defter 0.5.1

//! defter: a self-hosted Zotero sync and file storage server.
//!
//! Library metadata lives in SQLite, attachment files in S3-compatible object
//! storage. Stock Zotero clients sync against it, and commonmeta sync can
//! enrich the library through the same API.

use std::net::SocketAddr;
use std::path::PathBuf;
use std::time::Duration;

use clap::{Args, Parser, Subcommand};

#[cfg(test)]
mod api_tests;
mod app;
mod auth;
mod backup;
mod control;
mod countries;
mod db;
mod error;
mod i18n;
mod migrate;
mod oidc;
mod profile;
mod query;
mod registry;
mod serve;
mod storage;
mod store;
mod ui;
mod zotero;

#[derive(Parser)]
#[command(
    name = "defter",
    version,
    about = "Self-hosted Zotero sync and file storage server"
)]
struct Cli {
    #[command(subcommand)]
    command: Command,
}

#[derive(Subcommand)]
enum Command {
    /// Start the server (runs in the foreground).
    Start(Box<StartArgs>),
    /// Print the read/write API key the login session hands out, generating
    /// one in the data directory when none is configured.
    Key(KeyCommandArgs),
    /// Back up the databases to object storage now, or list backups. Safe
    /// while the server runs.
    Backup(Box<BackupCommandArgs>),
    /// Restore a library's database, or the control database, from a backup.
    /// The server must be stopped.
    Restore(Box<RestoreCommandArgs>),
    /// Move the library database of an earlier defter (0.5.0 and before) to the
    /// layout of this one: backs up, then creates the control database and
    /// moves the library to libraries/, unchanged. The server must be stopped.
    Migrate(Box<MigrateCommandArgs>),
}

#[derive(Args)]
struct DataArgs {
    /// Directory for the database, the generated API key and (without S3)
    /// attachment files. Defaults to $STATE_DIRECTORY under systemd; as root,
    /// /var/lib/defter (macOS: /Library/Application Support/defter);
    /// otherwise ~/.local/share/defter or $XDG_DATA_HOME/defter (macOS:
    /// ~/Library/Application Support/defter).
    #[arg(long, env = "DEFTER_DATA_DIR")]
    data_dir: Option<PathBuf>,
}

#[derive(Args)]
struct KeyArgs {
    /// API keys as a comma-separated list of `rw:<file>` / `ro:<file>`
    /// entries, each file holding one token. Read-only keys can read
    /// everything but change nothing.
    #[arg(long, env = "DEFTER_KEYS")]
    keys: Option<String>,

    /// A file holding a single read/write API key.
    #[arg(long, env = "DEFTER_API_KEY_FILE")]
    api_key_file: Option<PathBuf>,

    /// A single read/write API key, e.g. from an environment file only root
    /// and the defter group can read. Approves Zotero logins on the login
    /// page. Generate it with `openssl rand -hex 32`.
    #[arg(long, env = "DEFTER_API_KEY", hide_env_values = true)]
    api_key: Option<String>,
}

#[derive(Args)]
struct KeyCommandArgs {
    #[command(flatten)]
    data: DataArgs,
    #[command(flatten)]
    keys: KeyArgs,
}

/// Where attachment files are, which backups also use.
#[derive(Args)]
struct StorageArgs {
    /// S3 bucket for attachment files. Without it files are kept in
    /// --files-dir, which is meant for development.
    #[arg(long, env = "DEFTER_S3_BUCKET")]
    s3_bucket: Option<String>,

    /// S3 endpoint, e.g. https://fsn1.your-objectstorage.com (Hetzner),
    /// https://<account>.r2.cloudflarestorage.com (Cloudflare R2) or
    /// http://127.0.0.1:9000 (RustFS); defaults to AWS. Clients download from
    /// pre-signed URLs on it, so they must be able to reach it.
    #[arg(long, env = "DEFTER_S3_ENDPOINT")]
    s3_endpoint: Option<String>,

    /// S3 region: the location for Hetzner (fsn1, nbg1, hel1), `auto` for R2.
    /// Falls back to AWS_REGION.
    #[arg(long, env = "DEFTER_S3_REGION")]
    s3_region: Option<String>,

    /// S3 access key ID. Falls back to AWS_ACCESS_KEY_ID.
    #[arg(long, env = "DEFTER_S3_ACCESS_KEY_ID")]
    s3_access_key_id: Option<String>,

    /// File holding the S3 access key ID.
    #[arg(long, env = "DEFTER_S3_ACCESS_KEY_ID_FILE")]
    s3_access_key_id_file: Option<PathBuf>,

    /// S3 secret access key (prefer the _FILE variant). Falls back to
    /// AWS_SECRET_ACCESS_KEY.
    #[arg(long, env = "DEFTER_S3_SECRET_ACCESS_KEY", hide_env_values = true)]
    s3_secret_access_key: Option<String>,

    /// File holding the S3 secret access key.
    #[arg(long, env = "DEFTER_S3_SECRET_ACCESS_KEY_FILE")]
    s3_secret_access_key_file: Option<PathBuf>,

    /// Address the bucket as <bucket>.<endpoint> instead of <endpoint>/<bucket>.
    /// Always on for Hetzner Object Storage.
    #[arg(long, env = "DEFTER_S3_VIRTUAL_HOSTED_STYLE")]
    s3_virtual_hosted_style: bool,

    /// Key prefix for every object, so a bucket can be shared.
    #[arg(long, env = "DEFTER_S3_PREFIX", default_value = "")]
    s3_prefix: String,

    /// Seconds a pre-signed download URL stays valid.
    #[arg(long, env = "DEFTER_PRESIGN_TTL", default_value_t = 300)]
    presign_ttl: u64,

    /// Stream downloads through the server instead of redirecting clients
    /// to the bucket (for a bucket clients cannot reach).
    #[arg(long, env = "DEFTER_PROXY_DOWNLOADS")]
    proxy_downloads: bool,

    /// Directory for attachment files when no S3 bucket is configured.
    /// Defaults to <data-dir>/files.
    #[arg(long, env = "DEFTER_FILES_DIR")]
    files_dir: Option<PathBuf>,
}

/// The owner's library.
#[derive(Args)]
struct LibraryArgs {
    /// The library database of an earlier defter, which `defter migrate`
    /// moves. Defaults to <data-dir>/defter.sqlite3. Since 0.5.1, the databases
    /// are <data-dir>/control.sqlite3 and <data-dir>/libraries/.
    #[arg(long, env = "DEFTER_DB")]
    db: Option<PathBuf>,

    /// The owner's Zotero user ID: every API key configured here is theirs.
    #[arg(long, env = "DEFTER_USER_ID", default_value_t = 1)]
    user_id: u64,
}

#[derive(Args)]
struct BackupArgs {
    /// Hours between backups of the library database to object storage, under
    /// backup/. 0 turns scheduled backups off.
    #[arg(long, env = "DEFTER_BACKUP_INTERVAL_HOURS", default_value_t = 6)]
    backup_interval_hours: u64,

    /// Days backups are kept. Deleted attachment files are kept as long, so a
    /// restored library finds them.
    #[arg(long, env = "DEFTER_BACKUP_KEEP_DAYS", default_value_t = 30)]
    backup_keep_days: u64,

    /// A separate S3 bucket for backups, with the same endpoint and
    /// credentials, so losing the files bucket does not lose them too.
    /// Defaults to the files bucket.
    #[arg(long, env = "DEFTER_BACKUP_S3_BUCKET")]
    backup_s3_bucket: Option<String>,
}

#[derive(Args)]
struct BackupCommandArgs {
    #[command(flatten)]
    data: DataArgs,
    #[command(flatten)]
    library: LibraryArgs,
    #[command(flatten)]
    storage: StorageArgs,
    #[command(flatten)]
    backup: BackupArgs,

    /// List the backups instead of making one.
    #[arg(long)]
    list: bool,
}

#[derive(Args)]
struct RestoreCommandArgs {
    #[command(flatten)]
    data: DataArgs,
    #[command(flatten)]
    library: LibraryArgs,
    #[command(flatten)]
    storage: StorageArgs,
    #[command(flatten)]
    backup: BackupArgs,

    /// The backup to restore, by its time as `defter backup --list` shows it.
    /// Defaults to the newest.
    #[arg(long)]
    manifest: Option<String>,

    /// The library to restore, by its name in backups: u<user id>. Defaults to
    /// the owner's.
    #[arg(long = "library", conflicts_with = "control")]
    restore_library: Option<String>,

    /// Restore the control database (users and what is known about each
    /// library) instead of a library.
    #[arg(long)]
    control: bool,

    /// Restore. Without it, only show what would be done.
    #[arg(long)]
    yes: bool,

    /// The highest library version Zotero clients may have seen, needed only
    /// when the live database cannot be read. Versions are set above it.
    #[arg(long)]
    min_version: Option<i64>,
}

#[derive(Args)]
struct MigrateCommandArgs {
    #[command(flatten)]
    data: DataArgs,
    #[command(flatten)]
    library: LibraryArgs,
    #[command(flatten)]
    storage: StorageArgs,
    #[command(flatten)]
    backup: BackupArgs,

    /// The owner's user name.
    #[arg(long, env = "DEFTER_USERNAME", default_value = "defter")]
    username: String,

    /// The owner's ORCID iD, if --orcid is set for the server.
    #[arg(long, env = "DEFTER_ORCID")]
    orcid: Option<String>,

    /// The ORCID iDs allowed to sign in, comma-separated: everyone's but the
    /// owner's become invitations.
    #[arg(long, env = "DEFTER_OIDC_ALLOWED_ORCIDS")]
    oidc_allowed_orcids: Option<String>,

    /// Only show what would be done.
    #[arg(long)]
    dry_run: bool,

    /// Do not back up first (when a backup was just taken).
    #[arg(long)]
    no_backup: bool,
}

#[derive(Args)]
struct StartArgs {
    #[command(flatten)]
    data: DataArgs,
    #[command(flatten)]
    keys: KeyArgs,
    #[command(flatten)]
    library: LibraryArgs,
    #[command(flatten)]
    storage: StorageArgs,
    #[command(flatten)]
    backup: BackupArgs,

    /// Address to listen on. Keep the default behind a reverse proxy.
    #[arg(long, env = "DEFTER_HOST", default_value = "127.0.0.1")]
    host: String,

    /// TCP port to listen on.
    #[arg(short, long, env = "DEFTER_PORT", default_value_t = 8189)]
    port: u16,

    /// PEM certificate (chain) to serve HTTPS with, e.g. a Cloudflare origin
    /// certificate when a TLS pass-through such as dragoman's --sni-route
    /// forwards connections. Requires --tls-key. Without it, plain HTTP.
    #[arg(long, env = "DEFTER_TLS_CERT", requires = "tls_key")]
    tls_cert: Option<PathBuf>,

    /// PEM private key for --tls-cert.
    #[arg(long, env = "DEFTER_TLS_KEY", requires = "tls_cert")]
    tls_key: Option<PathBuf>,

    /// Public hostname to get an HTTPS certificate for from Let's Encrypt, when
    /// no CDN is in front. Connections for it on port 443 must reach this
    /// server, such as through dragoman's --sni-route. Requires --email.
    #[arg(
        long,
        env = "DEFTER_DOMAIN",
        requires = "email",
        conflicts_with = "tls_cert"
    )]
    domain: Option<String>,

    /// Contact email for the Let's Encrypt account, with --domain.
    #[arg(long, env = "DEFTER_EMAIL")]
    email: Option<String>,

    /// Directory keeping the Let's Encrypt account and certificates between
    /// restarts. Defaults to <data-dir>/acme.
    #[arg(long, env = "DEFTER_ACME_CACHE")]
    acme_cache: Option<PathBuf>,

    /// Use Let's Encrypt's staging environment, whose certificates browsers do
    /// not trust: for trying the setup out without its rate limits.
    #[arg(long, env = "DEFTER_ACME_STAGING")]
    acme_staging: bool,

    /// URL clients reach the server at (the reverse proxy's or CDN's), used in
    /// login, upload and download links. Defaults to https://<domain> with
    /// --domain, otherwise http(s)://<host>:<port>.
    #[arg(long, env = "DEFTER_PUBLIC_URL")]
    public_url: Option<String>,

    /// The user name reported to clients.
    #[arg(long, env = "DEFTER_USERNAME", default_value = "defter")]
    username: String,

    /// How many libraries' databases stay open at most, beyond those in use.
    #[arg(long, env = "DEFTER_LIBRARY_CACHE", default_value_t = 150)]
    library_cache: usize,

    /// Require the SSO proxy in front of /login to forward this identity
    /// (X-Forwarded-Email/-User or X-Auth-Request-Email/-User) to approve a
    /// login. Leave unset on a private network.
    #[arg(long, env = "DEFTER_LOGIN_AUTHORIZED_USER")]
    login_authorized_user: Option<String>,

    /// Largest attachment file accepted, in MiB.
    #[arg(long, env = "DEFTER_MAX_UPLOAD_MB", default_value_t = 1024)]
    max_upload_mb: u64,

    /// Your ORCID iD (or ORCID URL): publishes a profile at /<orcid> with
    /// your ORCID record and every work in My Publications. It can be hidden
    /// on the dashboard.
    #[arg(long, env = "DEFTER_ORCID")]
    orcid: Option<String>,

    /// Issuer URL of an OpenID Connect provider to also sign in through, such
    /// as https://auth.example.org/realms/<realm>. Requires --oidc-client-id and
    /// --oidc-allowed-orcids. API keys keep working.
    #[arg(long, env = "DEFTER_OIDC_ISSUER")]
    oidc_issuer: Option<String>,

    /// The client this server is at the provider. Its redirect URI is
    /// <public-url>/ui/oidc/callback.
    #[arg(long, env = "DEFTER_OIDC_CLIENT_ID")]
    oidc_client_id: Option<String>,

    /// The client's secret. Prefer --oidc-client-secret-file: the environment
    /// is visible in /proc. Leave out for a public client.
    #[arg(long, env = "DEFTER_OIDC_CLIENT_SECRET", hide_env_values = true)]
    oidc_client_secret: Option<String>,

    /// File holding the client's secret.
    #[arg(long, env = "DEFTER_OIDC_CLIENT_SECRET_FILE")]
    oidc_client_secret_file: Option<String>,

    /// The ORCID iDs that may sign in, comma-separated. They may approve Zotero
    /// logins, and hide the public profile. Without --orcid, the profile is the
    /// first of them to sign in.
    #[arg(long, env = "DEFTER_OIDC_ALLOWED_ORCIDS")]
    oidc_allowed_orcids: Option<String>,

    /// The claim holding an account's ORCID iD, in the ID token or userinfo.
    #[arg(long, env = "DEFTER_OIDC_ORCID_CLAIM", default_value = "orcid")]
    oidc_orcid_claim: String,

    /// What the sign-in button calls the provider.
    #[arg(long, env = "DEFTER_OIDC_NAME", default_value = "Keycloak")]
    oidc_name: String,

    /// Where to get Zotero's item schema for GET /schema.
    #[arg(
        long,
        env = "DEFTER_SCHEMA_URL",
        default_value = "https://api.zotero.org/schema"
    )]
    schema_url: String,
}

/// The data directory of a system-wide installation (run as root).
#[cfg(target_os = "macos")]
const SYSTEM_DATA_DIR: &str = "/Library/Application Support/defter";
#[cfg(not(target_os = "macos"))]
const SYSTEM_DATA_DIR: &str = "/var/lib/defter";

/// What the default data directory depends on, read from the process.
struct DataDirEnv {
    /// systemd's `$STATE_DIRECTORY`, set by `StateDirectory=defter`.
    state_directory: Option<String>,
    root: bool,
    home: Option<String>,
    #[cfg_attr(target_os = "macos", allow(dead_code))]
    xdg_data_home: Option<String>,
}

impl DataDirEnv {
    fn current() -> Self {
        let var = |name| std::env::var(name).ok().filter(|v: &String| !v.is_empty());
        DataDirEnv {
            state_directory: var("STATE_DIRECTORY"),
            #[cfg(unix)]
            // SAFETY: geteuid has no preconditions and cannot fail.
            root: unsafe { libc::geteuid() } == 0,
            #[cfg(not(unix))]
            root: false,
            home: var("HOME"),
            xdg_data_home: var("XDG_DATA_HOME"),
        }
    }
}

/// The data directory when none is given:
///
/// 1. `$STATE_DIRECTORY`, under a systemd unit with `StateDirectory=defter`
///    (`/var/lib/defter`); its first entry when it lists several;
/// 2. as root, the system directory: `/var/lib/defter` on Linux,
///    `/Library/Application Support/defter` on macOS;
/// 3. otherwise the user's: `~/Library/Application Support/defter` on macOS,
///    `$XDG_DATA_HOME/defter` or `~/.local/share/defter` elsewhere.
fn default_data_dir(env: &DataDirEnv) -> PathBuf {
    if let Some(dir) = env
        .state_directory
        .as_deref()
        .and_then(|dirs| dirs.split(':').next())
        .filter(|dir| !dir.is_empty())
    {
        return PathBuf::from(dir);
    }
    if env.root {
        return PathBuf::from(SYSTEM_DATA_DIR);
    }
    let home = || env.home.as_deref().map(PathBuf::from);
    #[cfg(target_os = "macos")]
    let user = home().map(|h| h.join("Library/Application Support"));
    #[cfg(not(target_os = "macos"))]
    let user = env
        .xdg_data_home
        .as_deref()
        .map(PathBuf::from)
        // The XDG spec ignores a relative XDG_DATA_HOME.
        .filter(|p| p.is_absolute())
        .or_else(|| home().map(|h| h.join(".local/share")));
    user.map(|dir| dir.join("defter"))
        .unwrap_or_else(|| PathBuf::from(SYSTEM_DATA_DIR))
}

impl DataArgs {
    fn dir(&self) -> PathBuf {
        self.data_dir
            .clone()
            .unwrap_or_else(|| default_data_dir(&DataDirEnv::current()))
    }
}

impl KeyArgs {
    fn source(&self, data_dir: &std::path::Path) -> auth::KeySource {
        auth::KeySource {
            manifest: self.keys.clone(),
            file: self.api_key_file.clone(),
            key: self.api_key.clone(),
            generated: data_dir.join("api-key"),
        }
    }
}

fn fail(message: impl std::fmt::Display) -> ! {
    eprintln!("defter: {message}");
    std::process::exit(1);
}

/// A secret from a file (preferred) or a value.
fn secret(file: &Option<PathBuf>, value: &Option<String>) -> Option<String> {
    match file {
        Some(path) => Some(
            std::fs::read_to_string(path)
                .unwrap_or_else(|e| fail(format!("read {}: {e}", path.display())))
                .trim()
                .to_string(),
        ),
        None => value.clone(),
    }
}

impl StorageArgs {
    fn backend(&self, data_dir: &std::path::Path) -> storage::Backend {
        match &self.s3_bucket {
            Some(bucket) => storage::Backend::S3(storage::S3Config {
                bucket: bucket.clone(),
                endpoint: self.s3_endpoint.clone(),
                region: self.s3_region.clone(),
                access_key_id: secret(&self.s3_access_key_id_file, &self.s3_access_key_id),
                secret_access_key: secret(
                    &self.s3_secret_access_key_file,
                    &self.s3_secret_access_key,
                ),
                virtual_hosted_style: self.s3_virtual_hosted_style,
                prefix: self.s3_prefix.clone(),
            }),
            None => storage::Backend::Local(
                self.files_dir
                    .clone()
                    .unwrap_or_else(|| data_dir.join("files")),
            ),
        }
    }

    fn storage(&self, data_dir: &std::path::Path) -> storage::Storage {
        storage::Storage::new(
            &self.backend(data_dir),
            Duration::from_secs(self.presign_ttl),
            self.proxy_downloads,
        )
        .unwrap_or_else(|e| fail(format!("object storage: {e}")))
    }

    /// Where backups go: the files bucket, or `bucket` with its settings.
    fn backup_storage(&self, data_dir: &std::path::Path, bucket: Option<&str>) -> storage::Storage {
        let backend = match (
            self.backend(data_dir),
            bucket.filter(|b| !b.trim().is_empty()),
        ) {
            (storage::Backend::S3(mut cfg), Some(bucket)) => {
                cfg.bucket = bucket.to_string();
                storage::Backend::S3(cfg)
            }
            (_, Some(_)) => fail(
                "DEFTER_BACKUP_S3_BUCKET needs DEFTER_S3_BUCKET, whose settings it shares"
                    .to_string(),
            ),
            (backend, None) => backend,
        };
        storage::Storage::new(&backend, Duration::from_secs(self.presign_ttl), true)
            .unwrap_or_else(|e| fail(format!("backup storage: {e}")))
    }
}

impl LibraryArgs {
    fn path(&self, data_dir: &std::path::Path) -> PathBuf {
        self.db
            .clone()
            .unwrap_or_else(|| data_dir.join("defter.sqlite3"))
    }

    fn layout(&self, data_dir: &std::path::Path) -> migrate::Layout {
        migrate::Layout::new(data_dir, self.path(data_dir))
    }
}

/// The databases in `layout`: the control database and every library it
/// lists, or the one library of an earlier defter.
fn sources(layout: &migrate::Layout, user_id: u64) -> Result<Vec<backup::Source>, String> {
    match migrate::state(layout, user_id) {
        migrate::State::New => Ok(Vec::new()),
        migrate::State::Legacy => Ok(vec![backup::Source {
            name: control::LibraryRef::User(user_id).to_string(),
            path: layout.legacy.clone(),
            files: Some(storage::FileScope::Legacy),
        }]),
        _ => {
            let conn = rusqlite::Connection::open_with_flags(
                &layout.control,
                rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY,
            )
            .map_err(|e| format!("opening {}: {e}", layout.control.display()))?;
            conn.busy_timeout(Duration::from_secs(30))
                .map_err(|e| e.to_string())?;
            let libraries = control::libraries(&conn)
                .map_err(|e| format!("reading {}: {e}", layout.control.display()))?;
            let mut sources = vec![backup::Source {
                name: "control".to_string(),
                path: layout.control.clone(),
                files: None,
            }];
            sources.extend(
                libraries
                    .into_iter()
                    .map(|(library, files)| backup::Source {
                        name: library.to_string(),
                        path: layout.library(library),
                        files: Some(files),
                    }),
            );
            Ok(sources)
        }
    }
}

/// Backups of the databases in the data directory, with attachment files in
/// `files`.
fn backups(
    data_dir: &std::path::Path,
    library: &LibraryArgs,
    storage_args: &StorageArgs,
    backup_args: &BackupArgs,
    files: std::sync::Arc<storage::Storage>,
) -> backup::Backup {
    let layout = library.layout(data_dir);
    let user_id = library.user_id;
    backup::Backup::new(
        std::sync::Arc::new(
            storage_args.backup_storage(data_dir, backup_args.backup_s3_bucket.as_deref()),
        ),
        files,
        std::sync::Arc::new(move || sources(&layout, user_id)),
        data_dir.join("tmp"),
        backup_args.backup_keep_days,
    )
}

async fn backup_command(args: BackupCommandArgs) {
    let data_dir = args.data.dir();
    let files = std::sync::Arc::new(args.storage.storage(&data_dir));
    let backup = backups(&data_dir, &args.library, &args.storage, &args.backup, files);
    if args.list {
        let manifests = backup::list(&backup.store)
            .await
            .unwrap_or_else(|e| fail(e));
        if manifests.is_empty() {
            println!("no backups in {}", backup.store.description());
        }
        for manifest in manifests {
            let libraries = manifest
                .entries
                .iter()
                .map(|e| format!("{} v{} ({} bytes)", e.name, e.version, e.bytes))
                .collect::<Vec<_>>()
                .join(", ");
            println!(
                "{}  defter {}  {libraries}",
                manifest.created, manifest.defter
            );
        }
        return;
    }
    let report = backup.run().await;
    match report.error {
        Some(error) => fail(error),
        None => match report.manifest {
            Some(manifest) => println!(
                "backed up to {manifest}: {} snapshot(s), {} bytes",
                report.snapshots, report.bytes
            ),
            None => println!("nothing changed since the last backup"),
        },
    }
}

async fn restore_command(args: RestoreCommandArgs) {
    let data_dir = args.data.dir();
    let _lock = backup::lock(&data_dir).unwrap_or_else(|e| fail(e));
    let files = std::sync::Arc::new(args.storage.storage(&data_dir));
    let backup = backups(&data_dir, &args.library, &args.storage, &args.backup, files);
    let layout = args.library.layout(&data_dir);
    let name = if args.control {
        "control".to_string()
    } else {
        args.restore_library
            .clone()
            .unwrap_or_else(|| control::LibraryRef::User(args.library.user_id).to_string())
    };
    let source = if args.control {
        backup::Source {
            name: name.clone(),
            path: layout.control.clone(),
            files: None,
        }
    } else {
        if matches!(
            migrate::state(&layout, args.library.user_id),
            migrate::State::New | migrate::State::ControlMissing
        ) {
            fail(
                "restore the control database first (`defter restore --control`): it knows \
                 where each library's attachment files are",
            );
        }
        backup
            .sources()
            .unwrap_or_else(|e| fail(e))
            .into_iter()
            .find(|s| s.name == name)
            .unwrap_or_else(|| fail(format!("the control database has no library {name}")))
    };
    // The highest version the server recorded serving, which clients may hold.
    let served = match source.files {
        Some(_) if layout.control.exists() => control::LibraryRef::parse(&name)
            .and_then(|library| {
                let conn = rusqlite::Connection::open_with_flags(
                    &layout.control,
                    rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY,
                )
                .ok()?;
                control::version_high(&conn, library).ok()
            })
            .filter(|v| *v > 0),
        _ => None,
    };
    let restored = backup::restore(
        &backup.store,
        &backup.files,
        &source,
        args.manifest.as_deref(),
        &data_dir.join("tmp"),
        args.yes,
        args.min_version,
        served,
    )
    .await
    .unwrap_or_else(|e| fail(e));
    let doing = if args.yes {
        "restored"
    } else {
        "would restore"
    };
    if source.files.is_none() {
        println!(
            "{doing} {} from {}",
            source.path.display(),
            restored.manifest
        );
    } else {
        println!(
            "{doing} {} from {} (library version {}), with every version set to {}",
            source.path.display(),
            restored.manifest,
            restored.snapshot_version,
            restored.version
        );
    }
    if let Some(previous) = &restored.previous {
        println!("the replaced database is kept as {}", previous.display());
    }
    if args.yes && source.files.is_none() {
        println!("users, keys and groups are back as they were then");
    } else if args.yes {
        println!(
            "attachment files brought back: {}, still missing: {}",
            restored.files_restored, restored.files_missing
        );
        println!(
            "Zotero clients now see a newer library. Follow \"Backups and restore\" in the \
             README to bring them in line."
        );
    } else {
        println!("run again with --yes to restore");
    }
}

async fn migrate_command(args: MigrateCommandArgs) {
    let data_dir = args.data.dir();
    let _lock = backup::lock(&data_dir).unwrap_or_else(|e| fail(e));
    let layout = args.library.layout(&data_dir);
    let orcid = |s: &str| {
        profile::normalize_orcid(s).unwrap_or_else(|| fail(format!("{s:?} is not an ORCID iD")))
    };
    let owner = migrate::Owner {
        user_id: args.library.user_id,
        username: args.username.clone(),
        orcid: args
            .orcid
            .as_deref()
            .filter(|s| !s.trim().is_empty())
            .map(orcid),
        allowed_orcids: args
            .oidc_allowed_orcids
            .as_deref()
            .unwrap_or("")
            .split(',')
            .map(str::trim)
            .filter(|s| !s.is_empty())
            .map(orcid)
            .collect(),
    };
    let plan = migrate::plan(&layout, &owner).unwrap_or_else(|e| fail(e));
    println!(
        "{} {} (library version {}) to {}",
        if args.dry_run { "would move" } else { "moving" },
        layout.legacy.display(),
        plan.version,
        layout
            .library(control::LibraryRef::User(owner.user_id))
            .display()
    );
    if plan.state == migrate::State::Legacy {
        println!(
            "and create {}: user {} ({}), profile {}{}, attachment files staying under files/",
            layout.control.display(),
            owner.user_id,
            owner.username,
            plan.orcid.as_deref().unwrap_or("none"),
            if plan.profile_hidden { ", hidden" } else { "" },
        );
        for invite in &plan.invites {
            println!("{invite} becomes an invitation");
        }
    }
    if args.dry_run {
        println!("run again without --dry-run to migrate");
        return;
    }
    if plan.state == migrate::State::Legacy && !args.no_backup {
        let files = std::sync::Arc::new(args.storage.storage(&data_dir));
        let backup = backups(&data_dir, &args.library, &args.storage, &args.backup, files);
        let report = backup.run().await;
        if let Some(error) = report.error {
            fail(format!(
                "backing up first failed, so nothing was changed: {error}"
            ));
        }
        match report.manifest {
            Some(manifest) => println!("backed up to {manifest}"),
            None => println!("the last backup is current"),
        }
    }
    migrate::apply(&layout, &owner, &plan).unwrap_or_else(|e| fail(e));
    println!("migrated; start the server again");
}

#[tokio::main]
async fn main() {
    tracing_subscriber::fmt()
        .with_env_filter(
            tracing_subscriber::EnvFilter::try_from_default_env()
                .unwrap_or_else(|_| "defter=info,tower_http=warn".into()),
        )
        .init();
    // object_store and reqwest bring rustls with aws-lc-rs, commonmeta with
    // ring; with both compiled in rustls cannot choose, so choose for it.
    let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();

    match Cli::parse().command {
        Command::Start(args) => start(*args).await,
        Command::Key(args) => {
            let (keys, generated) =
                auth::Keys::load(&args.keys.source(&args.data.dir())).unwrap_or_else(|e| fail(e));
            if let Some(path) = generated {
                eprintln!("defter: generated a key in {}", path.display());
            }
            println!("{}", keys.login_key());
        }
        Command::Backup(args) => backup_command(*args).await,
        Command::Restore(args) => restore_command(*args).await,
        Command::Migrate(args) => migrate_command(*args).await,
    }
}

async fn start(args: StartArgs) {
    let data_dir = args.data.dir();
    let (keys, generated) =
        auth::Keys::load(&args.keys.source(&data_dir)).unwrap_or_else(|e| fail(e));
    if let Some(path) = generated {
        tracing::warn!(path = %path.display(), "no API key configured; generated one");
    }
    if keys.short_keys() > 0 {
        tracing::warn!(
            count = keys.short_keys(),
            min = auth::MIN_KEY_LENGTH,
            "API keys shorter than the minimum are easy to guess on the login page; \
             generate keys with `openssl rand -hex 32`"
        );
    }

    // Held while the server runs, so a restore cannot replace the database
    // under it.
    let _lock = backup::lock(&data_dir).unwrap_or_else(|e| fail(e));
    if args.storage.s3_bucket.is_none() {
        tracing::warn!("no S3 bucket configured; keeping attachment files on local disk");
    }
    let storage = args.storage.storage(&data_dir);

    let layout = args.library.layout(&data_dir);
    if let Some(refused) = migrate::refuse_start(&layout, args.library.user_id) {
        fail(refused);
    }
    let control = std::sync::Arc::new(
        control::Control::open(&layout.control)
            .unwrap_or_else(|e| fail(format!("{}: {e}", layout.control.display()))),
    );
    // A new server's first start makes the owner; later ones check they still are.
    control
        .ensure_owner(registry::owner(args.library.user_id, &args.username, false))
        .await
        .unwrap_or_else(|e| fail(e));
    let libraries = registry::Libraries::new(
        layout.libraries.clone(),
        control.clone(),
        args.library_cache,
    );

    let addr: SocketAddr = format!("{}:{}", args.host, args.port)
        .parse()
        .unwrap_or_else(|e| fail(format!("listen address: {e}")));
    let tls = match (&args.domain, &args.email) {
        (Some(domain), Some(email)) => Some(serve::Tls::Acme {
            domain: domain.clone(),
            email: email.clone(),
            cache: args
                .acme_cache
                .clone()
                .unwrap_or_else(|| data_dir.join("acme")),
            staging: args.acme_staging,
        }),
        _ => args
            .tls_cert
            .clone()
            .zip(args.tls_key.clone())
            .map(|(cert, key)| serve::Tls::Files { cert, key }),
    };
    let scheme = if tls.is_some() { "https" } else { "http" };
    let public_url = args
        .public_url
        .clone()
        .or_else(|| args.domain.as_ref().map(|d| format!("https://{d}")))
        .unwrap_or_else(|| format!("{scheme}://{addr}"))
        .trim_end_matches('/')
        .to_string();
    let cfg = app::Config {
        user_id: args.library.user_id,
        username: args.username.clone(),
        public_url: public_url.clone(),
        login_authorized_user: args.login_authorized_user.clone().filter(|s| !s.is_empty()),
        max_upload: args.max_upload_mb.saturating_mul(1024 * 1024),
        schema_url: args.schema_url.clone(),
        orcid: args
            .orcid
            .as_deref()
            .filter(|s| !s.trim().is_empty())
            .map(|s| {
                profile::normalize_orcid(s)
                    .unwrap_or_else(|| fail(format!("--orcid: {s:?} is not a valid ORCID iD")))
            }),
        oidc: args
            .oidc_issuer
            .as_deref()
            .filter(|issuer| !issuer.trim().is_empty())
            .map(|issuer| {
                oidc::OidcConfig::new(
                    issuer,
                    args.oidc_client_id.as_deref().unwrap_or(""),
                    secret(
                        &args
                            .oidc_client_secret_file
                            .as_deref()
                            .filter(|file| !file.trim().is_empty())
                            .map(PathBuf::from),
                        &args.oidc_client_secret,
                    ),
                    args.oidc_allowed_orcids.as_deref().unwrap_or(""),
                    &args.oidc_orcid_claim,
                    &args.oidc_name,
                )
                .unwrap_or_else(|e| fail(e))
            }),
        // With a provider to sign in through, typing a key is opt-in. Without
        // one it is the only way in, so it stays.
        key_login: args
            .oidc_issuer
            .as_deref()
            .is_none_or(|i| i.trim().is_empty())
            || args
                .keys
                .api_key
                .as_deref()
                .is_some_and(|key| !key.trim().is_empty()),
    };
    let app = app::App::new(cfg, control, libraries, storage, keys)
        .await
        .unwrap_or_else(|e| fail(e));
    // Opened now, so a missing or unreadable library stops the start.
    app.owner_library().await.unwrap_or_else(|e| fail(e));

    if args.backup.backup_interval_hours > 0 {
        let backup = std::sync::Arc::new(backups(
            &data_dir,
            &args.library,
            &args.storage,
            &args.backup,
            app.storage.clone(),
        ));
        app.storage.keep_deleted(true);
        let _ = app.backup.set(backup.clone());
        let every = Duration::from_secs(args.backup.backup_interval_hours * 3600);
        tokio::spawn(async move {
            // A minute in, so a deploy is backed up soon, then on schedule.
            let mut ticks = tokio::time::interval_at(
                tokio::time::Instant::now() + Duration::from_secs(60),
                every,
            );
            ticks.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
            loop {
                ticks.tick().await;
                backup.run().await;
            }
        });
    } else {
        tracing::warn!("scheduled backups are off (--backup-interval-hours 0)");
    }

    let storage = app.storage.description().to_string();
    let cert = match &tls {
        Some(serve::Tls::Files { cert, .. }) => Some(cert.display().to_string()),
        Some(serve::Tls::Acme { domain, .. }) => Some(format!("Let's Encrypt: {domain}")),
        None => None,
    };
    serve::serve(addr, app::router(app), tls, shutdown(), move |addr| {
        tracing::info!(
            %addr,
            scheme,
            cert,
            public_url,
            data = %data_dir.display(),
            storage,
            "defter listening"
        );
    })
    .await
    .unwrap_or_else(|e| fail(e));
}

async fn shutdown() {
    let ctrl_c = async {
        let _ = tokio::signal::ctrl_c().await;
    };
    #[cfg(unix)]
    let terminate = async {
        if let Ok(mut s) = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())
        {
            s.recv().await;
        }
    };
    #[cfg(not(unix))]
    let terminate = std::future::pending::<()>();
    tokio::select! {
        _ = ctrl_c => {},
        _ = terminate => {},
    }
    tracing::info!("shutting down");
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn oidc_settings_set_to_nothing_mean_off() {
        let start = |args: &[&str]| {
            let all = ["defter", "start"].iter().chain(args).copied();
            Cli::try_parse_from(all).map(|_| ())
        };
        // The same goes for the variables, which clap treats like these.
        assert!(start(&["--oidc-issuer", ""]).is_ok());
        assert!(start(&["--oidc-client-secret-file", ""]).is_ok());
    }

    #[test]
    fn lets_encrypt_needs_an_email_and_excludes_certificate_files() {
        let parse = |args: &[&str]| {
            let all = ["defter", "start"].iter().chain(args).copied();
            Cli::try_parse_from(all).map(|_| ())
        };
        const DOMAIN: &str = "defter.example.org";
        assert!(parse(&["--domain", DOMAIN, "--email", "me@example.org"]).is_ok());
        assert!(parse(&["--domain", DOMAIN]).is_err());
        assert!(
            parse(&[
                "--domain",
                DOMAIN,
                "--email",
                "me@example.org",
                "--tls-cert",
                "c.pem",
                "--tls-key",
                "k.pem",
            ])
            .is_err()
        );
    }

    fn env(state: Option<&str>, root: bool, home: Option<&str>, xdg: Option<&str>) -> DataDirEnv {
        DataDirEnv {
            state_directory: state.map(String::from),
            root,
            home: home.map(String::from),
            xdg_data_home: xdg.map(String::from),
        }
    }

    #[test]
    fn systemd_state_directory_wins() {
        let dir = default_data_dir(&env(
            Some("/var/lib/defter:/var/lib/other"),
            true,
            None,
            None,
        ));
        assert_eq!(dir, PathBuf::from("/var/lib/defter"));
    }

    #[test]
    fn root_uses_the_system_directory() {
        let dir = default_data_dir(&env(None, true, Some("/root"), None));
        assert_eq!(dir, PathBuf::from(SYSTEM_DATA_DIR));
    }

    #[cfg(target_os = "macos")]
    #[test]
    fn a_mac_user_gets_application_support() {
        let dir = default_data_dir(&env(None, false, Some("/Users/me"), Some("/ignored")));
        assert_eq!(
            dir,
            PathBuf::from("/Users/me/Library/Application Support/defter")
        );
    }

    #[cfg(not(target_os = "macos"))]
    #[test]
    fn a_linux_user_gets_xdg_data_home() {
        let xdg = default_data_dir(&env(None, false, Some("/home/me"), Some("/data")));
        assert_eq!(xdg, PathBuf::from("/data/defter"));
        let local = default_data_dir(&env(None, false, Some("/home/me"), Some("relative")));
        assert_eq!(local, PathBuf::from("/home/me/.local/share/defter"));
    }

    #[test]
    fn no_home_falls_back_to_the_system_directory() {
        assert_eq!(
            default_data_dir(&env(None, false, None, None)),
            PathBuf::from(SYSTEM_DATA_DIR)
        );
    }
}