module http

import encoding.base64
import net
import net.urllib
import net.ssl
import net.socks

@[heap]
struct HttpProxy {
mut:
	scheme   string
	username string
	password string
	host     string
	hostname string
	port     int
	url      string
}

// dial_tcp_via_proxy connects to `host` through the proxy specified by `proxy_url`.
// `host` should be in `host:port` form.
pub fn dial_tcp_via_proxy(proxy_url string, host string) !&net.TcpConn {
	proxy := new_http_proxy(proxy_url)!
	return proxy.dial(host)!
}

// new_http_proxy creates a new HttpProxy instance, from the given http proxy url in `raw_url`
pub fn new_http_proxy(raw_url string) !&HttpProxy {
	mut url := urllib.parse(raw_url) or { return error('malformed proxy url') }
	scheme := url.scheme

	if scheme !in ['http', 'https', 'socks5'] {
		return error('invalid scheme')
	}

	url.path = ''
	url.raw_path = ''
	url.raw_query = ''
	url.fragment = ''
	mut username := ''
	mut password := ''

	str_url := url.str()

	mut host := url.host
	mut port := url.port().int()

	if port == 0 {
		if scheme == 'https' {
			port = 443
			host += ':' + port.str()
		} else if scheme == 'http' {
			port = 80
			host += ':' + port.str()
		}
	}
	if port == 0 {
		return error('Unknown port')
	}

	if u := url.user {
		username = u.username
		password = u.password
	}

	return &HttpProxy{
		scheme:   scheme
		username: username
		password: password
		host:     host
		hostname: url.hostname()
		port:     port
		url:      str_url
	}
}

// str returns the configured proxy URL for logging and debugging.
pub fn (pr &HttpProxy) str() string {
	if isnil(pr) {
		return 'nil'
	}
	return pr.url
}

// host format - ip:port
fn (pr &HttpProxy) build_proxy_headers(host string) string {
	mut uheaders := []string{}
	address := host.all_before_last(':')
	uheaders << 'Proxy-Connection: Keep-Alive\r\n'
	if pr.username != '' {
		mut authinfo := ''

		authinfo += pr.username
		if pr.password != '' {
			authinfo += ':${pr.password}'
		}

		encoded_authinfo := base64.encode(authinfo.bytes())

		uheaders << 'Proxy-Authorization: Basic ${encoded_authinfo}\r\n'
	}

	version := Version.v1_1

	return 'CONNECT ${host} ${version}\r\nHost: ${address}\r\n' + uheaders.join('') + '\r\n'
}

fn read_proxy_connect_response(mut tcp net.TcpConn) !string {
	mut total_bytes_read := 0
	mut msg := [4096]u8{}
	mut buffer := [1]u8{}
	for total_bytes_read < msg.len {
		bytes_read := tcp.read_ptr(&buffer[0], 1)!
		if bytes_read == 0 {
			return error('proxy closed the connection while establishing a tunnel')
		}
		msg[total_bytes_read] = buffer[0]
		total_bytes_read++
		if total_bytes_read > 3 && msg[total_bytes_read - 1] == `\n`
			&& msg[total_bytes_read - 2] == `\r` && msg[total_bytes_read - 3] == `\n`
			&& msg[total_bytes_read - 4] == `\r` {
			return msg[..total_bytes_read].bytestr()
		}
	}
	return error('proxy response headers exceeded 4096 bytes')
}

fn validate_proxy_connect_response(response string) ! {
	status_line := response.all_before('\r\n')
	if !status_line.starts_with('HTTP/1.1 200') && !status_line.starts_with('HTTP/1.0 200') {
		return error('proxy tunnel error: ${status_line}')
	}
}

fn (pr &HttpProxy) connect_tcp(host string) !&net.TcpConn {
	if pr.scheme in ['http', 'https'] {
		mut tcp := net.dial_tcp(pr.host)!
		tcp.write(pr.build_proxy_headers(host).bytes())!
		response := read_proxy_connect_response(mut tcp)!
		validate_proxy_connect_response(response)!
		return tcp
	} else if pr.scheme == 'socks5' {
		return socks.socks5_dial(pr.host, host, pr.username, pr.password)!
	} else {
		return error('http_proxy connect_tcp: invalid proxy scheme')
	}
}

fn (pr &HttpProxy) http_do(host urllib.URL, method Method, path string, req &Request, data string, header Header) !Response {
	host_name := host.hostname()
	mut port := host.port().int()
	if port == 0 {
		port = if host.scheme == 'https' { 443 } else { 80 }
	}
	port_part := if (host.scheme == 'http' && port == 80) || (host.scheme == 'https' && port == 443) {
		''
	} else {
		':${port}'
	}

	s := req.build_request_headers_with(method, host_name, port,
		'${host.scheme}://${host_name}${port_part}${path}', data, header)
	if host.scheme == 'https' {
		mut client := pr.ssl_dial('${host_name}:${port}')!

		$if windows {
			return error('Windows Not SUPPORTED') // TODO: windows ssl
			// response_text := req.do_request(req.build_request_headers(req.method, host_name,
			// 	path))!
			// client.shutdown()!
			// return response_text
		} $else {
			return req.do_request(req.build_request_headers_with(method, host_name, port, path,
				data, header), mut client)!
		}
	} else if host.scheme == 'http' {
		mut client := pr.dial('${host_name}:${port}')!
		client.set_read_timeout(req.read_timeout)
		client.set_write_timeout(req.write_timeout)
		client.write_string(s)!
		$if trace_http_request ? {
			eprintln('> ${s}')
		}
		response_data := req.read_all_from_client_connection(client)!
		client.close()!
		response_text := response_data.data.bytestr()
		$if trace_http_response ? {
			eprintln('< ${response_text}')
		}
		if req.on_finish != unsafe { nil } {
			req.on_finish(req, u64(response_text.len))!
		}
		return parse_received_response(response_text, response_data.info)
	}
	return error('Invalid Scheme')
}

fn (pr &HttpProxy) dial(host string) !&net.TcpConn {
	return pr.connect_tcp(host)!
}

fn (pr &HttpProxy) ssl_dial(host string) !&ssl.SSLConn {
	if pr.scheme in ['http', 'https'] {
		mut tcp := pr.connect_tcp(host)!
		mut ssl_conn := ssl.new_ssl_conn(
			verify:                 ''
			cert:                   ''
			cert_key:               ''
			validate:               false
			in_memory_verification: false
		)!
		ssl_conn.connect(mut tcp, host.all_before_last(':')) or {
			tcp.close() or {}
			return err
		}
		ssl_conn.owns_socket = true
		return ssl_conn
	} else if pr.scheme == 'socks5' {
		return socks.socks5_ssl_dial(pr.host, host, pr.username, pr.password)!
	} else {
		return error('http_proxy ssl_dial: invalid proxy scheme')
	}
}