Widerhall/src/main/java/de/srsoftware/widerhall/web/Rest.java

package de.srsoftware.widerhall.web;

import de.srsoftware.widerhall.data.ListMember;
import de.srsoftware.widerhall.data.MailingList;
import de.srsoftware.widerhall.data.User;
import org.json.simple.JSONObject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.mail.MessagingException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.Serializable;
import java.io.UnsupportedEncodingException;
import java.sql.SQLException;
import java.util.List;
import java.util.Map;
import java.util.stream.Collectors;

import static de.srsoftware.widerhall.Constants.*;
import static de.srsoftware.widerhall.Util.t;

public class Rest extends HttpServlet {
    private static final Logger LOG = LoggerFactory.getLogger(Rest.class);
    private static final String LIST_DISABLE = "list/disable";
    private static final String LIST_EDITABLE = "list/editable";
    private static final String LIST_ENABLE = "list/enable";
    private static final String LIST_HIDE = "list/hide";
    private static final String LIST_MEMBERS = "list/members";
    private static final String LIST_SHOW = "list/show";
    private static final String LIST_TEST = "list/test";
    private static final String LIST_SUBSCRIBABLE = "list/subscribable";
    private static final String USER_ADD_PERMISSION = "user/addpermission";
    private static final String USER_DROP_PERMISSION = "user/droppermission";
    private static final String USER_LIST = "user/list";
    private static final String MEMBERS = "members";
    private static final String SUCCESS = "success";

    private Map addPermission(String userEmail, String permissions) {
        if (userEmail == null || userEmail.isBlank()) return Map.of(ERROR,"missing user email address!");
        try {
            int perm = Integer.parseInt(permissions);
            var user = User.loadAll(List.of(userEmail)).stream().findAny().orElse(null);
            if (user == null) return Map.of(ERROR,t("Laden des Nutzers für die Adresse {} fehlgeschlagen",userEmail));
            user.addPermission(perm);
        } catch (NumberFormatException nfe){
            return Map.of(ERROR,"Keine gültigen Berechtigungen übergeben!");
        } catch (SQLException e) {
            LOG.debug("Laden des Nutzers für die Adresse {} fehlgeschlagen",userEmail,e);
            return Map.of(ERROR,t("Laden des Nutzers für die Adresse {} fehlgeschlagen",userEmail));
        }
        return Map.of(SUCCESS,"Nutzer-Berechtigungen aktualisiert");
    }

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        String error = handleGet(req, resp);
        if (error != null) resp.sendError(400,error);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        String error = handlePost(req, resp);
        if (error != null) resp.sendError(400,error);
    }

    private Map dropPermission(String userEmail, String permissions) {
        if (userEmail == null || userEmail.isBlank()) return Map.of(ERROR,"Nutzer-Emailadresse fehlt!");
        try {
            int perm = Integer.parseInt(permissions);
            var user = User.loadAll(List.of(userEmail)).stream().findAny().orElse(null);
            if (user == null) return Map.of(ERROR,t("Laden des Nutzers für die Adresse {} fehlgeschlagen",userEmail));
            user.dropPermission(perm);
        } catch (NumberFormatException nfe){
            return Map.of(ERROR,"Keine gültigen Berechtigungen übergeben!");
        } catch (SQLException e) {
            LOG.debug("Laden des Nutzers für die Adresse {} fehlgeschlagen",userEmail,e);
            return Map.of(ERROR,t("Laden des Nutzers für die Adresse {} fehlgeschlagen",userEmail));
        }
        return Map.of(SUCCESS,"Nutzer-Berechtigungen aktualisiert");
    }

    public String handleGet(HttpServletRequest req, HttpServletResponse resp){
        Object o = req.getSession().getAttribute(USER);
        JSONObject json = new JSONObject();
        var path = req.getPathInfo();
        path = path == null ? INDEX : path.substring(1);
        if (o instanceof User user){
            json.put(USER,user.safeMap());
            switch (path) {
                case USER_LIST:
                    try {
                        json.put("users", (user.hashPermission(User.PERMISSION_ADMIN) ? User.loadAll() : List.of(user)).stream().map(User::safeMap).toList());
                    } catch (SQLException e) {
                        LOG.debug("Laden der Nutzerliste fehlgeschlagen:",e);
                        json.put(ERROR,"Laden der Nutzerliste fehlgeschlagen");
                    }
                    break;
                case LIST_EDITABLE:
                    json.put("lists", MailingList.editableBy(user).stream().map(MailingList::safeMap).toList());
                    break;
                case LIST_SUBSCRIBABLE:
                    json.put("lists", MailingList.subscribable(user).stream().map(MailingList::minimalMap).toList());
                default:
                    json.put(ERROR,t("Kein Handler für den Pfad '{}'!",path));
                    break;
            }
        } else {
            switch (path) {
                case LIST_SUBSCRIBABLE:
                    json.put("lists", MailingList.subscribable().stream().map(MailingList::minimalMap).toList());
                    break;
                default:
                    json.put(ERROR,"Nicht eingeloggt!");
            }
        }
        try {
            resp.setContentType("application/json");
            resp.getWriter().println(json.toJSONString());
            return null;
        } catch (IOException e) {
            return t("Konnte Anfrage nicht verarbeiten: {}",e.getMessage());
        }
    }

    public String handlePost(HttpServletRequest req, HttpServletResponse resp){
        Object o = req.getSession().getAttribute(USER);
        JSONObject json = new JSONObject();
        var path = req.getPathInfo();
        path = path == null ? INDEX : path.substring(1);

        if (o instanceof User user){
            json.put(USER,user.safeMap());

            var listEmail = req.getParameter(LIST);
            var userEmail = req.getParameter(EMAIL);
            var permissions = req.getParameter(PERMISSIONS);
            switch (path) {
                case LIST_DISABLE:
                    json.putAll(enableList(listEmail,user,false));
                    break;
                case LIST_ENABLE:
                    json.putAll(enableList(listEmail,user,true));
                    break;
                case LIST_HIDE:
                    json.putAll(hideList(listEmail,user,true));
                    break;
                case LIST_MEMBERS:
                    json.putAll(listMembers(listEmail,user));
                    break;
                case LIST_SHOW:
                    json.putAll(hideList(listEmail,user,false));
                    break;
                case LIST_TEST:
                    json.putAll(testList(listEmail,user));
                    break;
                case USER_ADD_PERMISSION:
                    if (user.hashPermission(User.PERMISSION_ADMIN)){
                        json.putAll(addPermission(userEmail,permissions));
                    } else json.put(ERROR,"Sie haben nicht die Berechtigung, um Berechtigungen zu ändern!");
                    break;
                case USER_DROP_PERMISSION:
                    if (user.hashPermission(User.PERMISSION_ADMIN)){
                        json.putAll(dropPermission(userEmail,permissions));
                    } else json.put(ERROR,"Sie haben nicht die Berechtigung, um Berechtigungen zu ändern!");
                    break;
                default:
                    json.put(ERROR,t("Kein Handler für den Pfad '{}'!",path));
                    break;
            }
        } else {
            json.put(ERROR,"Nicht eingeloggt!");
        }
        try {
            resp.setContentType("application/json");
            resp.getWriter().println(json.toJSONString());
            return null;
        } catch (IOException e) {
            return t("Konnte Anfrage nicht verarbeiten: {}",e.getMessage());
        }
    }

    private Map<String, Object> listMembers(String listEmail, User user) {
        if (listEmail == null || listEmail.isBlank()) return Map.of(ERROR,"no list email provided!");
        if (user.hashPermission(User.PERMISSION_ADMIN) || ListMember.listsOwnedBy(user).contains(listEmail)) {
            try {
                var members = ListMember.of(listEmail)
                        .entrySet()
                        .stream()
                        .map(entry -> Map.of(
                                EMAIL,entry.getKey().email(),
                                NAME,entry.getKey().name(),
                                STATE,ListMember.stateText(entry.getValue())
                                ))
                        .toList();
                return Map.of(MEMBERS,members);
            } catch (SQLException e) {
                LOG.error("Laden der Mitglieder-Liste fehlgeschlagen: ",e);
                return Map.of("error",t("Laden der Mitglieder-Liste von '{}' fehlgeschlagen",listEmail));
            }
        }
        return Map.of("error",t("Sie haben nicht die Berechtigng, um die Mitglieder von '{}' aufzulisten.",listEmail));
    }

    private Map enableList(String listEmail, User user, boolean enable) {
        if (listEmail == null || listEmail.isBlank()) return Map.of(ERROR,"no list email provided!");
        if (user.hashPermission(User.PERMISSION_ADMIN) || ListMember.listsOwnedBy(user).contains(listEmail)){
            try {
                MailingList.load(listEmail).enable(enable);
                return Map.of(SUCCESS,t("Mailing-List '{}' wurde {}!",listEmail,enable ? "aktiviert" : "inaktiviert"));
            } catch (SQLException e) {
                LOG.error("Aktivieren/Inaktivieren der Mailing-Liste fehlgeschlagen: ",e);
                return Map.of("error",t("Failed to update list '{}'",listEmail));
            }
        }
        return Map.of("error",t("You are not allowed to edit '{}'",listEmail));
    }

    private Map<String, String> hideList(String listEmail, User user, boolean hide) {
        if (listEmail == null || listEmail.isBlank()) return Map.of(ERROR,"no list email provided!");
        if (user.hashPermission(User.PERMISSION_ADMIN) || ListMember.listsOwnedBy(user).contains(listEmail)){
            try {
                MailingList.load(listEmail).hide(hide);
                return Map.of(SUCCESS,t("Mailing list '{}' was {}!",listEmail,hide ? "hidden" : "made public"));
            } catch (SQLException e) {
                LOG.error("Failed to (un)hide mailing list: ",e);
                return Map.of("error",t("Failed to update list '{}'",listEmail));
            }

        }
        return Map.of("error",t("You are not allowed to edit '{}'",listEmail));
    }

    private Map testList(String listEmail, User user) {
        if (listEmail == null || listEmail.isBlank()) return Map.of(ERROR,"no list email provided!");
        try {
            MailingList.load(listEmail).test(user);
            return Map.of(SUCCESS,t("Sent test email to {}",user.email()));
        } catch (Exception e) {
            LOG.warn("Failed to send test email",e);
            return Map.of(ERROR,t("Failed to send test email to {}",user.email()));
        }
    }
}