runique 3.0.2

//! Build pipeline: validation → core construction → middleware → statics.
//!
//! Construction order:
//!   1. Validation (each staging + cross-dependencies)
//!   2. DB connection (if DatabaseConfig provided)
//!   3. Core (Templates → Engine → URLs)
//!   4. Admin panel (merged before middleware stack)
//!   5. Password reset routes
//!   6. Middleware staging (slots sort + apply)
//!   7. Static files

use std::sync::Arc;

use axum::{
    Router,
    http::{HeaderName, HeaderValue},
};
use tower_http::{services::ServeDir, set_header::SetResponseHeaderLayer};

use super::super::error_build::BuildError;
use super::super::runique_app::RuniqueApp;
use super::super::templates::TemplateLoader;
use super::RuniqueAppBuilder;
use crate::admin::build_admin_router;
use crate::config::RuniqueConfig;
use crate::engine::RuniqueEngine;
use crate::macros::{add_urls, register_name_url};
use crate::middleware::HostPolicy;
use crate::utils::aliases::{ADb, new};
use crate::utils::runique_log::log_init;

#[cfg(feature = "orm")]
use crate::middleware::session::session_db::RuniqueSessionStore;

/// Largest request body: the upload limit, plus 1 MB for the form's text fields.
fn body_limit(max_upload_mb: u64) -> usize {
    let bytes = max_upload_mb.saturating_add(1).saturating_mul(1024 * 1024);
    usize::try_from(bytes).unwrap_or(usize::MAX)
}

/// Policy of every media response: no script, no plugin, whatever the file
/// claims to be (an uploaded `.html` or `.xhtml` is otherwise a page of the site).
const MEDIA_CSP: &str = "script-src 'none'; object-src 'none'; base-uri 'none'";

/// 404 for any path segment starting with a dot, decoded first (`%2E` is a
/// dot to `ServeDir`): uploads wait in `.staging-*` folders under the media
/// root until their form is checked, and must not be reachable meanwhile.
async fn hide_dot_segments(
    req: axum::extract::Request,
    next: axum::middleware::Next,
) -> axum::response::Response {
    use axum::response::IntoResponse;
    let hidden = req.uri().path().split('/').any(|segment| {
        urlencoding::decode(segment).map_or(true, |decoded| decoded.starts_with('.'))
    });
    if hidden {
        return axum::http::StatusCode::NOT_FOUND.into_response();
    }
    next.run(req).await
}

impl<P> RuniqueAppBuilder<P> {
    /// Validates and builds the application.
    ///
    /// # Construction Pipeline
    /// 1. **Validation** of all components (Core, Middleware, Statics)
    /// 2. **Construction** of the Core (Templates → Engine → URLs)
    /// 3. **Automatic reorganization** of middlewares by slots
    /// 4. **Application** of static files (if enabled)
    pub async fn build(mut self) -> Result<RuniqueApp, BuildError> {
        // Step 0: tracing (before everything else)
        // log_init early so get_log() works in TemplateLoader::init() and middleware staging.
        log_init(self.config.log.clone());
        let log_guards = self.config.log.init_subscriber();

        // Step 1: validation
        self.validate()?;
        if !self.all_ready() {
            return Err(BuildError::validation(
                "One or more components are not ready for construction",
            ));
        }

        // Step 2: DB connection (if DatabaseConfig provided)
        //   - `with_database(db)`        → already connected, taken as is
        //   - `with_database_config(cfg)` → `connect()` during build
        #[cfg(feature = "orm")]
        let db = self.core.connect().await?;

        // Step 3: destructuring
        let extensions = self.core.extensions;
        let config = self.config;
        let url_registry = self.core.url_registry;
        let mut middleware = self.middleware;
        let statics_enabled = self.statics.enabled;
        let static_cache = self.statics.static_cache;
        let media_cache = self.statics.media_cache;
        let router = self.router;

        // Step 4: core construction — strict order: Templates → Config → Engine → URLs

        let tera = new(TemplateLoader::init(&config, url_registry.clone())
            .map_err(|e| BuildError::template(e.to_string()))?);

        let config = new(config);
        crate::utils::password::password_init(config.password.clone());

        // HSTS `preload` requires `includeSubDomains` + `max-age ≥ 1 an` to be
        // accepted on the browser preload list — warn once at boot if the combo
        // is invalid (the header would otherwise be silently ignored for preload).
        if config.security.hsts_preload_misconfigured() {
            tracing::warn!(
                max_age = config.security.hsts_max_age,
                include_subdomains = config.security.hsts_include_subdomains,
                "HSTS_PRELOAD set but combo invalid (needs includeSubDomains + max-age ≥ 31536000) — ignored by browsers for preload"
            );
        }

        let engine = new(RuniqueEngine {
            config: (*config).clone(),
            tera: tera.clone(),
            #[cfg(feature = "orm")]
            db: ADb::from_connection(db),
            features: {
                let mut f = middleware.features.clone();
                f.exclusive_login = middleware.exclusive_login;
                f
            },
            url_registry,
            security_csp: {
                let mut policy = middleware.security_policy.take().unwrap_or_default();
                if self.admin.enabled {
                    policy.merge_htmx_hashes();
                }
                new(policy)
            },
            security_hosts: new(HostPolicy::new(
                middleware.allowed_hosts.clone(),
                middleware.features.enable_host_validation,
            )),
            csrf_exempt_paths: Arc::new(middleware.csrf_exempt_paths.clone()),
            permissions_policy: Arc::new(middleware.permissions_policy.take().unwrap_or_default()),
            trusted_proxies: Arc::new(match middleware.trusted_proxies_config.take() {
                // Explicit config always wins; otherwise the default is edge-aware
                // (private ranges behind a proxy, but `none()` when Runique is the
                // ACME TLS edge — closes SEC2). See `TrustedProxies::default_for_edge`.
                Some(c) => c.build(),
                None => {
                    crate::middleware::security::trusted_proxies::TrustedProxies::default_for_edge(
                        config.security.acme_enabled,
                    )
                }
            }),
            session_store: std::sync::LazyLock::new(|| std::sync::RwLock::new(None)),
            session_db_store: std::sync::LazyLock::new(|| std::sync::RwLock::new(None)),
            extensions,
        });

        add_urls(&engine);

        // Step 4b: admin + password reset — merged BEFORE the middleware stack.
        // `.layer()` in Axum only covers routes present at call time;
        // merging after means admin routes run without Session/CSRF/Extensions.
        let router = router.unwrap_or_default();

        // The admin's emailed reset links point to the reset page this app
        // serves, and its "view site" link, unless set, is the app's public URL.
        if let Some(pr) = &self.password_reset {
            self.admin.config.reset_route = pr.config.reset_route.clone();
        }
        if self.admin.config.view_site_url.is_none() {
            self.admin.config.view_site_url = engine.config.server.public_url.clone();
        }

        let router = if let Some(pr) = self.password_reset {
            let forgot_path = pr.config.forgot_route.clone();
            let reset_path = format!(
                "{}/{{token}}/{{encrypted_email}}",
                pr.config.reset_route.trim_end_matches('/')
            );
            let pr_router = crate::auth::password::build_router(Arc::new(pr.config));
            register_name_url(&engine, "forgot_password", &forgot_path);
            register_name_url(&engine, "reset_password", &reset_path);
            router.merge(pr_router)
        } else {
            router
        };

        let router = if self.admin.enabled {
            // Public base URL (mount prefix + admin path) — what `{% url %}`
            // must resolve to, not the path the router is built from.
            let admin_prefix = self.admin.public_prefix();
            let robots_txt = self.admin.robots_txt;
            let sitemap_url = self.admin.sitemap_url.clone();
            if let Some(level) = crate::utils::runique_log::get_log()
                .builder
                .as_ref()
                .and_then(|b| b.registry)
            {
                let count = self
                    .admin
                    .state
                    .as_ref()
                    .map(|s| s.registry.all().count())
                    .unwrap_or(0);
                crate::runique_log!(level, resources = count, "admin registry");
            }
            // Close the `resource_key` referential-integrity gap: drop rights that
            // point at a resource key no longer in the registry (see
            // `prune_orphan_droits`). Static resources → boot is the only window.
            let valid_keys: Vec<String> = self
                .admin
                .state
                .as_ref()
                .map(|s| s.registry.keys().into_iter().map(str::to_string).collect())
                .unwrap_or_default();
            if !valid_keys.is_empty() {
                let refs: Vec<&str> = valid_keys.iter().map(String::as_str).collect();
                let level = crate::utils::runique_log::get_log()
                    .builder
                    .as_ref()
                    .and_then(|b| b.registry);
                match crate::auth::permissions::prune_orphan_droits(&engine.db, &refs).await {
                    Ok(n) if n > 0 => {
                        if let Some(level) = level {
                            crate::runique_log!(
                                level,
                                pruned = n,
                                "orphan group rights pruned at boot"
                            );
                        }
                    }
                    Ok(_) => {}
                    Err(e) => {
                        if let Some(level) = level {
                            crate::runique_log!(level, error = %e, "orphan rights prune failed — stale grants may remain");
                        }
                    }
                }
            }

            let admin_router = build_admin_router(self.admin);
            add_urls(&engine);
            register_name_url(&engine, "admin", &admin_prefix);
            let mut r = router.merge(admin_router);
            if robots_txt {
                r = r.route(
                    "/robots.txt",
                    axum::routing::get(move || {
                        let sitemap_line = sitemap_url
                            .map(|u| format!("Sitemap: {}\n", u))
                            .unwrap_or_default();
                        // No `Disallow` for the admin prefix on purpose: this file
                        // is public, so naming the path would publish the very
                        // prefix a dev may have chosen to stay discreet — and it
                        // would only ask crawlers not to fetch it, not to leave it
                        // out of the index. De-indexing is handled where it cannot
                        // leak, by the `X-Robots-Tag` header on the admin router.
                        let body = format!(
                            "User-agent: *\n\n{}Content-Signal: ai-train=yes, search=yes, ai-input=yes\n",
                            sitemap_line
                        );
                        async move { body }
                    }),
                );
            }
            r
        } else {
            router
        };

        if let Some(level) = crate::utils::runique_log::get_log()
            .builder
            .as_ref()
            .and_then(|b| b.routes)
        {
            let count = engine
                .url_registry
                .read()
                .map(|guard| guard.len())
                .unwrap_or(0);
            crate::runique_log!(level, routes = count, "url registry");
        }

        // Step 5: middleware staging — automatic slot sort and apply
        let _exclusive_login = middleware.exclusive_login;
        let (router, session_store) =
            middleware.apply_to_router(router, config, engine.clone(), tera);
        if let Some(store) = session_store
            && let Ok(mut guard) = engine.session_store.write()
        {
            *guard = Some(store);
        }

        #[cfg(feature = "orm")]
        {
            let db_store = RuniqueSessionStore::new(engine.db.clone());
            if let Ok(mut guard) = engine.session_db_store.write() {
                *guard = Some(Arc::new(db_store));
            }
        }

        // Step 6: static files (conditional)
        let router = if statics_enabled {
            Self::attach_static_files(router, &engine.config, static_cache, media_cache)
        } else {
            router
        };

        // Step 7: body size. axum's default (2 MB) unless RUNIQUE_MAX_UPLOAD_MB
        // sets it; `parse_multipart` holds each file to `max_upload_mb` anyway.
        let router = match engine.config.static_files.max_body_mb {
            Some(mb) => router.layer(axum::extract::DefaultBodyLimit::max(body_limit(mb))),
            None => router,
        };

        Ok(RuniqueApp {
            engine,
            router,
            _log_guards: log_guards,
        })
    }

    // ─── Internal validation ──────────────────────────────────────────────────

    fn validate(&self) -> Result<(), BuildError> {
        self.core.validate()?;
        self.middleware.validate()?;
        self.statics.validate()?;
        self.admin.validate()?;
        self.cross_validate()
    }

    fn cross_validate(&self) -> Result<(), BuildError> {
        if self.config.debug {
            return Ok(());
        }

        use crate::app::error_build::{CheckError, CheckReport};

        let mut report = CheckReport::new();
        #[cfg(feature = "acme")]
        let sec = &self.config.security;
        let srv = &self.config.server;

        if crate::config::server::secret_key_is_weak(&srv.secret_key) {
            report.add(
                CheckError::new(
                    "Security",
                    crate::utils::trad::t("build.check.secret_key_weak"),
                )
                .with_suggestion(crate::utils::trad::t("build.check.secret_key_weak_hint")),
            );
        }

        // Without a public URL, a reset link would be built from the request's
        // `Host` header: someone asking a reset for a victim's address with
        // `Host: evil.com` would get the victim's token mailed in a link to
        // their own site.
        if (self.password_reset.is_some() || self.admin.enabled) && srv.public_url.is_none() {
            report.add(
                CheckError::new(
                    "PublicUrl",
                    crate::utils::trad::t("build.check.public_url_missing"),
                )
                .with_suggestion(crate::utils::trad::t("build.check.public_url_missing_hint")),
            );
        }

        #[cfg(feature = "acme")]
        if sec.acme_enabled {
            if sec.acme_domain.is_none() {
                report.add(
                    CheckError::new(
                        "ACME",
                        crate::utils::trad::t("build.check.acme_domain_missing"),
                    )
                    .with_suggestion(crate::utils::trad::t(
                        "build.check.acme_domain_missing_hint",
                    )),
                );
            }
            if sec.acme_email.is_none() {
                report.add(
                    CheckError::new(
                        "ACME",
                        crate::utils::trad::t("build.check.acme_email_missing"),
                    )
                    .with_suggestion(crate::utils::trad::t("build.check.acme_email_missing_hint")),
                );
            }
        }

        if report.has_errors() {
            return Err(BuildError::check(report));
        }

        Ok(())
    }

    fn all_ready(&self) -> bool {
        self.core.is_ready()
            && self.middleware.is_ready()
            && self.statics.is_ready()
            && self.admin.is_ready()
    }

    // ─── Static files attachment ──────────────────────────────────────────────

    pub(super) fn attach_static_files(
        mut router: Router,
        config: &RuniqueConfig,
        static_cache: std::borrow::Cow<'static, str>,
        media_cache: std::borrow::Cow<'static, str>,
    ) -> Router {
        // HSTS is host-scoped: once any page emits it (via the CSP middleware,
        // gated + configured by `SecurityConfig::hsts_header_value`), the browser
        // applies it to the whole host, static assets included. So static file
        // responses only carry the per-asset headers here — no HSTS to keep
        // config as the single source of truth (never a hardcoded preload).
        let security_headers = || {
            tower::ServiceBuilder::new()
                .layer(SetResponseHeaderLayer::if_not_present(
                    HeaderName::from_static("x-content-type-options"),
                    HeaderValue::from_static("nosniff"),
                ))
                .layer(SetResponseHeaderLayer::if_not_present(
                    HeaderName::from_static("x-frame-options"),
                    HeaderValue::from_static("DENY"),
                ))
                .layer(SetResponseHeaderLayer::if_not_present(
                    HeaderName::from_static("referrer-policy"),
                    HeaderValue::from_static("strict-origin-when-cross-origin"),
                ))
        };

        // Value already validated in `StaticStaging::validate()` (build Step 1),
        // run before this function — the header is well-formed by construction.
        let static_headers = security_headers().layer(SetResponseHeaderLayer::if_not_present(
            HeaderName::from_static("cache-control"),
            HeaderValue::from_str(&static_cache).expect("validated in StaticStaging::validate()"),
        ));

        // Media are files users uploaded: served from the app's own origin, an
        // uploaded page must never run a script there. The middleware stack
        // (and its CSP) doesn't cover these routes, so the policy is set here.
        let media_headers = security_headers()
            .layer(SetResponseHeaderLayer::overriding(
                HeaderName::from_static("content-security-policy"),
                HeaderValue::from_static(MEDIA_CSP),
            ))
            .layer(SetResponseHeaderLayer::if_not_present(
                HeaderName::from_static("cache-control"),
                HeaderValue::from_str(&media_cache)
                    .expect("validated in StaticStaging::validate()"),
            ))
            .layer(axum::middleware::from_fn(hide_dot_segments));

        router = router
            .nest_service(
                &config.static_files.static_url,
                static_headers
                    .clone()
                    .service(ServeDir::new(&config.static_files.staticfiles_dirs)),
            )
            .nest_service(
                &config.static_files.media_url,
                media_headers.service(ServeDir::new(&config.static_files.media_root)),
            );

        if !config.static_files.static_runique_url.is_empty() {
            router = router.nest_service(
                &config.static_files.static_runique_url,
                static_headers.service(ServeDir::new(&config.static_files.static_runique_path)),
            );
        }

        if let Some(level) = crate::utils::runique_log::get_log()
            .builder
            .as_ref()
            .and_then(|b| b.statics)
        {
            crate::runique_log!(
                level,
                static_url = %config.static_files.static_url,
                static_dir = %config.static_files.staticfiles_dirs,
                media_url = %config.static_files.media_url,
                media_dir = %config.static_files.media_root,
                "static files attached"
            );
        }

        router
    }
}