###RUN_PERL: #!/usr/bin/perl

# /bsta/w
# opomba is generated from opomba.1.pl.
#
# The comment posting interface
#
# Copyright (C) 2024  Balthasar Szczepański
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

use strict;
use utf8;
# use Encode::Locale ('decode_argv');
use Encode ('encode', 'decode');

###PERL_LIB: use lib /botm/lib/bsta
use botm_common (
	'HTTP_STATUS',
	'fail_method', 'fail_content_type',
	'redirect',
	'read_header_env', 'url_query_decode',
	'write_data_file',
	'html_entity_encode_dec',
	'open_encoded',
	'join_path',
	'merge_url',
	'make_id',
	'http_header_status'
);
use bsta_lib (
	'TEXT_MODE', 'STATE',
	'get_password',
	'print_html_start', 'print_html_end',
	'print_html_head_start', 'print_html_head_end',
	'print_html_body_start', 'print_html_body_end',
	'bb_to_html', 'eval_bb',
	'merge_settings',
	'write_index', 'write_static_viewer_page',
	'read_settings', 'read_state',
	'read_words', 'write_words',
	'read_words_list', 'write_words_list'
);

###PERL_PATH_SEPARATOR:     PATH_SEPARATOR     = /

###PERL_CGI_VIEWER_PATH:    CGI_VIEWER_PATH    = /bsta/v
###PERL_CGI_WORDS_PATH:     CGI_WORDS_PATH     = /bsta/w

###PERL_DATA_WORDS_PATH:    DATA_WORDS_PATH    = /botm/data/bsta/words/

###PERL_LOG_SPAM_PATH:      LOG_SPAM_PATH      = /botm/log/bsta/words_spam.log
###PERL_LOG_WORDS_PATH:     LOG_WORDS_PATH     = /botm/log/bsta/words.log

###PERL_WEBSITE_NAME:       WEBSITE_NAME       = Bicycles on the Moon

###PERL_COMMENT_PAGE_LENGTH:COMMENT_PAGE_LENGTH= 16

binmode STDIN,  ':encoding(UTF-8)';
binmode STDOUT, ':encoding(UTF-8)';
binmode STDERR, ':encoding(UTF-8)';
# decode_argv();

my $time = time();
srand ($time-$$);

my %http;
my %cgi;
my %state;
my %settings;
my %words_data;
my %post_data;
my %last_post_data;

my @post_list;

my $method;
my $frame;
my $ID;
my $last_ID;
my $password;
my $password_ok;
my $access;
my $edit = 0;
my $remove = 0;
my $post = 0;
my $quote;
my $words_data_path;
my $index;
my $page;
my $ong_state;
my $last_frame;
my $fh;
my $r;


delete @ENV{qw(IFS CDPATH ENV BASH_ENV)};
###PERL_SET_PATH: $ENV{'PATH'} = /usr/local/bin:/usr/bin:/bin;

if ($ENV{'REQUEST_METHOD'} =~ /^(HEAD|GET|POST)$/) {
	$method = $1;
}
else {
	exit fail_method($ENV{'REQUEST_METHOD'}, ['GET', 'POST', 'HEAD']);
}

%http = read_header_env(\%ENV);
%cgi = url_query_decode($ENV{'QUERY_STRING'});

if ($method eq 'POST') {
	if ($http{'content-type'} eq 'application/x-www-form-urlencoded') {
		my %cgi_post = url_query_decode( <STDIN> );
		%cgi = merge_settings(\%cgi, \%cgi_post);
	}
	# multipart not supported
	else {
		exit fail_content_type($method, $http{'content-type'});
	}
}

if ($ENV{'PATH_INFO'} =~ /^\/([0-9]+)$/) {
	$frame = int($1);
}
elsif ($ENV{'PATH_INFO'} =~ /^\/(.+)$/) {
	$ID = $1;
}
if ($cgi{'f'} =~ /^.+$/) {
	$frame = int($&);
}
if ($cgi{'i'} =~ /^.+$/) {
	$ID = $&;
}
$password = get_password(\%cgi);

%settings = read_settings();
%state    = read_state();
$ong_state = int($state{'state'});
$last_frame = int($state{'last'});

$password_ok = ($password eq $settings{'password'});

if ($cgi{'post'} ne '') {
	$post = 1;
}
elsif ($cgi{'edit'} ne '') {
	$edit = 1;
	if ($ID eq '') {
		$ID = $cgi{'edit'};
	}
}
elsif ($cgi{'remove'} ne '') {
	$remove = 1;
	if ($ID eq '') {
		$ID = $cgi{'remove'};
	}
}
else {
	$edit = 1;
	if ($cgi{'quote'} ne '') {
		$quote = $cgi{'quote'};
	}
}

if ($ID ne '') {
	%post_data = read_words($ID);
	if ($post_data{'frame'} ne '') {
		$frame = int($post_data{'frame'});
	}
}

unless ($frame ne '') {
	exit output(0, HTTP_STATUS->{'bad_request'}, 'Frame ID not specified.');
}
$access = (
	$password_ok || (
		($ong_state >= STATE->{'waiting'}) &&
		($frame <= $last_frame)
	)
);
unless ($access) {
	exit output(0, HTTP_STATUS->{'forbidden'}, 'Not allowed to post this here now');
}

$words_data_path = join_path(PATH_SEPARATOR(), DATA_WORDS_PATH(), $frame);

unless (open_encoded($fh, "+<:encoding(UTF-8)", $words_data_path)) {
	unless (open_encoded($fh, "+>:encoding(UTF-8)", $words_data_path)) {
		exit output(0, '500 Internal Server Error', 'Failed opening data file.', 1);
	}
}
unless (flock($fh, 2)) {
	exit output(0, HTTP_STATUS->{'internal_server_error'}, 'Failed locking data file.', 1);
}

%words_data = read_words_list(
	$fh, # file
	0,   # header only
);

@post_list = @{$words_data{'content'}};

for (my $i=0; $i< scalar(@post_list); $i +=1) {
	if ($post_list[$i] eq $ID) {
		$index = $i;
		$page = int($index / COMMENT_PAGE_LENGTH());
		last;
	}
}

if ($remove || ($ID ne '')) {
	unless ($index ne '') {
		close($fh);
		exit output(0, HTTP_STATUS->{'not_found'}, $remove ? 'Nothing to remove.' : 'No such message.');
	}
	unless ($cgi{'key'} eq $post_data{'key'}) {
		close($fh);
		exit output(0, HTTP_STATUS->{'bad_request'}, 'Invalid request.');
	}
}
if ($remove) {
	unless (($method eq 'POST') && ($cgi{'i'} ne '')) { # followed a link, not confirmed yet
		close($fh);
		exit output(0, '', '', 1);
	}
}
else {
	unless (($method eq 'POST') && $post) { # followed a link, not confirmed yet
		close($fh);
		exit output(0, '', '', 1);
	}
}
if (!$remove) {
	unless ($cgi{'words'} ne '') {
		exit output(0, HTTP_STATUS->{'bad_request'}, 'Where are your words?', 1);
	}
}
unless ($cgi{'username'} ne '') {
	close($fh);
	exit output(0, HTTP_STATUS->{'bad_request'}, 'Missing user name.', 1);
}
if ($remove || ($ID ne '')) {
	unless ($cgi{'username'} eq $post_data{'name'}) {
		close($fh);
		exit output(0, HTTP_STATUS->{'forbidden'}, 'Wrong user name.', 1);
	}
}
if ($remove || ($ID ne '')) {
		unless ($cgi{'password'} ne '') {
		close($fh);
		exit output(0, HTTP_STATUS->{'bad_request'}, 'Missing password.', 1);
	}
	unless (
		($cgi{'password'} eq $post_data{'password'}) || (
			($cgi{'password'} eq $settings{'password'}) &&
			$password_ok
		)
	) {
		close($fh);
		exit output(0, HTTP_STATUS->{'forbidden'}, 'Wrong password.', 1);
	}
	if ($password_ok) {
		$cgi{'password'} = $post_data{'password'};
	}
}
unless ($cgi{'password2'} eq '') {
	close($fh);
	# no error code to confuse spambot :)
	output(0, '', 'Please don\'t write anything in the place which should remain empty.', 1);
	if (open_encoded($fh, ">>:encoding(UTF-8)", LOG_SPAM_PATH())) {
		$cgi{'content'} = $cgi{'words'};
		$cgi{'empty'} = $cgi{'password2'};
		delete($cgi{'words'});
		delete ($cgi{'password'});
		delete ($cgi{'password2'});
		print $fh "$time SPAM $ID\n";
		write_data_file(
			$fh, \%cgi, '',
			0, 0, 0,
			'>>', 1
		);
		print $fh "\n\n";
		close ($fh);
	}
	exit;
}

# all conditions fulfilled

if ($remove) {
	splice @post_list, $index, 1;
	$words_data{'posts'} = scalar(@post_list);
	$words_data{'content'} = \@post_list;
	
	$r = write_words_list($fh, \%words_data);
	unless ($r) {
		close($fh);
		exit output(0, HTTP_STATUS->{'internal_server_error'}, 'Failed writing data file.');
	}
	
	close ($fh);
	
	if (open_encoded($fh, ">>:encoding(UTF-8)", LOG_WORDS_PATH())) {
		delete ($post_data{'password'});
		print $fh "$time REMOVE $ID\n";
		write_data_file(
			$fh, \%post_data, '',
			0, 0, 0,
			'>>', 1
		);
		print $fh "\n\n";
		close ($fh);
	}
	
	$ID = 'insw';
	exit output(1);
}

if ($ID eq '') {
	$ID = make_id($frame, 1);
}
if ($index eq '') {
	$index = scalar(@post_list);
	$page = int($index / COMMENT_PAGE_LENGTH());
	if ($index > 0) {
		$last_ID = $post_list[-1];
		%last_post_data = read_words($last_ID);
		if (
			($cgi{'username'} eq $last_post_data{'name'   }) &&
			($cgi{'words'   } eq $last_post_data{'content'})
		) { # duplicate post
			$index -= 1;
			$page = int($index / COMMENT_PAGE_LENGTH());
			$ID = $last_ID;
			close ($fh);
			exit output(1);
		}
	}
	push @post_list, $ID;
}
$words_data{'posts'} = scalar(@post_list);
$words_data{'content'} = \@post_list;

$post_data{'frame'} = $frame;
$post_data{'name'} = $cgi{'username'};
$post_data{'password'} = $cgi{'password'};
if ($post_data{'posttime'} eq '') {
	$post_data{'posttime'} = $time;
}
else {
	$post_data{'edittime'} = $time;
}
if ($post_data{'key'} eq '') {
	my $new_key = '';
	for (my $i=1; $i<16; $i+=1) {
		$new_key .= sprintf('%02X', int(rand(0x100)));
	}
	$post_data{'key'} = $new_key;
}
$post_data{'content'} = $cgi{'words'};

$r = write_words($ID, \%post_data);
unless ($r) {
	close($fh);
	exit output(0, HTTP_STATUS->{'internal_server_error'}, 'Failed writing post file.', 1, 0);
}

$r = write_words_list($fh, \%words_data);
unless ($r) {
	close($fh);
	exit output(0, HTTP_STATUS->{'internal_server_error'}, 'Failed writing data file.', 1, 0);
}

close($fh);

if (($frame == 0) && ($ong_state > STATE->{'inactive'})) {
	write_index(\%state, \%settings);
}
elsif ($frame >= 1) {
	write_static_viewer_page(
		$frame,
		\%state,
		\%settings,
		'', # default
		'', # frame data
		'', # prev frame data
		'', # next frame data
		\%words_data
	);
}

if (open_encoded($fh, ">>:encoding(UTF-8)", LOG_WORDS_PATH())) {
	delete ($post_data{'password'});
	print $fh "$time POST $ID\n";
	write_data_file(
		$fh, \%post_data, '',
		0, 0, 0,
		'>>', 1
	);
	print $fh "\n\n";
	close ($fh);
}

exit output(1);


sub output {
	(my $done, my $status, my $message, my $show_content) = @_;
	
	my $return_url = merge_url(
		{'path' => CGI_VIEWER_PATH()},
		{
			'path' => $frame,
			'query' => {
				'b' => TEXT_MODE->{'words'},
				'i' => $page,
				'p' => ($password_ok ? $settings{'password'} : '')
			},
			'fragment' => $ID
		}
	);
	if ($done) {
		return redirect($method, $return_url, HTTP_STATUS->{'see_other'});
	}
	
	if ($status ne '') {
		print http_header_status($status);
	}
	print "Content-type: text/html; charset=UTF-8\n\n";
	if ($method eq 'HEAD') {
		return;
	}
	
	my $title;
	my $name;
	my $content;
	
	if ($remove) {
		$title = 'Remove message "'.$ID.'"';
	}
	elsif ($ID ne '') {
		$title = 'Edit message "'.$ID.'"';
	}
	else {
		$title = 'Words';
	}
	if ($frame ne '') {
		$title = $frame.'. '.$title;
	}
	
	if ($cgi{'username'} ne '') {
		$name = $cgi{'username'}
	}
	elsif ($post_data{'name'} ne '') {
		$name = $post_data{'name'}
	}
	else {
		$name = '';
	}
	
	if ($cgi{'words'} ne '') {
		$content = $cgi{'words'};
	}
	elsif ($quote ne '') {
		my %quote_data = read_words($quote);
		$content = '[quote="'.$quote_data{'name'}.'"]'.$quote_data{'content'}.'[/quote]';
	}
	elsif (($cgi{'edit'} ne '') || $remove) {
		$content = $post_data{'content'};
	}
	else {
		$content = '';
	}
	
	my $_password = $password_ok ? html_entity_encode_dec($settings{'password'}, 1) : '';
	my $_key = html_entity_encode_dec($post_data{'key'}, 1);
	my $_ID = html_entity_encode_dec($ID, 1);
	my $_title = html_entity_encode_dec($title, 1);
	my $_message = html_entity_encode_dec($message, 1);
	my $_story = html_entity_encode_dec($settings{'story'}, 1);
	my $_name = html_entity_encode_dec($name, 1);
	my $_content = html_entity_encode_dec($content, 1);
	my $_empty = html_entity_encode_dec($cgi{'password2'}, 1);
	my $_website_name = html_entity_encode_dec(WEBSITE_NAME(), 1);
	my $_post_url = html_entity_encode_dec(CGI_WORDS_PATH(), 1);
	my $_return_url = html_entity_encode_dec($return_url, 1);
		
	print_html_start(\*STDOUT);
	print_html_head_start(\*STDOUT);
	
	print '  <title>'.$_title.' &bull; '.$_story.' &bull; '.$_website_name.'</title>';
	
	print_html_head_end(\*STDOUT);
	print_html_body_start(\*STDOUT);
	
	print '   <div id="inst" class="ins">'."\n";
	
	print '    <div id="title">'."\n";
	print '     <h1 id="titletext">'.$_title.'</h1>'."\n";
	print '    </div>'."\n";
	
	print '   </div>'."\n";
	
	if ($message ne '') {
		print '   <div id="insb" class="ins">'."\n";
		
		print '    <div id="command">'."\n";
		print '     <span class="br">'.$_message.'</span>'."\n";
		print '    </div>'."\n";
		
		print '   </div>'."\n";
	}
	
	print '   <div id="insw" class="ins">'."\n";
	
	if ($show_content) {
		print '    <div class="undertext" id="words">'."\n";
		print '     <form method="post" action="'.$_post_url.'">'."\n";
		unless ($remove) {
			print '      <b>Your words:</b>'."\n";
			print '      <textarea class="inta" name="words" rows="4">'.$_content.'</textarea>'."\n";
		}
		print '      <table cellpadding="0" cellspacing="0" border="0"><tr>'."\n";
		print '       <td><b>Your name: </b></td>'."\n";
		print '       <td><input class="intx" type="text" name="username" value="'.$_name.'"></td>'."\n";
		print '       <td></td>'."\n";
		print '      </tr><tr>'."\n";
		print '       <td><b>'.(($ID ne '') ? 'Password' : 'Optional password').': </b></td>'."\n";
		print '       <td><input class="intx" type="password" name="password" value=""></td>'."\n";
		print '       <td>'.(($ID ne '') ? '' : '(if you want to edit later)').'</td>'."\n";
		print '      </tr><tr>'."\n";
		print '       <td><b>Leave this empty: </b></td>'."\n";
		print '       <td><input class="intx" type="text" name="password2" value="'.$_empty.'"></td>'."\n";
		if ($remove) {
			print '       <td><input class="inbt" type="submit" name="remove" value="Remove"></td>'."\n";
		}
		else {
			print '       <td>'."\n";
			print '        <input class="inbt" type="submit" name="post" value="'.(($ID ne '') ? 'Update' : 'Send').'">'."\n";
			print '        <input class="inbt" type="submit" name="preview" value="Preview">'."\n";
			print '       </td>'."\n";
		}
		print '      </tr></table>'."\n";
		print '      <input type="hidden" name="f" value="'.$frame.'">'."\n";
		if ($ID ne '') {
			print '      <input type="hidden" name="i" value="'.$_ID.'">'."\n";
		}
		print '      <input type="hidden" name="key" value="'.$_key.'">'."\n";
		if ($password_ok) {
			print '      <input type="hidden" name="p" value="'.$_password.'">'."\n";
		}
		print '     </form>'."\n";
		if ($content ne ''){
			print '     <br>'."\n";
			print '     <div id="preview"class="opomba">'."\n";
			print '      <div class="opomba_info">'."\n";
			print '       Preview:'."\n";
			print '      </div>'."\n";
			print '      <div class="opomba_text">'."\n";
		  print bb_to_html(
				eval_bb(
					$content,
					0,
					$password_ok ? $settings{'password'} : ''
				)
			)."\n";
			print '      </div>'."\n";
			print '     </div>'."\n";
		}
		print '    </div>'."\n";
	}
	print '    <div id="underlinks">'."\n";
	print '     <a href="'.$_return_url.'">Return</a>'."\n";
	print '    </div>'."\n";
	
	print '   </div>'."\n";
	
	print_html_body_end(\*STDOUT, $ong_state == STATE->{'inactive'});
	print_html_end(\*STDOUT);
}
