import { createRequire } from 'module'

import fs from 'fs/promises'

import { $rdf } from './rdf.js'

import { HttpError } from './error.js'

import { debugACL as debug } from './utils.js'

const require = createRequire(import.meta.url)

const aclCheck = require('@solid/acl-check')

const ACL = $rdf.Namespace('http://www.w3.org/ns/auth/acl#')

export class ACLChecker {

constructor ({ ldp, rootUrl }) {

this.ldp = ldp

this.rootUrl = rootUrl

}

async can (user, resourceUrl, mode, isContainer) {

const { aclUrl, aclBody, isDefault, directory } = await this.findACL(resourceUrl, isContainer)

if (!aclBody) {

throw new HttpError(500, 'No ACL found for ' + resourceUrl)

}

const graph = $rdf.graph()

try {

$rdf.parse(aclBody, graph, aclUrl, 'text/turtle')

} catch (e) {

throw new HttpError(500, 'Error parsing ACL: ' + e.message)

}

const doc = $rdf.sym(resourceUrl)

const aclDoc = $rdf.sym(aclUrl)

const agent = user ? $rdf.sym(user) : null

const modes = [ACL(mode)]

const dir = isDefault ? $rdf.sym(directory) : null

const denied = aclCheck.accessDenied(graph, doc, dir, aclDoc, agent, modes, null, null)

if (denied) {

debug(`Access denied: ${user || 'anonymous'} ${mode} ${resourceUrl} — ${denied}`)

const status = user ? 403 : 401

throw new HttpError(status, denied)

}

}

async getPermissions (user, resourceUrl, isContainer) {

const { aclUrl, aclBody, isDefault, directory } = await this.findACL(resourceUrl, isContainer)

if (!aclBody) return { user: [], public: [] }

const graph = $rdf.graph()

try {

$rdf.parse(aclBody, graph, aclUrl, 'text/turtle')

} catch {

return { user: [], public: [] }

}

const doc = $rdf.sym(resourceUrl)

const aclDoc = $rdf.sym(aclUrl)

const dir = isDefault ? $rdf.sym(directory) : null

const modes = ['Read', 'Write', 'Append', 'Control']

const userPerms = []

const publicPerms = []

for (const mode of modes) {

const agent = user ? $rdf.sym(user) : null

if (agent) {

const denied = aclCheck.accessDenied(graph, doc, dir, aclDoc, agent, [ACL(mode)], null, null)

if (!denied) userPerms.push(mode.toLowerCase())

}

const pubDenied = aclCheck.accessDenied(graph, doc, dir, aclDoc, null, [ACL(mode)], null, null)

if (!pubDenied) publicPerms.push(mode.toLowerCase())

}

return { user: userPerms, public: publicPerms }

}

async findACL (resourceUrl, isContainer) {

let url = resourceUrl

let isDefault = false

// Walk up the hierarchy looking for .acl files

for (let depth = 0; depth < 30; depth++) {

const aclUrl = url.endsWith('/') ? url + '.acl' : url + '.acl'

const aclPathname = aclUrl.slice(this.rootUrl.length)

try {

const filePath = this.ldp.resolve(aclPathname)

const body = await fs.readFile(filePath, 'utf8')

return {

aclUrl,

aclBody: body,

isDefault,

directory: isDefault ? url : null

}

} catch {

// No ACL here, go up

}

if (url === this.rootUrl || url === this.rootUrl + '/') {

break

}

// Move to parent

isDefault = true

if (url.endsWith('/')) {

url = url.slice(0, -1)

}

const lastSlash = url.lastIndexOf('/')

if (lastSlash <= url.indexOf('/', 8)) {

url = this.rootUrl + '/'

} else {

url = url.slice(0, lastSlash + 1)

}

}

return { aclUrl: null, aclBody: null, isDefault: false, directory: null }

}

}

export function wacAllowHeader (perms) {

const u = perms.user.length ? perms.user.join(' ') : ''

const p = perms.public.length ? perms.public.join(' ') : ''

return `user="${u}",public="${p}"`

}