedReferencesContext(context.Background())
	default:
		return fmt.Errorf("githttp: unknown service %q", svc)
	}
	if err != nil {
		return err
	}

	w.Header().Set("Content-Type", fmt.Sprintf("application/x-%s-advertisement", svc))
	w.Header().Set("Cache-Control", "no-cache")

	enc := pktline.NewEncoder(w)
	if err := enc.Encodef("# service=%s\n", svc); err != nil {
		return err
	}
	if err := enc.Flush(); err != nil {
		return err
	}
	return ar.Encode(w)
}

// negotiation is the tail of an upload-pack request: the "have" lines the
// client is offering, and whether it closed the request with "done".
type negotiation struct {
	haves []plumbing.Hash
	done  bool
}

// decodeNegotiation reads the have/done section that follows the upload
// request. UploadRequest.Decode stops at the flush-pkt ending the want section,
// so this part of the body is still unread; without it req.Haves stays empty
// and every fetch re-sends the full history.
func decodeNegotiation(r io.Reader) (negotiation, error) {
	var n negotiation
	sc := pktline.NewScanner(r)
	for sc.Scan() {
		line := bytes.TrimSuffix(sc.Bytes(), []byte("\n"))
		switch {
		case len(line) == 0:
			// flush-pkt: end of this batch of haves.
		case bytes.Equal(line, []byte("done")):
			n.done = true
			return n, nil
		case bytes.HasPrefix(line, []byte("have ")):
			text := string(bytes.TrimPrefix(line, []byte("have ")))
			h := plumbing.NewHash(text)
			if h.IsZero() {
				return n, fmt.Errorf("malformed have line %q", line)
			}
			n.haves = append(n.haves, h)
		}
	}
	return n, sc.Err()
}

// ServeUploadPack handles a POST git-upload-pack: it decodes the client's
// negotiation from the (possibly gzip-compressed) body, runs upload-pack over
// s, and streams the packfile response.
//
// Over stateless HTTP the client negotiates across several requests. It offers
// its haves in batches — the first holds 16 — and ends a batch that is not its
// last with a flush-pkt and no "done". In that round it is reading ACK/NAK
// pkt-lines to decide what to offer next, so a packfile must not be sent: the
// client would read the literal "PACK" where a pkt-line length belongs and fail
// with "protocol error: bad line length character: PACK". We answer such a
// round with a bare NAK; the commit we share is acknowledged only once the
// client sends "done", which is also when the pack goes out.
func ServeUploadPack(w http.ResponseWriter, r *http.Request, s storer.Storer) error {
	body, err := requestBody(r)
	if err != nil {
		return err
	}
	defer body.Close()

	req := packp.NewUploadPackRequest()
	if err := req.Decode(body); err != nil {
		return err
	}
	neg, err := decodeNegotiation(body)
	if err != nil {
		return err
	}
	// Only the haves we actually hold may be passed on. The session walks them
	// to build the exclusion set and fails on any object it cannot find, and a
	// client with unpushed local commits legitimately offers some we lack.
	// Excluding everything reachable from the rest is what keeps a fetch from
	// re-sending history the client already has.
	common := commonHaves(s, neg.haves)
	req.Haves = common

	if !neg.done {
		// The client is still negotiating, so no packfile yet -- but the answer
		// must be NAK even when we do share a commit. We advertise no multi_ack,
		// and in that mode a plain ACK does not mean "noted": it means
		// negotiation is over and the pack follows. git acts on it immediately,
		// sending a bare "done" request carrying no haves and reading that
		// response as a raw packfile, so an ACK here costs both the negotiated
		// haves and the fetch, which fails with "protocol error: bad pack
		// header". The common base is acknowledged on the "done" round instead.
		setUploadPackHeaders(w)
		return pktline.NewEncoder(w).Encode([]byte("NAK\n"))
	}

	sess, err := newUploadSession(s)
	if err != nil {
		return err
	}
	defer sess.Close()

	resp, err := sess.UploadPack(r.Context(), req)
	if err != nil {
		return err
	}
	// The client has finished negotiating, so this ACK names the base the pack
	// was cut against rather than cutting negotiation short. Without it
	// find_common returns "no common commits" and git warns on every fetch.
	if len(common) > 0 {
		resp.ACKs = []plumbing.Hash{common[0]}
	}

	setUploadPackHeaders(w)
	return resp.Encode(w)
}

// commonHaves returns the haves present in s, in the order the client offered
// them — git sends its newest commits first, so the first entry is the most
// recent commit the two sides share.
func commonHaves(s storer.Storer, haves []plumbing.Hash) []plumbing.Hash {
	var common []plumbing.Hash
	for _, h := range haves {
		if _, err := s.EncodedObject(plumbing.AnyObject, h); err == nil {
			common = append(common, h)
		}
	}
	return common
}

func setUploadPackHeaders(w http.ResponseWriter) {
	w.Header().Set("Content-Type", fmt.Sprintf("application/x-%s-result", UploadPack))
	w.Header().Set("Cache-Control", "no-cache")
}

// ErrProbe is returned by DecodeReceivePack for git's probe request: a POST
// whose whole body is a flush-pkt ("0000"). git sends it before a request too
// large for http.postBuffer, to check that the endpoint works (and that it is
// authorized) before streaming the real body chunked. It must be answered
// with 200 and an empty result, or git abandons the push.
var ErrProbe = errors.New("receive-pack probe")

// DecodeReceivePack parses a POST git-receive-pack body into a reference-update
// request. The returned request's Packfile is a streaming reader over the rest
// of the body; the caller runs the receive-pack session (see the push package)
// and then calls WriteReceivePackResult. It returns ErrProbe for git's
// flush-only probe request.
func DecodeReceivePack(r *http.Request) (*packp.ReferenceUpdateRequest, error) {
	body, err := requestBody(r)
	if err != nil {
		return nil, err
	}
	// The first pkt-line is always sent in full before the client waits for
	// anything, so reading its 4-byte length can't block. A real push starts
	// with a command; only the probe starts with a flush.
	var head [4]byte
	if _, err := io.ReadFull(body, head[:]); err != nil {
		body.Close()
		return nil, fmt.Errorf("read receive-pack request: %w", err)
	}
	if string(head[:]) == "0000" {
		body.Close()
		return nil, ErrProbe
	}
	body = prefixedBody{Reader: io.MultiReader(bytes.NewReader(head[:]), body), Closer: body}

	// Note: body is not closed here; req.Packfile streams from it and is closed
	// by the receive-pack session.
	req := packp.NewReferenceUpdateRequest()
	if err := req.Decode(body); err != nil {
		body.Close()
		return nil, err
	}
	// A pack follows the commands only when at least one ref is created or
	// updated; a delete-only push sends none (same rule as stock
	// receive-pack). Decode leaves the body reader in req.Packfile regardless,
	// and go-git's session unpacks whenever Packfile is non-nil, failing on
	// the packless stream ("empty packfile") — so nil it out. Detection must
	// come from the commands, not from probing the body past them: a read
	// would block, because the client transmits nothing further until it sees
	// our response.
	needPack := false
	for _, cmd := range req.Commands {
		if cmd.Action() != packp.Delete {
			needPack = true
			break
		}
	}
	if !needPack {
		body.Close()
		req.Packfile = nil
	}
	return req, nil
}

// WriteReceivePackResult writes the report-status for a completed push. A nil
// status (client did not request report-status) writes nothing.
func WriteReceivePackResult(w http.ResponseWriter, rs *packp.ReportStatus) error {
	w.Header().Set("Content-Type", fmt.Sprintf("application/x-%s-result", ReceivePack))
	w.Header().Set("Cache-Control", "no-cache")
	if rs == nil {
		return nil
	}
	return rs.Encode(w)
}

// requestBody returns the request body, transparently decompressing it when the
// client sent Content-Encoding: gzip (stock git gzips larger request bodies),
// and capping the amount read.
func requestBody(r *http.Request) (io.ReadCloser, error) {
	var body io.ReadCloser = http.MaxBytesReader(nil, r.Body, maxBody)
	if r.Header.Get("Content-Encoding") == "gzip" {
		zr, err := gzip.NewReader(body)
		if err != nil {
			body.Close()
			return nil, err
		}
		return gzipBody{zr: zr, under: body}, nil
	}
	return body, nil
}

// prefixedBody puts bytes already read back in front of a body, keeping the
// original's Close.
type prefixedBody struct {
	io.Reader
	io.Closer
}

// gzipBody couples a gzip reader with the underlying capped body so both are
// closed together.
type gzipBody struct {
	zr    *gzip.Reader
	under io.ReadCloser
}

func (g gzipBody) Read(p []byte) (int, error) { return g.zr.Read(p) }
func (g gzipBody) Close() error {
	err := g.zr.Close()
	if cerr := g.under.Close(); err == nil {
		err = cerr
	}
	return err
}