# Base class for drivers that run in the browser.
#
# Inheriting from this class makes a driver use HTML5 localStorage to preserve
# OAuth tokens across page reloads.
class Dropbox.Drivers.BrowserBase
  # Sets up the OAuth driver.
  #
  # Subclasses should pass the options object they receive to the superclass
  # constructor.
  #
  # @param {?Object} options the advanced settings below
  # @option options {Boolean} useQuery if true, the page will receive OAuth
  #   data as query parameters; by default, the page receives OAuth data in
  #   the fragment part of the URL (the string following the #,
  #   available as document.location.hash), to avoid confusing the server
  #   generating the page
  # @option options {Boolean} rememberUser if true, the user's OAuth tokens are
  #   saved in localStorage; if you use this, you MUST provide a UI item that
  #   calls signOut() on Dropbox.Client, to let the user "log out" of the
  #   application
  # @option options {String} scope embedded in the localStorage key that holds
  #   the authentication data; useful for having multiple OAuth tokens in a
  #   single application
  constructor: (options) ->
    @rememberUser = options?.rememberUser or false
    @useQuery = options?.useQuery or false
    @scope = options?.scope or 'default'
    @storageKey = null

    @dbTokenRe = new RegExp "(#|\\?|&)dboauth_token=([^&#]+)(&|#|$)"
    @rejectedRe = new RegExp "(#|\\?|&)not_approved=true(&|#|$)"
    @tokenRe = new RegExp "(#|\\?|&)oauth_token=([^&#]+)(&|#|$)"

  # The magic happens here.
  onAuthStateChange: (client, callback) ->
    @setStorageKey client

    switch client.authState
      when DropboxClient.RESET
        @loadCredentials (credentials) =>
          return callback() unless credentials

          if credentials.authState  # Incomplete authentication.
            client.setCredentials credentials
            return callback()

          # There is an old access token. Only use it if the app supports
          # logout.
          unless @rememberUser
            return @forgetCredentials(callback)

          # Verify that the old access token still works.
          client.setCredentials credentials
          client.getUserInfo (error) =>
            if error
              client.reset()
              @forgetCredentials callback
            else
              callback()
      when DropboxClient.REQUEST
        @storeCredentials client.credentials(), callback
      when DropboxClient.DONE
        if @rememberUser
          return @storeCredentials(client.credentials(), callback)
        @forgetCredentials callback
      when DropboxClient.SIGNED_OFF
        @forgetCredentials callback
      when DropboxClient.ERROR
        @forgetCredentials callback
      else
        callback()
        @

  # Computes the @storageKey used by loadCredentials and forgetCredentials.
  #
  # @private
  # This is called by onAuthStateChange.
  #
  # @param {Dropbox.Client} client the client instance that is running the
  #     authorization process
  # @return {Dropbox.Driver} this, for easy call chaining
  setStorageKey: (client) ->
    # NOTE: the storage key is dependent on the app hash so that multiple apps
    #       hosted off the same server don't step on eachother's toes
    @storageKey = "dropbox-auth:#{@scope}:#{client.appHash()}"
    @

  # Stores a Dropbox.Client's credentials to localStorage.
  #
  # @private
  # onAuthStateChange calls this method during the authentication flow.
  #
  # @param {Object} credentials the result of a Drobpox.Client#credentials call
  # @param {function()} callback called when the storing operation is complete
  # @return {Dropbox.Drivers.BrowserBase} this, for easy call chaining
  storeCredentials: (credentials, callback) ->
    localStorage.setItem @storageKey, JSON.stringify(credentials)
    callback()
    @

  # Retrieves a token and secret from localStorage.
  #
  # @private
  # onAuthStateChange calls this method during the authentication flow.
  #
  # @param {function(?Object)} callback supplied with the credentials object
  #   stored by a previous call to
  #   Dropbox.Drivers.BrowserBase#storeCredentials; null if no credentials were
  #   stored, or if the previously stored credentials were deleted
  # @return {Dropbox.Drivers.BrowserBase} this, for easy call chaining
  loadCredentials: (callback) ->
    jsonString = localStorage.getItem @storageKey
    unless jsonString
      callback null
      return @

    try
      callback JSON.parse(jsonString)
    catch jsonError
      # Parse errors.
      callback null
    @

  # Deletes information previously stored by a call to storeCredentials.
  #
  # @private
  # onAuthStateChange calls this method during the authentication flow.
  #
  # @param {function()} callback called after the credentials are deleted
  # @return {Dropbox.Drivers.BrowserBase} this, for easy call chaining
  forgetCredentials: (callback) ->
    localStorage.removeItem @storageKey
    callback()
    @

  # Pre-computes the static parts of url()'s return value.
  #
  # @param {String} baseUrl
  # @return {[String, String]} the static prefix and suffix in url()'s return
  #     value; the changing part is the URL-encoded OAuth token
  computeUrl: (baseUrl) ->
    querySuffix =
        "_dropboxjs_scope=#{encodeURIComponent(@scope)}&dboauth_token="
    location = baseUrl
    if location.indexOf('#') is -1
      fragment = null
    else
      locationPair = location.split '#', 2
      location = locationPair[0]
      fragment = locationPair[1]
    if @useQuery
      if location.indexOf('?') is -1
        location += "?#{querySuffix}"  # No query string in the URL.
      else
        location += "&#{querySuffix}"  # The URL already has a query string.

      if fragment
        [location, '#' + fragment]
      else
        [location, '']
    else
      [location + '#?' + querySuffix, '']

  # Figures out if the user completed the OAuth flow based on the current URL.
  #
  # @param {?String} the URL to check; if not given, the current location's URL
  #   is checked
  # @return {?String} the OAuth token that the user just authorized, or null if
  #   the user accessed this directly, without having authorized a token
  locationToken: (url) ->
    location = url or Dropbox.Drivers.BrowserBase.currentLocation()

    # Check for the scope.
    scopePattern = "_dropboxjs_scope=#{encodeURIComponent @scope}&"
    return null if location.indexOf?(scopePattern) is -1

    # Check for not_approved=true
    if @rejectedRe.test(location)
      match = @dbTokenRe.exec location
      if match
        # TODO(pwnall): indicate that the user did not approve the app.
        return decodeURIComponent(match[2])
      else
        return null

    # Extract the oauth_token.
    match = @tokenRe.exec location
    return decodeURIComponent(match[2]) if match

    null

  # Wrapper for window.location, for testing purposes.
  #
  # @return {String} the current page's URL
  @currentLocation: ->
    window.location.href


# OAuth driver that uses a redirect and localStorage to complete the flow.
class Dropbox.Drivers.Redirect extends Dropbox.Drivers.BrowserBase
  # Sets up the redirect-based OAuth driver.
  #
  # @param {?Object} options the advanced settings below
  # @option options {Boolean} useQuery if true, the page will receive OAuth
  #   data as query parameters; by default, the page receives OAuth data in
  #   the fragment part of the URL (the string following the #,
  #   available as document.location.hash), to avoid confusing the server
  #   generating the page
  # @option options {Boolean} rememberUser if true, the user's OAuth tokens are
  #   saved in localStorage; if you use this, you MUST provide a UI item that
  #   calls signOut() on Dropbox.Client, to let the user "log out" of the
  #   application
  # @option options {String} scope embedded in the localStorage key that holds
  #   the authentication data; useful for having multiple OAuth tokens in a
  #   single application
  constructor: (options) ->
    super options
    [@receiverUrl1, @receiverUrl2] =
        @computeUrl Dropbox.Drivers.BrowserBase.currentLocation()

  # Forwards the authentication process from REQUEST to AUTHORIZED on redirect.
  onAuthStateChange: (client, callback) ->
    superCall = do => => super client, callback
    @setStorageKey client
    if client.authState is DropboxClient.RESET
      @loadCredentials (credentials) =>
        if credentials and credentials.authState  # Incomplete authentication.
          if credentials.token is @locationToken() and
              credentials.authState is DropboxClient.REQUEST
            # locationToken matched, so the redirect happened
            credentials.authState = DropboxClient.AUTHORIZED
            return @storeCredentials credentials, superCall
          else
            # The authentication process broke down, start over.
            return @forgetCredentials superCall
        superCall()
    else
      superCall()

  # URL of the current page, since the user will be sent right back.
  url: (token) ->
    @receiverUrl1 + encodeURIComponent(token) + @receiverUrl2

  # Redirects to the authorize page.
  doAuthorize: (authUrl) ->
    window.location.assign authUrl

# OAuth driver that uses a popup window and postMessage to complete the flow.
class Dropbox.Drivers.Popup extends Dropbox.Drivers.BrowserBase
  # Sets up a popup-based OAuth driver.
  #
  # @param {?Object} options one of the settings below; leave out the argument
  #   to use the current location for redirecting
  # @option options {Boolean} rememberUser if true, the user's OAuth tokens are
  #   saved in localStorage; if you use this, you MUST provide a UI item that
  #   calls signOut() on Dropbox.Client, to let the user "log out" of the
  #   application
  # @option options {String} scope embedded in the localStorage key that holds
  #   the authentication data; useful for having multiple OAuth tokens in a
  #   single application
  # @option options {String} receiverUrl URL to the page that receives the
  #   /authorize redirect and performs the postMessage
  # @option options {Boolean} useQuery if true, the receiverUrl will be
  #   modified by adding query arguments; by default, a hash "#" is appended to
  #   URLs that don't have one, so the OAuth token information is contained in
  #   the URL fragment and does not hit the file server
  # @option options {String} receiverFile the URL to the receiver page will be
  #   computed by replacing the file name (everything after the last /) of
  #   the current location with this parameter's value
  constructor: (options) ->
    super options
    [@receiverUrl1, @receiverUrl2] = @computeUrl @baseUrl(options)

  # Removes credentials stuck in the REQUEST stage.
  onAuthStateChange: (client, callback) ->
    superCall = do => => super client, callback
    @setStorageKey client
    if client.authState is DropboxClient.RESET
      @loadCredentials (credentials) =>
        if credentials and credentials.authState  # Incomplete authentication.
          # The authentication process broke down, start over.
          return @forgetCredentials superCall
        superCall()
    else
      superCall()

  # Shows the authorization URL in a pop-up, waits for it to send a message.
  doAuthorize: (authUrl, token, tokenSecret, callback) ->
    @listenForMessage token, callback
    @openWindow authUrl

  # URL of the redirect receiver page, which posts a message back to this page.
  url: (token) ->
    @receiverUrl1 + encodeURIComponent(token) + @receiverUrl2

  # The URL of the page that will receive the OAuth callback.
  #
  # @param {Object} options the options passed to the constructor
  # @option options {String} receiverUrl URL to the page that receives the
  #   /authorize redirect and performs the postMessage
  # @option options {String} receiverFile the URL to the receiver page will be
  #   computed by replacing the file name (everything after the last /) of
  #   the current location with this parameter's value
  # @return {String} absolute URL of the receiver page
  baseUrl: (options) ->
    if options
      if options.receiverUrl
        return options.receiverUrl
      else if options.receiverFile
        fragments = Dropbox.Drivers.BrowserBase.currentLocation().split '/'
        fragments[fragments.length - 1] = options.receiverFile
        return fragments.join('/')
    Dropbox.Drivers.BrowserBase.currentLocation()

  # Creates a popup window.
  #
  # @param {String} url the URL that will be loaded in the popup window
  # @return {?DOMRef} reference to the opened window, or null if the call
  #   failed
  openWindow: (url) ->
    window.open url, '_dropboxOauthSigninWindow', @popupWindowSpec(980, 700)

  # Spec string for window.open to create a nice popup.
  #
  # @param {Number} popupWidth the desired width of the popup window
  # @param {Number} popupHeight the desired height of the popup window
  # @return {String} spec string for the popup window
  popupWindowSpec: (popupWidth, popupHeight) ->
    # Metrics for the current browser window.
    x0 = window.screenX ? window.screenLeft
    y0 = window.screenY ? window.screenTop
    width = window.outerWidth ? document.documentElement.clientWidth
    height = window.outerHeight ? document.documentElement.clientHeight

    # Computed popup window metrics.
    popupLeft = Math.round x0 + (width - popupWidth) / 2
    popupTop = Math.round y0 + (height - popupHeight) / 2.5
    popupLeft = x0 if popupLeft < x0
    popupTop = y0 if popupTop < y0

    # The specification string.
    "width=#{popupWidth},height=#{popupHeight}," +
      "left=#{popupLeft},top=#{popupTop}" +
      'dialog=yes,dependent=yes,scrollbars=yes,location=yes'

  # Listens for a postMessage from a previously opened popup window.
  #
  # @param {String} token the token string that must be received from the popup
  #   window
  # @param {function()} called when the received message matches the token
  listenForMessage: (token, callback) ->
    listener = (event) =>
      if event.data
        # Message coming from postMessage.
        data = event.data
      else
        # Message coming from Dropbox.EventSource.
        data = event

      if @locationToken(data) is token
        token = null  # Avoid having this matched in the future.
        window.removeEventListener 'message', listener
        Dropbox.Drivers.Popup.onMessage.removeListener listener
        callback()
    window.addEventListener 'message', listener, false
    Dropbox.Drivers.Popup.onMessage.addListener listener

  # Communicates with the driver from the OAuth receiver page.
  @oauthReceiver: ->
    window.addEventListener 'load', ->
      opener = window.opener
      if window.parent isnt window.top
        opener or= window.parent
      if opener
        try
          opener.postMessage window.location.href, '*'
        catch ieError
          # IE 9 doesn't support opener.postMessage for popup windows.
        try
          # postMessage doesn't work in IE, but direct object access does.
          opener.Dropbox.Drivers.Popup.onMessage.dispatch(
              window.location.href)
        catch frameError
          # Hopefully postMessage worked.
      window.close()

  # Works around postMessage failures on Internet Explorer.
  @onMessage = new Dropbox.EventSource