#########################################################################
# This file is part of CoCalc: Copyright © 2020 Sagemath, Inc.
# License: AGPLv3 s.t. "Commons Clause" – see LICENSE.md for details
#########################################################################

###
User sign in

Throttling policy:  It basically like this, except we reset the counters
each minute and hour, so a crafty attacker could get twice as many tries by finding the
reset interval and hitting us right before and after.  This is an acceptable tradeoff
for making the data structure trivial.

  * POLICY 1: A given email address is allowed at most 3 failed login attempts per minute.
  * POLICY 2: A given email address is allowed at most 30 failed login attempts per hour.
  * POLICY 3: A given ip address is allowed at most 10 failed login attempts per minute.
  * POLICY 4: A given ip address is allowed at most 50 failed login attempts per hour.
###

async                = require('async')
message              = require('@cocalc/util/message')
misc                 = require('@cocalc/util/misc')
{required, defaults} = misc
auth                 = require('./auth')
{process_env_int}    = require("@cocalc/backend/misc")
throttle             = require("@cocalc/server/auth/throttle")
Bottleneck           = require("bottleneck")
apiKeyAction = require("@cocalc/server/api/manage").default;

# these parameters are per group and per hub!
bottleneck_opts      =
    minTime        : process_env_int('THROTTLE_SIGN_IN_MINTIME', 100)
    maxConcurrent  : process_env_int('THROTTLE_SIGN_IN_CONCURRENT', 10)
limit_group          = new Bottleneck.Group(bottleneck_opts)

record_sign_in_fail = (opts) ->
    {email, ip, logger} = defaults opts,
        email  : required
        ip     : required
        logger : undefined
    throttle.recordFail(email, ip)
    logger?("WARNING: record_sign_in_fail(#{email}, #{ip})")

sign_in_check = (opts) ->
    {email, ip, auth_token} = defaults opts,
        email : required
        ip    : required
        auth_token : undefined
    return throttle.signInCheck(email, ip, auth_token)

exports.sign_in = (opts) ->
    opts = defaults opts,
        client   : required
        mesg     : required
        logger   : undefined
        database : required
        host     : undefined
        port     : undefined
        cb       : undefined

    key = opts.client.ip_address

    done_cb = () ->
        opts.logger?.debug("sign_in(group='#{key}'): done")

    limit_group.key(key).submit(_sign_in, opts, done_cb)


_sign_in = (opts, done) ->
    {client, mesg} = opts
    if opts.logger?
        dbg = (m) ->
            opts.logger.debug("_sign_in(#{mesg.email_address}): #{m}")
        dbg()
    else
        dbg = ->
    tm = misc.walltime()

    sign_in_error = (error) ->
        dbg("sign_in_error -- #{error}")
        exports.record_sign_in
            database      : opts.database
            ip_address    : client.ip_address
            successful    : false
            email_address : mesg.email_address
            account_id    : account?.account_id
        client.push_to_client(message.sign_in_failed(id:mesg.id, email_address:mesg.email_address, reason:error))
        opts.cb?(error)

    if not mesg.email_address
        sign_in_error("Empty email address.")
        return

    if not mesg.password
        sign_in_error("Empty password.")
        return

    mesg.email_address = misc.lower_email_address(mesg.email_address)

    m = await sign_in_check
        email      : mesg.email_address
        ip         : client.ip_address
        auth_token : false
    if m
        sign_in_error("sign_in_check failure: #{m}")
        return

    signed_in_mesg = undefined
    account = undefined

    async.series([
        (cb) ->
            dbg("get account and check credentials")
            # NOTE: Despite people complaining, we do give away info about whether
            # the e-mail address is for a valid user or not.
            # There is no security in not doing this, since the same information
            # can be determined via the invite collaborators feature.
            opts.database.get_account
                email_address : mesg.email_address
                columns       : ['password_hash', 'account_id', 'passports', 'banned']
                cb            : (err, _account) ->
                    if err
                        cb(err)
                        return
                    account = _account
                    dbg("account = #{JSON.stringify(account)}")
                    if account.banned
                        dbg("banned account!")
                        cb("This account is BANNED.  Contact help@cocalc.com if you believe this is a mistake.")
                        return
                    cb()
        (cb) ->
            dbg("got account; now checking if password is correct...")
            auth.is_password_correct
                database      : opts.database
                account_id    : account.account_id
                password      : mesg.password
                password_hash : account.password_hash
                cb            : (err, is_correct) ->
                    if err
                        cb("Error checking correctness of password -- #{err}")
                        return
                    if not is_correct
                        if not account.password_hash
                            cb("The account #{mesg.email_address} exists but doesn't have a password. Either set your password by clicking 'Forgot Password?' or log in using #{misc.keys(account.passports).join(', ')}.  If that doesn't work, email help@cocalc.com and we will sort this out.")
                        else
                            cb("Incorrect password for #{mesg.email_address}.  You can reset your password by clicking the 'Forgot Password?' link.   If that doesn't work, email help@cocalc.com and we will sort this out.")
                    else
                        cb()
        # remember me
        (cb) ->
            if not mesg.remember_me
                # do not set cookie if already set (and message known)
                cb(); return
            dbg("remember_me -- setting the remember_me cookie")
            signed_in_mesg = message.signed_in
                id                : mesg.id
                account_id        : account.account_id
                email_address     : mesg.email_address
                remember_me       : false
                hub               : opts.host + ':' + opts.port
            client.remember_me
                account_id    : signed_in_mesg.account_id
                cb            : cb
        (cb) ->
            if not mesg.get_api_key
                cb(); return
            dbg("get_api_key -- also get_api_key")
            try
                signed_in_mesg.api_key = await apiKeyAction({account_id:account.account_id, password:mesg.password, action:'get'})
                cb()
            catch err
                cb(err)
        (cb) ->
            if not mesg.get_api_key or signed_in_mesg.api_key
                cb(); return
            dbg("get_api_key -- must generate key since don't already have it")
            try
                signed_in_mesg.api_key = await apiKeyAction({account_id:account.account_id, password:mesg.password, action:'regenerate'})
                cb()
            catch err
                cb(err)
    ], (err) ->
        if err
            dbg("send error to user (in #{misc.walltime(tm)}seconds) -- #{err}")
            sign_in_error(err)
            opts.cb?(err)
        else
            dbg("user got signed in fine (in #{misc.walltime(tm)}seconds) -- sending them a message")
            client.signed_in(signed_in_mesg)
            client.push_to_client(signed_in_mesg)
            opts.cb?()

        # final callback for bottleneck group
        done()
    )

exports.sign_in_using_auth_token = (opts) ->
    opts = defaults opts,
        client   : required
        mesg     : required
        logger   : undefined
        database : required
        host     : undefined
        port     : undefined
        cb       : undefined

    key = opts.client.ip_address

    done_cb = () ->
        opts.logger?.debug("sign_in_using_auth_token(group='#{key}'): done")

    limit_group.key(key).submit(_sign_in_using_auth_token, opts, done_cb)

_sign_in_using_auth_token = (opts, done) ->
    {client, mesg} = opts
    if opts.logger?
        dbg = (m) ->
            opts.logger.debug("_sign_in_using_auth_token(#{mesg.email_address}): #{m}")
        dbg()
    else
        dbg = ->
    tm = misc.walltime()

    sign_in_error = (error) ->
        dbg("sign_in_using_auth_token_error -- #{error}")
        exports.record_sign_in
            database      : opts.database
            ip_address    : client.ip_address
            successful    : false
            email_address : mesg.auth_token  # yes, we abuse the email_address field
            account_id    : account?.account_id
        client.push_to_client(message.error(id:mesg.id, error:error))
        opts.cb?(error)

    if not mesg.auth_token
        sign_in_error("missing auth_token.")
        return

    if mesg.auth_token?.length != 24
        sign_in_error("auth_token must be exactly 24 characters long")
        return

    m = await sign_in_check
        email      : mesg.auth_token
        ip         : client.ip_address
        auth_token : true
    if m
        sign_in_error("sign_in_check fail(ip=#{client.ip_address}): #{m}")
        return

    signed_in_mesg = undefined
    account = account_id = undefined
    async.series([
        (cb) ->
            dbg("get account and check credentials")
            opts.database.get_auth_token_account_id
                auth_token : mesg.auth_token
                cb         : (err, _account_id) ->
                    if not err and not _account_id
                        err = 'auth_token is not valid'
                    account_id = _account_id; cb(err)
        (cb) ->
            dbg("successly got account_id; now getting more information about the account")
            opts.database.get_account
                account_id : account_id
                columns    : ['email_address', 'lti_id']
                cb         : (err, _account) ->
                    # for LTI accounts, we set the email address at least to an empty string
                    if !!_account.lti_id
                        _account.email_address ?= ''
                    account = _account; cb(err)
        # remember me
        (cb) ->
            dbg("remember_me -- setting the remember_me cookie")
            signed_in_mesg = message.signed_in
                id            : mesg.id
                account_id    : account_id
                email_address : account.email_address
                lti_id        : account.lti_id
                remember_me   : false
                hub           : opts.host + ':' + opts.port
            client.remember_me
                account_id    : signed_in_mesg.account_id
                lti_id        : signed_in_mesg.lti_id
                ttl           : 12*3600
                cb            : cb
    ], (err) ->
        if err
            dbg("send error to user (in #{misc.walltime(tm)}seconds) -- #{err}")
            sign_in_error(err)
            opts.cb?(err)
        else
            dbg("user got signed in fine (in #{misc.walltime(tm)}seconds) -- sending them a message")
            client.signed_in(signed_in_mesg)
            client.push_to_client(signed_in_mesg)
            opts.cb?()

        # final callback for bottleneck group
        done()
    )


# Record to the database a failed and/or successful login attempt.
exports.record_sign_in = (opts) ->
    opts = defaults opts,
        ip_address       : required
        successful       : required
        database         : required
        email_address    : undefined
        account_id       : undefined
        remember_me      : false

    if not opts.successful
        record_sign_in_fail
            email : opts.email_address
            ip    : opts.ip_address
    else
        data =
            ip_address    : opts.ip_address
            email_address : opts.email_address ? null
            remember_me   : opts.remember_me
            account_id    : opts.account_id

        opts.database.log
            event : 'successful_sign_in'
            value : data