/* Copyright (c) 2008-2009 Dovecot authors, see the included COPYING file */

#include "lib.h"
#include "array.h"
#include "str.h"
#include "dict.h"
#include "mail-user.h"
#include "mail-namespace.h"
#include "acl-api-private.h"
#include "acl-storage.h"
#include "acl-plugin.h"
#include "acl-lookup-dict.h"

#include <stdlib.h>

#define DICT_SHARED_BOXES_PATH "shared-boxes/"

struct acl_lookup_dict {
	struct mail_user *user;
	struct dict *dict;
};

struct acl_lookup_dict_iter {
	pool_t pool;
	struct acl_lookup_dict *dict;

	ARRAY_TYPE(const_string) iter_ids;
	struct dict_iterate_context *dict_iter;
	unsigned int iter_idx;

	const char *prefix;
	unsigned int prefix_len;

	unsigned int failed:1;
};

struct acl_lookup_dict *acl_lookup_dict_init(struct mail_user *user)
{
	struct acl_lookup_dict *dict;
	const char *uri;

	dict = i_new(struct acl_lookup_dict, 1);
	dict->user = user;

	uri = mail_user_plugin_getenv(user, "acl_shared_dict");
	if (uri != NULL) {
		dict->dict = dict_init(uri, DICT_DATA_TYPE_STRING, "");
		if (dict->dict == NULL)
			i_error("acl: dict_init(%s) failed", uri);
	} else if (user->mail_debug) {
		i_info("acl: No acl_shared_dict setting - "
		       "shared mailbox listing is disabled");
	}
	return dict;
}

void acl_lookup_dict_deinit(struct acl_lookup_dict **_dict)
{
	struct acl_lookup_dict *dict = *_dict;

	*_dict = NULL;
	if (dict->dict != NULL)
		dict_deinit(&dict->dict);
	i_free(dict);
}

static void
acl_lookup_dict_write_rights_id(string_t *dest, const struct acl_rights *right)
{
	switch (right->id_type) {
	case ACL_ID_ANYONE:
	case ACL_ID_AUTHENTICATED:
		/* don't bother separating these */
		str_append(dest, "anyone");
		break;
	case ACL_ID_USER:
		str_append(dest, "user/");
		str_append(dest, right->identifier);
		break;
	case ACL_ID_GROUP:
	case ACL_ID_GROUP_OVERRIDE:
		str_append(dest, "group/");
		str_append(dest, right->identifier);
		break;
	case ACL_ID_OWNER:
	case ACL_ID_TYPE_COUNT:
		i_unreached();
	}
}

static int acl_lookup_dict_rebuild_add_backend(struct mail_namespace *ns,
					       ARRAY_TYPE(const_string) *ids)
{
	struct acl_backend *backend;
	struct acl_mailbox_list_context *ctx;
	struct acl_object *aclobj;
	struct acl_object_list_iter *iter;
	struct acl_rights rights;
	const char *name, *id_dup;
	string_t *id;
	int ret, ret2 = 0;

	if ((ns->flags & NAMESPACE_FLAG_NOACL) != 0 || ns->owner == NULL)
		return 0;

	id = t_str_new(128);
	backend = acl_mailbox_list_get_backend(ns->list);
	ctx = acl_backend_nonowner_lookups_iter_init(backend);
	while ((ret = acl_backend_nonowner_lookups_iter_next(ctx, &name)) > 0) {
		aclobj = acl_object_init_from_name(backend, name);

		iter = acl_object_list_init(aclobj);
		while ((ret = acl_object_list_next(iter, &rights)) > 0) {
			if (acl_rights_has_nonowner_lookup_changes(&rights)) {
				str_truncate(id, 0);
				acl_lookup_dict_write_rights_id(id, &rights);
				str_append_c(id, '/');
				str_append(id, ns->owner->username);
				id_dup = t_strdup(str_c(id));
				array_append(ids, &id_dup, 1);
			}
		}
		acl_object_list_deinit(&iter);
		if (ret < 0)
			ret2 = -1;
		acl_object_deinit(&aclobj);
	}
	acl_backend_nonowner_lookups_iter_deinit(&ctx);
	return ret < 0 || ret2 < 0 ? -1 : 0;
}

static int
acl_lookup_dict_rebuild_update(struct acl_lookup_dict *dict,
			       const ARRAY_TYPE(const_string) *new_ids_arr,
			       bool no_removes)
{
	const char *username = dict->user->username;
	struct dict_iterate_context *iter;
	struct dict_transaction_context *dt;
	const char *prefix, *key, *value, **old_ids, *const *new_ids, *p;
	ARRAY_TYPE(const_string) old_ids_arr;
	unsigned int newi, oldi, old_count, new_count;
	string_t *path;
	unsigned int prefix_len;
	int ret;

	/* get all existing identifiers for the user. we might be able to
	   sync identifiers also for other users whose shared namespaces we
	   have, but it's possible that the other users have other namespaces
	   that aren't visible to us, so we don't want to remove anything
	   that could break them. */
	t_array_init(&old_ids_arr, 128);
	prefix = DICT_PATH_SHARED DICT_SHARED_BOXES_PATH;
	prefix_len = strlen(prefix);
	iter = dict_iterate_init(dict->dict, prefix, DICT_ITERATE_FLAG_RECURSE);
	while ((ret = dict_iterate(iter, &key, &value)) > 0) {
		/* prefix/$dest/$source */
		key += prefix_len;
		p = strchr(key, '/');
		if (p != NULL && strcmp(p + 1, username) == 0) {
			key = t_strdup_until(key, p);
			array_append(&old_ids_arr, &key, 1);
		}
	}
	dict_iterate_deinit(&iter);
	if (ret < 0) {
		i_error("acl: dict iteration failed, can't update dict");
		return -1;
	}

	/* sort the existing identifiers */
	old_ids = array_get_modifiable(&old_ids_arr, &old_count);
	qsort(old_ids, old_count, sizeof(*old_ids), i_strcmp_p);

	/* sync the identifiers */
	path = t_str_new(256);
	str_append(path, prefix);

	dt = dict_transaction_begin(dict->dict);
	new_ids = array_get(new_ids_arr, &new_count);
	for (newi = oldi = 0; newi < new_count || oldi < old_count; ) {
		ret = newi == new_count ? 1 :
			oldi == old_count ? -1 :
			strcmp(new_ids[newi], old_ids[oldi]);
		if (ret == 0) {
			newi++; oldi++;
		} else if (ret < 0) {
			/* new identifier, add it */
			str_truncate(path, prefix_len);
			str_append(path, new_ids[newi]);
			dict_set(dt, str_c(path), "1");
			newi++;
		} else if (!no_removes) {
			/* old identifier removed */
			str_truncate(path, prefix_len);
			str_append(path, old_ids[oldi]);
			str_append_c(path, '/');
			str_append(path, username);
			dict_unset(dt, str_c(path));
			oldi++;
		}
	}
	if (dict_transaction_commit(&dt) < 0) {
		i_error("acl: dict commit failed");
		return -1;
	}
	return 0;
}

int acl_lookup_dict_rebuild(struct acl_lookup_dict *dict)
{
	struct mail_namespace *ns;
	ARRAY_TYPE(const_string) ids_arr;
	const char **ids;
	unsigned int i, dest, count;
	int ret = 0;

	if (dict->dict == NULL)
		return 0;

	/* get all ACL identifiers with a positive lookup right */
	t_array_init(&ids_arr, 128);
	for (ns = dict->user->namespaces; ns != NULL; ns = ns->next) {
		if (acl_lookup_dict_rebuild_add_backend(ns, &ids_arr) < 0)
			ret = -1;
	}

	/* sort identifiers and remove duplicates */
	ids = array_get_modifiable(&ids_arr, &count);
	qsort(ids, count, sizeof(*ids), i_strcmp_p);

	for (i = 1, dest = 0; i < count; i++) {
		if (strcmp(ids[dest], ids[i]) != 0) {
			if (++dest != i)
				ids[dest] = ids[i];
		}
	}
	if (++dest < count)
		array_delete(&ids_arr, dest, count-dest);

	/* if lookup failed at some point we can still add new ids,
	   but we can't remove any existing ones */
	if (acl_lookup_dict_rebuild_update(dict, &ids_arr, ret < 0) < 0)
		ret = -1;
	return ret;
}

static void acl_lookup_dict_iterate_start(struct acl_lookup_dict_iter *iter)
{
	const char *const *idp;

	idp = array_idx(&iter->iter_ids, iter->iter_idx);
	iter->iter_idx++;
	iter->prefix = p_strconcat(iter->pool, DICT_PATH_SHARED
				   DICT_SHARED_BOXES_PATH, *idp, "/", NULL);
	iter->prefix_len = strlen(iter->prefix);

	iter->dict_iter = dict_iterate_init(iter->dict->dict, iter->prefix,
					    DICT_ITERATE_FLAG_RECURSE);
}

struct acl_lookup_dict_iter *
acl_lookup_dict_iterate_visible_init(struct acl_lookup_dict *dict)
{
	struct acl_user *auser = ACL_USER_CONTEXT(dict->user);
	struct acl_lookup_dict_iter *iter;
	const char *id;
	unsigned int i;
	pool_t pool;

	pool = pool_alloconly_create("acl lookup dict iter", 512);
	iter = p_new(pool, struct acl_lookup_dict_iter, 1);
	iter->pool = pool;
	iter->dict = dict;

	p_array_init(&iter->iter_ids, pool, 16);
	id = "anyone";
	array_append(&iter->iter_ids, &id, 1);
	id = p_strconcat(pool, "user/", dict->user->username, NULL);
	array_append(&iter->iter_ids, &id, 1);

	/* get all groups we belong to */
	if (auser->groups != NULL) {
		for (i = 0; auser->groups[i] != NULL; i++) {
			id = p_strconcat(pool, "group/", auser->groups[i],
					 NULL);
			array_append(&iter->iter_ids, &id, 1);
		}
	}

	/* iterate through all identifiers that match us, start with the
	   first one */
	if (dict->dict != NULL)
		acl_lookup_dict_iterate_start(iter);
	return iter;
}

const char *
acl_lookup_dict_iterate_visible_next(struct acl_lookup_dict_iter *iter)
{
	const char *key, *value;
	int ret;

	if (iter->dict_iter == NULL)
		return 0;

	ret = dict_iterate(iter->dict_iter, &key, &value);
	if (ret > 0) {
		i_assert(iter->prefix_len < strlen(key));
		return key + iter->prefix_len;
	}
	if (ret < 0)
		iter->failed = TRUE;
	dict_iterate_deinit(&iter->dict_iter);

	if (iter->iter_idx < array_count(&iter->iter_ids)) {
		/* get to the next iterator */
		acl_lookup_dict_iterate_start(iter);
		return acl_lookup_dict_iterate_visible_next(iter);
	}
	return NULL;
}

int acl_lookup_dict_iterate_visible_deinit(struct acl_lookup_dict_iter **_iter)
{
	struct acl_lookup_dict_iter *iter = *_iter;
	int ret = iter->failed ? -1 : 0;

	*_iter = NULL;
	if (iter->dict_iter != NULL)
		dict_iterate_deinit(&iter->dict_iter);
	pool_unref(&iter->pool);
	return ret;
}