monosecret 0.3.5

use std::process::Command;
use std::process::Stdio;

use secrecy::ExposeSecret;
use secrecy::SecretString;
use serde::Deserialize;
use serde::Serialize;

use crate::MonosecretError;
use crate::Result;
use crate::provider::Address;
use crate::provider::Provider;
use crate::provider::ProviderUrl;

/// Configuration for the `LastPass` provider.
///
/// This struct contains the configuration options for interacting with `LastPass`
/// through the `lpass` CLI tool.
///
/// # Examples
///
/// ```ignore
/// use monosecret::provider::lastpass::LastPassConfig;
///
/// // Create a default configuration
/// let config = LastPassConfig::default();
///
/// // Create a configuration with a folder prefix
/// let config = LastPassConfig {
///     folder_prefix: Some("my-company".to_string()),
/// };
/// ```
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct LastPassConfig {
	/// Optional folder prefix format string for organizing secrets in `LastPass`.
	///
	/// Supports placeholders: {project}, {profile}, and {key}.
	/// Defaults to "monosecret/{project}/{profile}/{key}" if not specified.
	pub folder_prefix: Option<String>,
}

impl Default for LastPassConfig {
	/// Creates a default `LastPassConfig` with no folder prefix.
	fn default() -> Self {
		Self {
			folder_prefix: None,
		}
	}
}

impl TryFrom<&ProviderUrl> for LastPassConfig {
	type Error = MonosecretError;

	/// Creates a `LastPassConfig` from a URL.
	///
	/// Parses a URL in the format `lastpass://[folder]` where the folder
	/// component is optional. The folder can be specified either as the
	/// authority or the path component of the URL.
	fn try_from(url: &ProviderUrl) -> std::result::Result<Self, Self::Error> {
		if url.scheme() != "lastpass" {
			return Err(MonosecretError::ProviderOperationFailed(format!(
				"Invalid scheme '{}' for lastpass provider",
				url.scheme()
			)));
		}

		let mut config = Self::default();

		if let Some(host) = url.host() {
			config.folder_prefix = Some(format!("{}{}", host, url.path()));
		}

		Ok(config)
	}
}

/// `LastPass` provider implementation for Monosecret.
///
/// This provider integrates with `LastPass` password manager through the `lpass` CLI tool.
/// It stores secrets in a hierarchical structure within `LastPass` using a configurable
/// format string that defaults to: `monosecret/{project}/{profile}/{key}`.
///
/// # Requirements
///
/// The `LastPass` CLI (`lpass`) must be installed and the user must be logged in:
/// - macOS: `brew install lastpass-cli`
/// - Linux: Use your package manager (e.g., `apt install lastpass-cli`)
/// - NixOS: `nix-env -iA nixpkgs.lastpass-cli`
///
/// After installation, authenticate with: `lpass login <your-email>`
///
/// # Examples
///
/// ```ignore
/// use monosecret::provider::lastpass::{LastPassProvider, LastPassConfig};
///
/// // Create provider with default config
/// let provider = LastPassProvider::default();
///
/// // Create provider with custom config
/// let config = LastPassConfig {
///     folder_prefix: Some("work".to_string()),
/// };
/// let provider = LastPassProvider::new(config);
/// ```
pub struct LastPassProvider {
	#[allow(dead_code)]
	config: LastPassConfig,
}

crate::register_provider! {
	struct: LastPassProvider,
	config: LastPassConfig,
	name: "lastpass",
	description: "LastPass password manager",
	schemes: ["lastpass"],
	examples: ["lastpass://", "lastpass://Shared-Monosecret"],
	preflight: check_auth,
}

impl LastPassProvider {
	/// Creates a new `LastPassProvider` with the given configuration.
	///
	/// # Arguments
	///
	/// * `config` - The `LastPass` configuration to use
	pub fn new(config: LastPassConfig) -> Self {
		Self { config }
	}

	/// Executes a `LastPass` CLI command and returns its output.
	///
	/// This is the core method for interacting with the `LastPass` CLI. It handles
	/// command execution, error detection, and provides helpful error messages
	/// for common issues like missing CLI installation or authentication.
	///
	/// # Arguments
	///
	/// * `args` - Command line arguments to pass to `lpass`
	///
	/// # Returns
	///
	/// Returns the command's stdout as a String on success, or an error with
	/// detailed information about what went wrong.
	///
	/// # Errors
	///
	/// - Returns an error if the `lpass` CLI is not installed
	/// - Returns an error if the user is not logged in to `LastPass`
	/// - Returns an error if the command fails for any other reason
	fn execute_lpass_command(args: &[&str]) -> Result<String> {
		let mut cmd = Command::new("lpass");
		cmd.args(args);

		let output = match cmd.output() {
			Ok(output) => output,
			Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
				return Err(MonosecretError::ProviderOperationFailed(
                    "LastPass CLI (lpass) is not installed.\n\nTo install it:\n  - macOS: brew install lastpass-cli\n  - Linux: Check your package manager (apt install lastpass-cli, yum install lastpass-cli, etc.)\n  - NixOS: nix-env -iA nixpkgs.lastpass-cli\n\nAfter installation, run 'lpass login <your-email>' to authenticate.".to_string(),
                ));
			}
			Err(e) => return Err(e.into()),
		};

		if !output.status.success() {
			let error_msg = String::from_utf8_lossy(&output.stderr);
			if error_msg.contains("Could not find decryption key")
				|| error_msg.contains("Not logged in")
			{
				return Err(MonosecretError::ProviderOperationFailed(
					"LastPass authentication required. Please run 'lpass login' first.".to_string(),
				));
			}
			return Err(MonosecretError::ProviderOperationFailed(
				error_msg.to_string(),
			));
		}

		String::from_utf8(output.stdout).map_err(|e| {
			MonosecretError::ProviderOperationFailed(format!(
				"LastPass CLI returned non-UTF-8 output: {}",
				crate::error::display_error_chain(&e)
			))
		})
	}

	/// Formats the item name for storage in `LastPass`.
	///
	/// Creates a hierarchical path for organizing secrets within `LastPass`.
	/// Uses `folder_prefix` as a format string with {project}, {profile}, and {key} placeholders.
	/// Defaults to "monosecret/{project}/{profile}/{key}" if not configured.
	///
	/// # Arguments
	///
	/// * `project` - The project name
	/// * `key` - The secret key name
	/// * `profile` - The profile name (e.g., "default", "production", "staging")
	///
	/// # Returns
	///
	/// A formatted string representing the full path to the secret in `LastPass`.
	fn format_item_name(&self, project: &str, key: &str, profile: &str) -> String {
		let format_string = self
			.config
			.folder_prefix
			.as_deref()
			.unwrap_or("monosecret/{project}/{profile}/{key}");

		format_string
			.replace("{project}", project)
			.replace("{profile}", profile)
			.replace("{key}", key)
	}

	/// Checks the current `LastPass` login status.
	///
	/// Executes `lpass status` to determine if the user is currently logged in.
	///
	/// # Returns
	///
	/// Returns `Ok(true)` if logged in, `Ok(false)` if not logged in, or an error
	/// if the status check itself fails.
	fn check_login_status() -> Result<bool> {
		match Self::execute_lpass_command(&["status"]) {
			Ok(output) => Ok(!output.contains("Not logged in")),
			Err(MonosecretError::ProviderOperationFailed(msg))
				if msg.contains("Not logged in")
					|| msg.contains("LastPass authentication required") =>
			{
				Ok(false)
			}
			Err(e) => Err(e),
		}
	}

	/// Checks that the user is logged in to `LastPass`.
	/// Called by the preflight guard before any provider operations.
	// Method signature is required by the `register_provider!` preflight hook,
	// which invokes it as `provider.check_auth()` on an `Arc<Self>`.
	#[allow(clippy::unused_self)]
	pub(crate) fn check_auth(&self) -> Result<()> {
		if !Self::check_login_status()? {
			return Err(MonosecretError::ProviderOperationFailed(
				"LastPass authentication required. Please run 'lpass login <your-email>' first."
					.to_string(),
			));
		}
		Ok(())
	}
}

impl Provider for LastPassProvider {
	/// Convention items live under the folder-prefix format string,
	/// `monosecret/{project}/{profile}/{key}` by default.
	fn convention_address(
		&self,
		project: &str,
		profile: &str,
		key: &str,
	) -> Result<crate::config::NativeAddress> {
		Ok(crate::config::NativeAddress {
			item: self.format_item_name(project, key, profile),
			..Default::default()
		})
	}

	fn name(&self) -> &'static str {
		Self::PROVIDER_NAME
	}

	/// `lpass status` probes the user's singleton `LastPass` session, so every
	/// instance shares one preflight probe.
	fn auth_scope_key(&self) -> Option<String> {
		Some(String::new())
	}

	/// `TryFrom` reads the whole `host` + `path` as the item template, so the
	/// whole template is emitted here for it to read back. Emitting less names
	/// a different template: dropping `/{key}` addresses one item for every
	/// secret.
	fn uri(&self) -> String {
		match self.config.folder_prefix.as_deref() {
			Some(prefix) if !prefix.is_empty() => {
				format!("lastpass://{}", ProviderUrl::encode(prefix))
			}
			_ => "lastpass".to_string(),
		}
	}

	/// The template selects an item inside the account's own vault; it does not
	/// select another `LastPass` store.
	fn entry_container_identity(&self) -> String {
		"lastpass".to_string()
	}

	/// Retrieves a secret from `LastPass`.
	///
	/// Fetches the value of a secret stored in `LastPass` at the path
	/// determined by the `folder_prefix` format string. Uses `lpass show` with
	/// the `--sync=now` flag to ensure fresh data from the server.
	///
	/// # Arguments
	///
	/// * `project` - The project name
	/// * `key` - The secret key to retrieve
	/// * `profile` - The profile name
	///
	/// # Returns
	///
	/// - `Ok(Some(value))` if the secret exists and has a value
	/// - `Ok(None)` if the secret doesn't exist or has an empty value
	/// - `Err` if there's an error accessing `LastPass`
	///
	/// # Errors
	///
	/// - Returns an error if not logged in to `LastPass`
	/// - Returns an error if the `LastPass` CLI fails
	fn get(&self, addr: Address<'_>) -> Result<Option<SecretString>> {
		let item_name = crate::provider::flat_item(self, addr)?;

		match Self::execute_lpass_command(&["show", "--sync=now", "--password", &item_name]) {
			Ok(output) => {
				let password = output.trim();
				if password.is_empty() {
					Ok(None)
				} else {
					Ok(Some(SecretString::new(password.to_string().into())))
				}
			}
			Err(MonosecretError::ProviderOperationFailed(msg))
				if msg.contains("Could not find specified account") =>
			{
				Ok(None)
			}
			Err(e) => Err(e),
		}
	}

	/// Stores a secret in `LastPass`.
	///
	/// Creates or updates a secret in `LastPass` at the path
	/// determined by the `folder_prefix` format string. The method first checks if
	/// the item exists to determine whether to use `lpass edit` (for updates)
	/// or `lpass add` (for new items).
	///
	/// # Arguments
	///
	/// * `project` - The project name
	/// * `key` - The secret key to store
	/// * `value` - The secret value to store
	/// * `profile` - The profile name
	///
	/// # Returns
	///
	/// Returns `Ok(())` on success, or an error if the operation fails.
	///
	/// # Errors
	///
	/// - Returns an error if not logged in to `LastPass`
	/// - Returns an error if the `LastPass` CLI command fails
	///
	/// # Implementation Details
	///
	/// The method uses non-interactive mode and disables pinentry to avoid
	/// GUI prompts. The secret value is passed via stdin to avoid exposing
	/// it in the process list.
	fn set(&self, addr: Address<'_>, value: &SecretString) -> Result<()> {
		let item_name = crate::provider::flat_item(self, addr)?;

		// Check if item exists
		if self.get(addr)?.is_some() {
			// Update existing item
			let args = vec![
				"edit",
				"--sync=now",
				&item_name,
				"--password",
				"--non-interactive",
			];

			let mut cmd = Command::new("lpass");
			cmd.args(&args);
			cmd.env("LPASS_DISABLE_PINENTRY", "1");

			let mut child = cmd
				.stdin(Stdio::piped())
				.stdout(Stdio::piped())
				.stderr(Stdio::piped())
				.spawn()?;

			if let Some(stdin) = child.stdin.take() {
				super::write_child_stdin(stdin, value.expose_secret())?;
			}

			let output = child.wait_with_output()?;
			if !output.status.success() {
				let error_msg = String::from_utf8_lossy(&output.stderr);
				return Err(MonosecretError::ProviderOperationFailed(
					error_msg.to_string(),
				));
			}
		} else {
			// Create new item using lpass add
			let args = vec![
				"add",
				"--sync=now",
				&item_name,
				"--password",
				"--non-interactive",
			];

			let mut cmd = Command::new("lpass");
			cmd.args(&args);
			cmd.env("LPASS_DISABLE_PINENTRY", "1");

			let mut child = cmd
				.stdin(Stdio::piped())
				.stdout(Stdio::piped())
				.stderr(Stdio::piped())
				.spawn()?;

			if let Some(stdin) = child.stdin.take() {
				super::write_child_stdin(stdin, value.expose_secret())?;
			}

			let output = child.wait_with_output()?;
			if !output.status.success() {
				let error_msg = String::from_utf8_lossy(&output.stderr);
				return Err(MonosecretError::ProviderOperationFailed(
					error_msg.to_string(),
				));
			}
		}

		Ok(())
	}
}

impl Default for LastPassProvider {
	/// Creates a `LastPassProvider` with default configuration.
	///
	/// This is equivalent to calling `LastPassProvider::new(LastPassConfig::default())`.
	fn default() -> Self {
		Self::new(LastPassConfig::default())
	}
}

#[cfg(test)]
mod tests {
	use super::*;

	fn provider_of(spec: &str) -> Box<dyn Provider> {
		Box::<dyn Provider>::try_from(spec).expect("the spec must be valid")
	}

	fn uri_of(spec: &str) -> String {
		provider_of(spec).uri()
	}

	/// The item a spec addresses, for comparing two spellings of one store.
	/// `LastPassConfig` has no `PartialEq`, and the rendered item is what the
	/// template exists to produce.
	fn addressed_item(spec: &str) -> String {
		provider_of(spec)
			.convention_address("my-app", "production", "API_KEY")
			.expect("a convention address")
			.item
	}

	#[test]
	fn format_item_name_default_pattern() {
		let provider = LastPassProvider::new(LastPassConfig::default());
		assert_eq!(
			provider.format_item_name("myproj", "API_KEY", "prod"),
			"monosecret/myproj/prod/API_KEY"
		);
	}

	#[test]
	fn format_item_name_custom_prefix() {
		let provider = LastPassProvider::new(LastPassConfig {
			folder_prefix: Some("Work/{profile}/{key}".to_string()),
		});
		assert_eq!(
			provider.format_item_name("myproj", "API_KEY", "prod"),
			"Work/prod/API_KEY"
		);
	}

	#[test]
	fn uri_round_trips_the_item_template() {
		// `uri()` is the provider's identity: Monosecret fingerprints cached
		// routes with it, names the answering store with it in audit records,
		// and the derive macro hands it back as a provider spec. Emitting only
		// the first segment made different templates indistinguishable --
		// `Shared/{project}/{profile}/{key}` read back as the default
		// `monosecret/{project}/{profile}/{key}`, a different folder, and
		// `Work/TeamA/{key}` read back as the literal item `Work`, one item for
		// every secret in the profile.
		for spec in [
			"lastpass",
			"lastpass://",
			"lastpass://Work",
			"lastpass://Shared",
			"lastpass://Shared/{project}/{profile}/{key}",
			"lastpass://Shared-Monosecret/{project}/{profile}/{key}",
			"lastpass://Work/TeamA/{project}/{profile}/{key}",
			"lastpass://Shared Items/dev/{key}",
		] {
			let rendered = uri_of(spec);
			assert_eq!(
				addressed_item(&rendered),
				addressed_item(spec),
				"{spec} rendered as {rendered}, which does not read back as the same item",
			);
		}
	}

	/// Two templates under one folder must stay distinguishable, or the cache
	/// fingerprints both routes alike and keeps serving the first one's values
	/// after the source is repointed at the second.
	#[test]
	fn uri_distinguishes_two_templates_under_one_folder() {
		assert_ne!(
			uri_of("lastpass://Work/TeamA/{project}/{profile}/{key}"),
			uri_of("lastpass://Work/TeamB/{project}/{profile}/{key}"),
		);
	}
}

#[cfg(test)]
mod reference_tests {
	use super::*;

	/// A native address names the item directly via `item`, bypassing the
	/// folder-prefix format string.
	#[test]
	fn native_address_names_the_item() {
		let p = LastPassProvider::new(LastPassConfig {
			folder_prefix: Some("Work/{key}".to_string()),
		});
		let addr = crate::config::NativeAddress {
			item: "Shared/api-token".into(),
			..Default::default()
		};
		assert_eq!(
			crate::provider::flat_item(&p, Address::Native(&addr)).unwrap(),
			"Shared/api-token"
		);
	}

	/// `LastPass` items are read whole here; a `field` coordinate is rejected.
	#[test]
	fn native_address_rejects_field() {
		let p = LastPassProvider::new(LastPassConfig::default());
		let addr = crate::config::NativeAddress {
			item: "api-token".into(),
			field: Some("password".into()),
			..Default::default()
		};
		let err = crate::provider::flat_item(&p, Address::Native(&addr)).unwrap_err();
		assert!(err.to_string().contains("`field`"), "{err}");
	}
}