/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

/***************************************************************************
 * Copyright (C) 2017-2026 ZmartZone Holding BV
 * All rights reserved.
 *
 * DISCLAIMER OF WARRANTIES:
 *
 * THE SOFTWARE PROVIDED HEREUNDER IS PROVIDED ON AN "AS IS" BASIS, WITHOUT
 * ANY WARRANTIES OR REPRESENTATIONS EXPRESS, IMPLIED OR STATUTORY; INCLUDING,
 * WITHOUT LIMITATION, WARRANTIES OF QUALITY, PERFORMANCE, NONINFRINGEMENT,
 * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.  NOR ARE THERE ANY
 * WARRANTIES CREATED BY A COURSE OR DEALING, COURSE OF PERFORMANCE OR TRADE
 * USAGE.  FURTHERMORE, THERE ARE NO WARRANTIES THAT THE SOFTWARE WILL MEET
 * YOUR NEEDS OR BE FREE FROM ERRORS, OR THAT THE OPERATION OF THE SOFTWARE
 * WILL BE UNINTERRUPTED.  IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES HOWEVER CAUSED AND ON ANY THEORY OF
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * @Author: Hans Zandbelt - hans.zandbelt@openidc.com
 */

#include "util/util.h"

/*
 * true if path exists and is a regular file; with follow set, a symlink is resolved and it is
 * the target that must be regular - right for operator-managed files (metadata, templates,
 * keys), where symlinks are a fact of deployment life (Kubernetes ConfigMap volumes expose
 * every file as one) - while without it the path itself must be regular, for the module's own
 * private cache directory where a symlink can only have been planted. finfo->filetype is
 * always well-defined on return: APR_NOFILE when the path could not be stat-ed at all
 * (typically: missing, or a dangling symlink when following), the actual (non-regular) type
 * otherwise, letting callers tell "absent" apart from "present but wrong type"
 */
apr_byte_t oidc_util_file_is_regular(apr_pool_t *pool, const char *path, apr_byte_t follow, apr_finfo_t *finfo) {
	finfo->filetype = APR_NOFILE;
	if (apr_stat(finfo, path, APR_FINFO_TYPE | (follow ? 0 : APR_FINFO_LINK), pool) != APR_SUCCESS)
		return FALSE;
	return (finfo->filetype == APR_REG) ? TRUE : FALSE;
}

typedef enum {
	OIDC_UTIL_FILE_READ_OK = 0,
	OIDC_UTIL_FILE_READ_NOT_FOUND,	 /* missing, or could not be stat-ed/opened */
	OIDC_UTIL_FILE_READ_NOT_REGULAR, /* exists but is a symlink or other special file */
	OIDC_UTIL_FILE_READ_IO_ERROR,	 /* stat/open succeeded but a later step failed */
} oidc_util_file_read_rc_t;

/*
 * hardened whole-file read shared by the request- and server-scoped wrappers below: rejects
 * symlinks/non-regular files and caps the size of what gets allocated into memory; the caller
 * is responsible for logging, since the request/server logging macros are not interchangeable
 */
static oidc_util_file_read_rc_t oidc_util_file_read_core(apr_pool_t *pool, const char *path, char **result, char *s_err,
							 apr_size_t s_err_len) {
	apr_file_t *fd = NULL;
	apr_status_t rc = APR_SUCCESS;
	apr_finfo_t finfo;

	/* follow symlinks: what is read here is operator-managed (metadata, templates, keys) and
	 * commonly symlinked into place; it is the target that must be a regular file */
	if (oidc_util_file_is_regular(pool, path, TRUE, &finfo) == FALSE) {
		if (finfo.filetype == APR_NOFILE) {
			apr_cpystrn(s_err, "no such file", s_err_len);
			return OIDC_UTIL_FILE_READ_NOT_FOUND;
		}
		apr_cpystrn(s_err, "not a regular file", s_err_len);
		return OIDC_UTIL_FILE_READ_NOT_REGULAR;
	}

	/* open the file */
	if ((rc = apr_file_open(&fd, path, APR_FOPEN_READ | APR_FOPEN_BUFFERED, APR_OS_DEFAULT, pool)) != APR_SUCCESS) {
		apr_strerror(rc, s_err, s_err_len);
		return OIDC_UTIL_FILE_READ_NOT_FOUND;
	}

	/* the file exists, now lock it */
	apr_file_lock(fd, APR_FLOCK_EXCLUSIVE);

	/* move the read pointer to the very start of the file */
	apr_off_t begin = 0;
	apr_file_seek(fd, APR_SET, &begin);

	/* get the file info so we know its size */
	if ((rc = apr_file_info_get(&finfo, APR_FINFO_SIZE, fd)) != APR_SUCCESS) {
		apr_strerror(rc, s_err, s_err_len);
		goto error_close;
	}

	/* refuse untrusted on-disk sizes before allocating memory for the contents */
	if ((finfo.size < 0) || (finfo.size > (apr_off_t)OIDC_UTIL_FILE_SIZE_MAX)) {
		apr_snprintf(s_err, s_err_len, "file too large (%" APR_OFF_T_FMT " bytes)", finfo.size);
		goto error_close;
	}

	/* now that we have the size of the file, allocate a buffer that can contain its contents */
	*result = apr_palloc(pool, finfo.size + 1);

	/* read the file in to the buffer */
	apr_size_t bytes_read = 0;
	if ((rc = apr_file_read_full(fd, *result, finfo.size, &bytes_read)) != APR_SUCCESS) {
		apr_strerror(rc, s_err, s_err_len);
		goto error_close;
	}

	/* just to be sure, we set a \0 (we allocated space for it anyway) */
	(*result)[bytes_read] = '\0';

	/* check that we've got all of it */
	if ((apr_off_t)bytes_read != finfo.size) {
		apr_snprintf(s_err, s_err_len, "read %" APR_SIZE_T_FMT " bytes, expected %" APR_OFF_T_FMT, bytes_read,
			     finfo.size);
		goto error_close;
	}

	/* we're done, unlock and close the file */
	apr_file_unlock(fd);
	apr_file_close(fd);

	return OIDC_UTIL_FILE_READ_OK;

error_close:

	apr_file_unlock(fd);
	apr_file_close(fd);

	return OIDC_UTIL_FILE_READ_IO_ERROR;
}

/*
 * read a file from a path on disk, for use at request time
 */
apr_byte_t oidc_util_file_read(request_rec *r, const char *path, apr_pool_t *pool, char **result) {
	char s_err[128];
	oidc_util_file_read_rc_t rc = oidc_util_file_read_core(pool, path, result, s_err, sizeof(s_err));

	switch (rc) {
	case OIDC_UTIL_FILE_READ_OK:
		oidc_debug(r, "file read successfully \"%s\"", path);
		return TRUE;
	case OIDC_UTIL_FILE_READ_NOT_FOUND:
		oidc_warn(r, "no file found at: \"%s\" (%s)", path, s_err);
		return FALSE;
	case OIDC_UTIL_FILE_READ_NOT_REGULAR:
		oidc_warn(r, "refusing to read non-regular file: \"%s\"", path);
		return FALSE;
	default:
		oidc_error(r, "reading \"%s\" failed: %s", path, s_err);
		return FALSE;
	}
}

/*
 * read a file from a path on disk, for use at server startup (e.g. config/license checks)
 * where there is no request_rec to log against or allocate from
 */
apr_byte_t oidc_util_file_read_server(server_rec *s, const char *path, apr_pool_t *pool, char **result) {
	char s_err[128];
	oidc_util_file_read_rc_t rc = oidc_util_file_read_core(pool, path, result, s_err, sizeof(s_err));

	switch (rc) {
	case OIDC_UTIL_FILE_READ_OK:
		oidc_sdebug(s, "file read successfully \"%s\"", path);
		return TRUE;
	case OIDC_UTIL_FILE_READ_NOT_FOUND:
		oidc_swarn(s, "no file found at: \"%s\" (%s)", path, s_err);
		return FALSE;
	case OIDC_UTIL_FILE_READ_NOT_REGULAR:
		oidc_swarn(s, "refusing to read non-regular file: \"%s\"", path);
		return FALSE;
	default:
		oidc_serror(s, "reading \"%s\" failed: %s", path, s_err);
		return FALSE;
	}
}

/*
 * write data to a file
 */
apr_byte_t oidc_util_file_write(request_rec *r, const char *path, const char *data) {

	apr_file_t *fd = NULL;
	apr_status_t rc = APR_SUCCESS;
	apr_size_t bytes_written = 0;
	char s_err[128];
	char *rnd = NULL;
	const char *tmp_path = NULL;

	if (oidc_util_rand_str(r, &rnd, 12) == FALSE)
		return FALSE;
	tmp_path = apr_psprintf(r->pool, "%s.%s.tmp", path, rnd);

	/* try to open the metadata file for writing, creating it if it does not exist; some of
	 * these files hold secrets (e.g. a dynamically registered client_secret), so restrict
	 * the permissions to the owner only rather than falling back to the process umask */
	if ((rc = apr_file_open(&fd, tmp_path, (APR_FOPEN_WRITE | APR_FOPEN_CREATE | APR_FOPEN_EXCL),
				(APR_FPROT_UREAD | APR_FPROT_UWRITE), r->pool)) != APR_SUCCESS) {
		oidc_error(r, "file \"%s\" could not be opened for atomic update (%s)", tmp_path,
			   apr_strerror(rc, s_err, sizeof(s_err)));
		return FALSE;
	}

	/* lock the file and move the write pointer to the start of it */
	apr_file_lock(fd, APR_FLOCK_EXCLUSIVE);
	apr_off_t begin = 0;
	apr_file_seek(fd, APR_SET, &begin);

	/* calculate the length of the data, which is a string length */
	apr_size_t len = _oidc_strlen(data);

	/* (blocking) write the number of bytes in the buffer */
	rc = apr_file_write_full(fd, data, len, &bytes_written);

	/* check for a system error */
	if (rc != APR_SUCCESS) {
		oidc_error(r, "could not write to: \"%s\" (%s)", path, apr_strerror(rc, s_err, sizeof(s_err)));
		apr_file_unlock(fd);
		apr_file_close(fd);
		apr_file_remove(tmp_path, r->pool);
		return FALSE;
	}

	/* check that all bytes from the header were written */
	if (bytes_written != len) {
		oidc_error(r,
			   "could not write enough bytes to: \"%s\", bytes_written (%" APR_SIZE_T_FMT
			   ") != len (%" APR_SIZE_T_FMT ")",
			   path, bytes_written, len);
		apr_file_unlock(fd);
		apr_file_close(fd);
		apr_file_remove(tmp_path, r->pool);
		return FALSE;
	}

	/* unlock and close the written file */
	apr_file_unlock(fd);
	apr_file_close(fd);
	if ((rc = apr_file_rename(tmp_path, path, r->pool)) != APR_SUCCESS) {
		oidc_error(r, "file \"%s\" could not be atomically renamed to \"%s\" (%s)", tmp_path, path,
			   apr_strerror(rc, s_err, sizeof(s_err)));
		apr_file_remove(tmp_path, r->pool);
		return FALSE;
	}

	oidc_debug(r, "file \"%s\" written; number of bytes (%" APR_SIZE_T_FMT ")", path, len);

	return TRUE;
}
