package httprc

import (
	"regexp"
	"sync"
)

// Whitelist is an interface that allows you to determine if a given URL is allowed
// or not. Implementations of this interface can be used to restrict the URLs that
// the client can access.
//
// By default all URLs are allowed, but this may not be ideal in production environments
// for security reasons.
//
// This exists because you might use this module to store resources provided by
// user of your application, in which case you cannot necessarily trust that the
// URLs are safe.
//
// You will HAVE to provide some sort of whitelist.
type Whitelist interface {
	IsAllowed(string) bool
}

// WhitelistFunc is a function type that implements the Whitelist interface.
type WhitelistFunc func(string) bool

func (f WhitelistFunc) IsAllowed(u string) bool { return f(u) }

// BlockAllWhitelist is a Whitelist implementation that blocks all URLs.
type BlockAllWhitelist struct{}

// NewBlockAllWhitelist creates a new BlockAllWhitelist instance. It is safe to
// use the zero value of this type; this constructor is provided for consistency.
func NewBlockAllWhitelist() BlockAllWhitelist { return BlockAllWhitelist{} }

func (BlockAllWhitelist) IsAllowed(_ string) bool { return false }

// InsecureWhitelist is a Whitelist implementation that allows all URLs. Be careful
// when using this in your production code: make sure you do not blindly register
// URLs from untrusted sources.
type InsecureWhitelist struct{}

// NewInsecureWhitelist creates a new InsecureWhitelist instance. It is safe to
// use the zero value of this type; this constructor is provided for consistency.
func NewInsecureWhitelist() InsecureWhitelist { return InsecureWhitelist{} }

func (InsecureWhitelist) IsAllowed(_ string) bool { return true }

// RegexpWhitelist is a jwk.Whitelist object comprised of a list of *regexp.Regexp
// objects. All entries in the list are tried until one matches. If none of the
// *regexp.Regexp objects match, then the URL is deemed unallowed.
//
// Matching is performed using (*regexp.Regexp).MatchString, which succeeds when
// the pattern matches ANY substring of the URL — it is NOT anchored automatically.
// This has important security implications: a pattern like `http://example.com`
// will match URLs you almost certainly did not intend to allow, such as
// `http://example.com.attacker.com/` (the host is actually attacker.com) or
// `http://attacker.com/?u=http://example.com` (the pattern appears in the query).
//
// To restrict to a specific origin, anchor the pattern at the start with `^`,
// escape the dots in the host (`.` is the "any character" metacharacter in a
// regular expression), and terminate the host with a `/` so that it cannot be
// extended into a subdomain:
//
//	// GOOD: only matches the example.com origin and its paths
//	regexp.MustCompile(`^https://example\.com/`)
//
//	// BAD: also matches example.com.attacker.com, attacker.com/?x=http://example.com, httpsX//exampleYcom, ...
//	regexp.MustCompile(`http://example.com`)
//
// Note that requiring a trailing `/` means the bare origin URL `https://example.com`
// (no path) will not match; register an additional pattern such as
// `^https://example\.com$` if you need to allow it. Likewise, account for an
// optional port (e.g. `^https://example\.com(:\d+)?/`) if your URLs may include one.
type RegexpWhitelist struct {
	mu       sync.RWMutex
	patterns []*regexp.Regexp
}

// NewRegexpWhitelist creates a new RegexpWhitelist instance. It is safe to use the
// zero value of this type; this constructor is provided for consistency.
func NewRegexpWhitelist() *RegexpWhitelist {
	return &RegexpWhitelist{}
}

// Add adds a new regular expression to the list of expressions to match against.
func (w *RegexpWhitelist) Add(pat *regexp.Regexp) *RegexpWhitelist {
	w.mu.Lock()
	defer w.mu.Unlock()
	w.patterns = append(w.patterns, pat)
	return w
}

// IsAllowed returns true if any of the patterns in the whitelist
// returns true.
func (w *RegexpWhitelist) IsAllowed(u string) bool {
	w.mu.RLock()
	patterns := w.patterns
	w.mu.RUnlock()
	for _, pat := range patterns {
		if pat.MatchString(u) {
			return true
		}
	}
	return false
}

// MapWhitelist is a jwk.Whitelist object comprised of a map of strings.
// If the URL exists in the map, then the URL is allowed to be fetched.
type MapWhitelist interface {
	Whitelist
	Add(string) MapWhitelist
}

type mapWhitelist struct {
	mu    sync.RWMutex
	store map[string]struct{}
}

func NewMapWhitelist() MapWhitelist {
	return &mapWhitelist{store: make(map[string]struct{})}
}

func (w *mapWhitelist) Add(pat string) MapWhitelist {
	w.mu.Lock()
	defer w.mu.Unlock()
	w.store[pat] = struct{}{}
	return w
}

func (w *mapWhitelist) IsAllowed(u string) bool {
	w.mu.RLock()
	_, b := w.store[u]
	w.mu.RUnlock()
	return b
}