path: root/src/main.zig

const std = @import("std");
const lmdb = @import("lmdb");

// db {{{

const Prng = struct {
    var prng: std.Random.DefaultPrng = std.Random.DefaultPrng.init(0);

    pub fn gen_id(dbi: anytype) Id {
        var id = Prng.prng.next();

        while (dbi.has(id)) {
            id = Prng.prng.next();
        }

        return id;
    }
};

// }}}

// http stuff {{{

pub fn redirect(req: *std.http.Server.Request, location: []const u8) !void {
    try req.respond("", .{ .status = .see_other, .extra_headers = &.{.{ .name = "Location", .value = location }} });
}

pub fn get_body(req: *std.http.Server.Request) []const u8 {
    return req.server.read_buffer[req.head_end .. req.head_end + (req.head.content_length orelse 0)];
}

pub fn get_value(req: *std.http.Server.Request, name: []const u8) ?[]const u8 {
    const body = get_body(req);
    if (std.mem.indexOf(u8, body, name)) |name_index| {
        if (std.mem.indexOfScalarPos(u8, body, name_index, '=')) |eql_index| {
            if (std.mem.indexOfScalarPos(u8, body, name_index, '&')) |amp_index| {
                return body[eql_index + 1 .. amp_index];
            }

            return body[eql_index + 1 .. body.len];
        }
    }
    return null;
}

pub fn get_cookie(req: *std.http.Server.Request, name: []const u8) ?CookieValue {
    var header_it = req.iterateHeaders();
    while (header_it.next()) |header| {
        if (std.mem.eql(u8, header.name, "Cookie")) {
            if (std.mem.indexOf(u8, header.value, name)) |name_index| {
                if (std.mem.indexOfScalarPos(u8, header.value, name_index, '=')) |eql_index| {
                    if (std.mem.indexOfPos(u8, header.value, name_index, "; ")) |semi_index| {
                        return CookieValue.fromSlice(header.value[eql_index + 1 .. semi_index]) catch null;
                    }

                    return CookieValue.fromSlice(header.value[eql_index + 1 .. header.value.len]) catch null;
                }
            }
        }
    }
    return null;
}

// }}}

// content {{{

const User = struct {
    // TODO: choose sizes
    username: Username,
    password_hash: PasswordHash,
};

const Id = u64;
const Username = std.BoundedArray(u8, 16);
const PasswordHash = std.BoundedArray(u8, 128);
const SessionToken = u64;
const CookieValue = std.BoundedArray(u8, 128);

pub fn hash_password(password: []const u8) !PasswordHash {
    var hash_buffer = try PasswordHash.init(128);

    // TODO: choose buffer size
    // TODO: dont allocate on stack, maybe zero memory?
    var buffer: [1024 * 10]u8 = undefined;
    var alloc = std.heap.FixedBufferAllocator.init(&buffer);

    // TODO: choose limits
    const result = try std.crypto.pwhash.argon2.strHash(password, .{
        .allocator = alloc.allocator(),
        .params = std.crypto.pwhash.argon2.Params.fromLimits(1000, 1024),
    }, hash_buffer.slice());

    try hash_buffer.resize(result.len);

    return hash_buffer;
}

pub fn verify_password(password: []const u8, hash: PasswordHash) bool {
    var buffer: [1024 * 10]u8 = undefined;
    var alloc = std.heap.FixedBufferAllocator.init(&buffer);

    if (std.crypto.pwhash.argon2.strVerify(hash.constSlice(), password, .{
        .allocator = alloc.allocator(),
    })) {
        return true;
    } else |err| {
        std.debug.print("verify error: {}\n", .{err});
        return false;
    }
}

pub fn register_user(env: *lmdb.Env, username: []const u8, password: []const u8) !void {
    const username_array = try Username.fromSlice(username);

    const txn = try env.txn();
    defer {
        txn.commit();
        env.sync();
    }

    const users = try txn.dbi("users", Id, User);
    const user_id = Prng.gen_id(users);
    users.put(user_id, User{
        .username = username_array,
        .password_hash = try hash_password(password),
    });

    const user_ids = try txn.dbi("user_ids", Username, Id);
    user_ids.put(username_array, user_id);
}

pub fn login_user(env: *lmdb.Env, username: []const u8, password: []const u8) !SessionToken {
    const username_array = try Username.fromSlice(username);

    const txn = try env.txn();
    defer {
        txn.commit();
        env.sync();
    }

    const user_ids = try txn.dbi("user_ids", Username, Id);
    const user_id = user_ids.get(username_array) orelse return error.UnknownUsername;
    std.debug.print("id: {}\n", .{user_id});

    const users = try txn.dbi("users", Id, User);
    if (users.get(user_id)) |user| {
        if (verify_password(password, user.password_hash)) {
            const sessions = try txn.dbi("sessions", Id, Id);
            const session_token = Prng.gen_id(sessions);
            sessions.put(session_token, user_id);
            return session_token;
        } else {
            return error.IncorrectPassword;
        }
    } else {
        return error.UserNotFound;
    }
}

fn logout_user(env: *lmdb.Env, session_token: SessionToken) !void {
    const txn = try env.txn();
    defer {
        txn.commit();
        env.sync();
    }

    const sessions = try txn.dbi("sessions", Id, Id);
    sessions.del(session_token);
}

fn get_session_user(env: *lmdb.Env, session_token: SessionToken) !User {
    const txn = try env.txn();
    defer txn.abort();

    const sessions = try txn.dbi("sessions", Id, Id);
    const users = try txn.dbi("users", Id, User);

    if (sessions.get(session_token)) |user_id| {
        return users.get(user_id) orelse error.UnknownUser;
    } else {
        return error.SessionNotFound;
    }
}

// }}}

fn list_users(env: *lmdb.Env) !void {
    const txn = try env.txn();
    defer txn.abort();

    const users = try txn.dbi("users", Id, User);
    var cursor = try users.cursor();

    var key: Id = undefined;
    var user_maybe = cursor.get(&key, .First);

    while (user_maybe) |user| {
        std.debug.print("[{}] {s}\n", .{ key, user.username.constSlice() });

        user_maybe = cursor.get(&key, .Next);
    }
}
fn list_user_ids(env: *lmdb.Env) !void {
    const txn = try env.txn();
    defer txn.abort();

    const user_ids = try txn.dbi("user_ids", Username, Id);
    var cursor = try user_ids.cursor();

    var key: Username = undefined;
    var user_id_maybe = cursor.get(&key, .First);

    while (user_id_maybe) |user_id| {
        std.debug.print("[{s}] {}\n", .{ key.constSlice(), user_id });

        user_id_maybe = cursor.get(&key, .Next);
    }
}

fn list_sessions(env: *lmdb.Env) !void {
    const txn = try env.txn();
    defer txn.abort();

    const sessions = try txn.dbi("sessions", SessionToken, Id);
    var cursor = try sessions.cursor();

    var key: SessionToken = undefined;
    var user_id_maybe = cursor.get(&key, .First);

    while (user_id_maybe) |user_id| {
        std.debug.print("[{}] {}\n", .{ key, user_id });

        user_id_maybe = cursor.get(&key, .Next);
    }
}

pub fn main() !void {
    // server
    const address = try std.net.Address.resolveIp("::", 8080);

    var server = try address.listen(.{
        .reuse_address = true,
    });
    defer server.deinit();

    // lmdb
    var env = lmdb.Env.open("db", 1024 * 100);
    defer env.close();

    std.debug.print("Users:\n", .{});
    try list_users(&env);
    std.debug.print("User IDs:\n", .{});
    try list_user_ids(&env);
    std.debug.print("Sessions:\n", .{});
    try list_sessions(&env);

    accept: while (true) {
        const conn = try server.accept();

        std.debug.print("new connection: {}\n", .{conn});

        var read_buffer: [1024]u8 = undefined;
        var http_server = std.http.Server.init(conn, &read_buffer);

        while (http_server.state == .ready) {
            var req = http_server.receiveHead() catch continue;

            std.debug.print("[{}]: {s}\n", .{ req.head.method, req.head.target });

            var logged_in: ?struct {
                user: User,
                session_token: SessionToken,
            } = null;

            if (get_cookie(&req, "session_token")) |session_token_str| {
                const session_token = try std.fmt.parseUnsigned(SessionToken, session_token_str.constSlice(), 10);
                if (get_session_user(&env, session_token)) |user| {
                    logged_in = .{
                        .user = user,
                        .session_token = session_token,
                    };
                } else |err| {
                    std.debug.print("get_session_user err: {}\n", .{err});
                }
                // TODO: delete session token
                // TODO: add changeable headers (set, delete cookies)
            }

            // html
            if (req.head.method == .GET) {
                if (std.mem.eql(u8, req.head.target, "/register")) {
                    try req.respond(
                        \\<form action="/register" method="post">
                        \\<input type="text" name="username" />
                        \\<input type="password" name="password" />
                        \\<input type="submit" value="Register" />
                        \\</form>
                    , .{});
                } else if (std.mem.eql(u8, req.head.target, "/login")) {
                    try req.respond(
                        \\<form action="/login" method="post">
                        \\<input type="text" name="username" />
                        \\<input type="password" name="password" />
                        \\<input type="submit" value="Login" />
                        \\</form>
                    , .{});
                } else {
                    if (logged_in) |login| {
                        var response_buffer = try std.BoundedArray(u8, 1024).init(0);
                        try std.fmt.format(response_buffer.writer(),
                            \\<a href="/user/{s}">Home</a>
                            \\<form action="/logout" method="post"><input type="submit" value="Logout" /></form>
                            \\<form action="/quit" method="post"><input type="submit" value="Quit" /></form>
                        , .{login.user.username.constSlice()});
                        try req.respond(response_buffer.constSlice(), .{});
                    } else {
                        try req.respond(
                            \\<a href="/register">Register</a>
                            \\<a href="/login">Login</a>
                            \\<form action="/quit" method="post"><input type="submit" value="Quit" /></form>
                        , .{});
                    }
                }
            }
            // api
            else {
                if (std.mem.eql(u8, req.head.target, "/register")) {
                    // TODO: handle args not supplied
                    const username = get_value(&req, "username").?;
                    const password = get_value(&req, "password").?;

                    std.debug.print("New user: {s} {s}\n", .{ username, password });
                    try register_user(&env, username, password);

                    try redirect(&req, "/login");
                } else if (std.mem.eql(u8, req.head.target, "/login")) {
                    // TODO: handle args not supplied
                    const username = get_value(&req, "username").?;
                    const password = get_value(&req, "password").?;

                    std.debug.print("New login: {s} {s}\n", .{ username, password });
                    if (login_user(&env, username, password)) |session_token| {
                        var redirect_buffer = try std.BoundedArray(u8, 128).init(0);
                        try std.fmt.format(redirect_buffer.writer(), "/user/{s}", .{username});

                        var cookie_buffer = try std.BoundedArray(u8, 128).init(0);
                        try std.fmt.format(cookie_buffer.writer(), "session_token={}; Secure; HttpOnly", .{session_token});

                        try req.respond("", .{
                            .status = .see_other,
                            .extra_headers = &.{
                                .{ .name = "Location", .value = redirect_buffer.constSlice() },
                                .{ .name = "Set-Cookie", .value = cookie_buffer.constSlice() },
                            },
                        });
                    } else |err| {
                        std.debug.print("login_user err: {}\n", .{err});
                        try redirect(&req, "/login");
                    }
                } else if (std.mem.eql(u8, req.head.target, "/logout")) {
                    if (logged_in) |login| {
                        try logout_user(&env, login.session_token);
                        try req.respond("", .{
                            .status = .see_other,
                            .extra_headers = &.{
                                .{ .name = "Location", .value = "/" },
                                .{ .name = "Set-Cookie", .value = "session_token=deleted; Expires=Thu, 01 Jan 1970 00:00:00 GMT" },
                            },
                        });
                    }
                } else if (std.mem.eql(u8, req.head.target, "/quit")) {
                    try redirect(&req, "/");
                    break :accept;
                } else {
                    try req.respond(
                        \\<p>POST</p>
                    , .{});
                }
            }
        }
    }
}