--

--	loona - tiny CMS

--	Written by Timm S. Mueller <tmueller at neoscientists.org>

--	See copyright notice in COPYRIGHT

--

local tek = require "tek"

local cgi = require "tek.cgi"

local posix = require "tek.posix"

require "tek.cgi.request"

require "tek.cgi.request.args"

require "tek.cgi.session"

require "tek.web"

require "tek.web.markup"

require "tek.util"

local boxed_G = { 

	string = string, table = table,

	assert = assert, collectgarbage = collectgarbage, dofile = dofile,

	error = error, getfenv = getfenv, getmetatable = getmetatable,

	ipairs = ipairs, load = load, loadfile = loadfile, loadstring = loadstring,

	next = next, pairs = pairs, pcall = pcall, print = print,

	rawequal = rawequal, rawget = rawget, rawset = rawset, require = require,

	select = select, setfenv = setfenv, setmetatable = setmetatable,

	tonumber = tonumber, tostring = tostring, type = type, unpack = unpack,

	xpcall = xpcall

}

local table, string, assert, unpack, ipairs, pairs, type, require =

	table, string, assert, unpack, ipairs, pairs, type, require

local setmetatable, setfenv, getfenv = setmetatable, setfenv, getfenv

local open, remove, rename, getenv, time =

	io.open, os.remove, os.rename, os.getenv, os.time

local sectionfname, langs, docname

module "loona"

_VERSION = 2

_REVISION = 2

out = tek.web.out

setheader = tek.web.setheader

session = cgi.session

request = cgi.request

args = request.args

encodeform = cgi.encodeform

loadhtml = tek.web.include.load

source = tek.source

domarkup = tek.web.markup.main

expire = tek.util.expire

local function dbmsg(msg, detail)

	return (msg and detail and config.debug) and

		("%s : %s"):format(msg, detail) or msg

end

local function checkprofilename(c)

	assert(c:match("^%w+$") and c ~= "current",

		dbmsg("Invalid profile name", c))

	return c

end

local function checkbodyname(s)

	s = s or "main"

	assert(s:match("^[%w_]*%w+[%w_]*$"), dbmsg("Invalid body name", s))

	return s

end

local function deletedir(dst)

	for e in tek.util.readdir(dst) do

 		local success, msg = remove(dst .. "/" .. e)

		assert(success, dbmsg("Error removing entry in profile", msg))

	end

	return remove(dst)

end

local function copyprofile(contentdir, lang, srcprofile, newprofile)

	local src = ("%s/%s_%s"):format(contentdir, srcprofile, lang)

	assert(posix.stat(src, "mode") == "directory",

		dbmsg("Not a directory", src))

	local dst = ("%s/%s_%s"):format(contentdir, newprofile, lang)

	local success, msg = posix.mkdir(dst)

	assert(success, dbmsg("Error creating profile directory", msg))

	for e in tek.util.readdir(src) do

		local ext = e:match("^[^.].*%.([^.]*)$")

		if ext ~= "LOCK" then

			local f = src .. "/" .. e

			if posix.stat(f, "mode") == "file" then

				success, msg = tek.copyfile(f, dst .. "/" .. e)

				assert(success, dbmsg("Error copying file", msg))

			end

		end

	end

end

local function publishprofile(contentdir, lang, profile)

	local newpath = ("%s/current_%s"):format(contentdir, lang)

	local tmppath = newpath .. "." .. session.name

	local success, msg = posix.symlink(profile .. "_" .. lang, tmppath)

	assert(success, dbmsg("Cannot create symlink", msg))

	success, msg = rename(tmppath, newpath)

	assert(success, dbmsg("Cannot put symlink in place", msg))

end

local function lookupname(tab, val)

	if tab then

		for i, v in ipairs(tab) do

			if v.name == val then

				return i

			end

		end

	end

end

--	Index sections, determine accessibility and visibility in menu

local function indexsections(s)

	for _, e in ipairs(s) do

		if e.subs then

			indexsections(e.subs)

		end

		e.notvalid = (not secure and e.secure) or 

			(not authuser and e.secret) or nil

		e.notvisible = e.notvalid or not authuser and e.hidden or nil

		s[e.name] = e

	end

end

--	Decompose section path into a stack of sections, returning only up to

--	the last valid element in the path. additionally returns the table of

--	the last section path element (or the default section)

local function getsection(section, authuser, path, default)

	local tab = { { entries = sections, name = default } }

	local ss = sections

	local sectionpath

	(path or default):gsub("(%w+)/?", function(a)

		if ss then

			local s = ss[a]

			if s and not s.notvalid then

				sectionpath = s

				tab[#tab].name = a

				ss = s.subs

				if ss then

					table.insert(tab, { entries = ss })

				end

			else

				ss = nil -- stop.

			end

		end

	end)

	if not section and not sectionpath then

		sectionpath = sections[default]

		if sectionpath then

			table.insert(tab, { entries = sectionpath.subs })

		end

	end

	return tab, sectionpath

end

local function getpath(menus, delimiter)

	local t = { }

	for _, menu in ipairs(menus) do

		if menu.name then

			table.insert(t, menu.name)

		end

	end

	return table.concat(t, delimiter or "/")

end

--	Descending into the sections table alongside the current path,

--	return the filename to include, defaulting to its parent value

--	(or the default specified)

local function getsectionfile(menus, path, ext, default)

	local t, val = { }

	for _, menu in ipairs(menus) do

		if menu.entries and menu.entries[menu.name] then

			table.insert(t, menu.name)

			local fn = table.concat(t, "_") .. ext

			if posix.stat(path .. "/" .. fn, "mode") == "file" then

				val = fn

			end

		end

	end

	return val or default

end

local function deletesection(dir, fname)

	local fullname = dir .. "/" .. fname

	local success, msg = remove(fullname)

	if success then

		local pat = "^" .. 

			fname:gsub("%^%$%(%)%%%.%[%]%*%+%-%?", "%%%1") .. "%..*$"

		for e in tek.util.readdir(dir) do

			if e:match(pat) then

				remove(dir .. "/" .. e)

			end

		end

	end

	return success, msg

end

--	Add element to path

local function addtopath(tab, path, e)

	path:gsub("(%w+)/?", function(a)

		if tab then

			local s = tab[a]

			if s then

				if not s.subs then

					s.subs = { }

				end

				tab = s.subs

			else

				table.insert(tab, e)

				tab[a] = e

 				tab = nil -- stop

			end

		end

	end)

end

--	Remove element from path

local function rmpath(tab, path)

	local parent

	path:gsub("(%w+)/?", function(a)

		if tab then

			local idx = lookupname(tab, a)

			if idx then

				if tab[idx].subs then

					parent = tab[idx]

					tab = tab[idx].subs

				else

					table.remove(tab, idx)

					tab[a] = nil

					if #tab == 0 and parent then

						parent.subs = nil

					end

					tab = nil

				end

			end

		end

	end)

end

-------------------------------------------------------------------------------

--	Produce page title

function title()

	return section and (section.title or section.label or section.name) or ""

end

--	Create proxy for on-demand loading of locale strings

locale = { }

local locmt = { }

locmt.__index = function(_, key)

	for _, l in ipairs(langs) do

		locmt.__locale = source(config.localedir .. "/" .. l)

		if locmt.__locale then

			break

		end

	end

	locmt.__index = locmt.__locale

	return locmt.__locale[key]

end

setmetatable(locale, locmt)

--	Find element in path

function checkpath(tab, path)

	local res, idx

	path:gsub("(%w+)/?", function(a)

		if tab then

			local i = lookupname(tab, a)

			if i then

				res, idx = tab, i

				tab = tab[i].subs

			else

				res, idx = nil, nil

			end

		end

	end)

	return res, idx

end

--	Run a site function snippet, with full error recovery

--	(also recovers from errors in error handling function)

function dosnippet(config, func, errfunc)

	local ret = { tek.catch(func) }

	if ret[1] == 0 or (errfunc and tek.catch(errfunc) == 0) then

		return unpack(ret)

	end

	out("<h2>Error</h2>")

	out("<h3>" .. cgi.encodeform(ret[2] or "") .. "</h3>")

	if config.debug then

		if type(ret[3]) == "string" then

			out("<p>" .. cgi.encodeform(ret[3]) .. "</p>")

		end

		if ret[4] and config.debug then

			out("<pre>" .. cgi.encodeform(ret[4]) .. "</pre>")

		end

	end

end	

function lockfile(newfile)

	return not session and true or 

		posix.symlink(session.filename, newfile .. ".LOCK")

end

function unlockfile(dstfile)

	return not session and true or remove(dstfile .. ".LOCK")

end

function savesection(dir, fname, content)

	fname = dir .. "/" .. fname

	local f, msg = open(fname, "wb")

	assert(f, dbmsg("Could not open file for writing", msg))

	f:write(content or "")

	f:close()

end

--	Run extension in a controlled environment

function include(fname, ...)

	assert(not fname:match("%W"), dbmsg("Invalid include name", fname))

	local fname2 = ("%s/%s.lua"):format(config.extdir, fname)

	local f, msg = open(fname2)

	assert(f, dbmsg("Cannot open file", msg))

	local parsed, msg = loadhtml(f, "loona.out", fname2)

	assert(parsed, dbmsg("Syntax error", msg))

 	local fenv = {

 		arg = arg,

 		loona = {

 			out = out,

 			setheader = setheader,

			hidden = hidden,

			link = link,

			elink = elink,

			plink = plink,

			href = href,

			checkpath = checkpath,

			authuser = authuser,

			document = document,

			contentdir = contentdir,

			profile = profile,

			pubprofile = pubprofile,

			lang = lang,

			locale = locale,

			secure = secure,

			config = config,

			sectionpath = sectionpath,

			sections = sections,

			session = session,

		}

	}

 	setmetatable(fenv, { __index = boxed_G }) -- boxed global environment

	setfenv(parsed, fenv)

	return parsed()

end

--	produce link target, propagate lang, profile, session

function href(section, ...)

	local target = section and docname .. "/" .. section or docname

	if session or profile ~= pubprofile then

		return tek.web.gethref(target, { "profile", "session", "lang", 

			unpack(arg) })

	end

	return tek.web.gethref(target, { "lang", unpack(arg) })

end

local function ilink(target, text, extra)

	return ('<a href="%s"%s>%s</a>'):format(target, extra or "", text)

end

--	internal link, propagation of lang, profile, session

function link(section, text, ...)

	return ilink(href(section, unpack(arg)), text or section)

end

--	external link (opens in a new window), no argument propagation

function elink(target, text)

	return ilink(target, text or target,

		' class="extlink" onclick="void(window.open(this.href, \'\', \'\')); return false;"')

end

--	plain link, no argument propagation

function plink(section, text, ...)

	return ilink(tek.web.gethref(section, arg), text or section)

end

--	user interface link, propagation of lang, profile, session

function uilink(section, text, ...)

	return ilink(href(section, unpack(arg)), text or section)

end

--	produce a hidden input value in forms

function hidden(name, value)

	return not value and "" or

		('<input type="hidden" name="%s" value="%s" />'):format(name, value)

end

function getprofiles(contentdir, lang)

	local t = { }

	for f in tek.util.readdir(contentdir) do

		if posix.lstat(contentdir .. "/" .. f, "mode") == "directory" then

			local e = f:match("^(%w+)_" .. lang .. "$")

 			if e then

	 			t[e] = e

 	 		end

		end

	end

	return t

end

--	Functions to produce a hierarchical navigation menu

local function rmenu(level, linkf, path)

	local sub = submenus[level]

	if sub and sub.entries then

		local visible = { }

		for _, e in ipairs(sub.entries) do

			if not e.notvisible then

				table.insert(visible, e)

			end

		end

		if #visible > 0 then

			out('<ul id="menulevel' .. level .. '">')

			for _, e in ipairs(visible) do

				local label = encodeform(e.label or e.name)

				local newpath = path and path .. "/" .. e.name or e.name

				local active = (e.name == sub.name)

				out('<li>')

				linkf(newpath, label, active, e.action)

				if active then

					rmenu(level + 1, linkf, newpath)

				end

				out('</li>')

			end

			out('</ul>')

		end

	end

end

local function mlink(path, label, active, ...)

	local href = href(path, unpack(arg))

	if active then

		out('<a class="active" href="' .. href .. '">' .. label .. '</a>')

	else

		out('<a href="' .. href .. '">' .. label .. '</a>')

	end	

end

function menu(level, linkf)

	rmenu(level or 1, linkf or mlink)

end

-- Init

local function init()

	-- get list of languages, in order of preference

	langs = { args.lang and args.lang:match("^%w+$") }

	if config.browserlang then

		local s = getenv("HTTP_ACCEPT_LANGUAGE")

		while s do

			local l, r = s:match("^([%w.=]+)[,;](.*)$")

			l = l or s

			s = r

			if l:match("^%w+$") then

				table.insert(langs, l)

			end

		end

	end

	table.insert(langs, config.deflang)

	-- get list of possible profiles

	local profiles = { }

	for e in tek.util.readdir(config.contentdir) do

		profiles[e] = e

	end

	-- get pubprofile

	for _, lang in ipairs(langs) do

		local p = posix.readlink(config.contentdir .. "/current_" .. lang)

		p = p and p:match("^(%w+)_" .. lang .. "$")

		if p then

			pubprofile = p

			break

		end

	end

	-- get profile

	local checkprofile = authuser and args.profile or pubprofile or "default"

	for _, l in ipairs(langs) do

		if profiles[checkprofile .. "_" .. l] then

			profile = checkprofile

			lang = l

			break

		end

	end

	assert(profile and lang, "Invalid profile or language")

	-- Write back language and profile

	args.lang = lang ~= config.deflang and lang or nil

	args.profile = profile

	-- determine content directory pathname and section filename

	contentdir = ("%s/%s_%s"):format(config.contentdir, profile, lang)

 	sectionfname = contentdir .. "/.sections"

	-- load sections

 	sections = source(sectionfname)

	-- index sections, determine visibility in menu

	indexsections(sections)

	-- decompose section path, produce a stack of sections

	submenus, section = getsection(section, authuser, 

		cgi.document.VirtualPath or "", not authuser and config.defname)

	-- handle redirects if not logged on

	if not authuser and section and section.redirect then

		submenus, section = getsection(section, authuser, 

			section.redirect, not authuser and config.defname)

	end

	-- section path and document name (refined)

	sectionpath = getpath(submenus)

	sectionname = getpath(submenus, "_")

end

--	Handle state modifications (create/save/delete, profile management)

local function handlestate()

	if args.editkey == "main" then

		-- In main editable section:

		local save

		if args.actioncreate then

			-- Create new section

			local editname = args.editname:lower()

			assert(not editname:match("%W"),

				dbmsg("Invalid section name", editname))

			if not (section and (section.subs or section)[editname]) then

				local newpath = 

					(sectionpath and (sectionpath .. "/")) .. editname

				addtopath(sections, newpath, { name = editname,

					label = args.editlabel ~= "" and args.editlabel or nil,

					title = args.edittitle ~= "" and args.edittitle or nil,

					redirect = args.editredirect ~= "" and args.editredirect or nil,

					hidden = args.editvisibility and true,

					secret = args.editsecrecy and true,

					secure = args.editsecure and true,

					creator = authuser,

					creationdate = time() })

				save = true

			end

		elseif args.actionsave then

			-- Save section

			section.revisiondate = time()

			section.revisioner = authuser

			save = true

		elseif args.actiondelete then

			-- Delete section

			if not args.actionconfirm then

				useralert = {

					text = locale.ALERT_DELETE_SECTION,

					confirm =

						'<input type="submit" name="actiondelete" value="' .. 

						locale.DELETE .. '" /> ' ..

						hidden("actionconfirm", "true")

				}

			else

				deletesection(contentdir, sectionname)

				rmpath(sections, sectionpath)

				save = true

			end

		elseif args.actionsaveprops then

			-- Save properties

			section.hidden = args.editvisibility and true

			section.secret = args.editsecrecy and true

			section.secure = args.editsecure and true

			section.label = args.editlabel ~= "" and args.editlabel or nil

			section.title = args.edittitle ~= "" and args.edittitle or nil

			section.redirect =

				args.editredirect ~= "" and args.editredirect or nil

			save = true

		elseif args.actionup then

			-- Move section up

			local t, i = checkpath(sections, sectionpath)

			if t and i > 1 then

				local item = table.remove(t, i)

				table.insert(t, i - 1, item)

				save = true

			end

		elseif args.actiondown then

			-- Move section down

			local t, i = checkpath(sections, sectionpath)

			if t and i < #t then

				local item = table.remove(t, i)

				table.insert(t, i + 1, item)

				save = true

			end

		elseif args.actioncreateprofile and args.createprofile then

			-- Create profile

			local c = checkprofilename(args.createprofile:lower())

			if c == profile then

				useralert = { text = locale.ALERT_CANNOT_COPY_PROFILE_TO_SELF }

			else

				local profiles = getprofiles(config.contentdir, lang)

				if profiles[c] and not args.actionconfirm then

					useralert = {

						text = c == pubprofile and 

							locale.ALERT_OVERWRITE_PUBLISHED_PROFILE or

							locale.ALERT_OVERWRITE_EXISTING_PROFILE,

						confirm =

							'<input type="submit" name="actioncreateprofile" value="' .. 

							locale.OVERWRITE .. '" /> ' ..

							hidden("actionconfirm", "true") .. 

							hidden("createprofile", c)

					}

				else

					if profiles[c] then

						deletedir(config.contentdir .. "/" .. c .. "_" .. lang)

					end

					copyprofile(config.contentdir, lang, profile, c)

				end

			end

		elseif args.actiondeleteprofile and args.deleteprofile then

			-- Delete profile

			local c = checkprofilename(args.deleteprofile:lower())

			assert(c ~= pubprofile, dbmsg("Cannot delete published profile", c))

			if args.actionconfirm then

				deletedir(config.contentdir .. "/" .. c .. "_" .. lang)

				profile = nil

				args.profile = nil

				init()

				save = true

			else

				useralert = { 

					text = locale.ALERT_DELETE_PROFILE,

					confirm = 

						'<input type="submit" name="actiondeleteprofile" value="' .. 

						locale.DELETE .. '" /> ' ..

						hidden("actionconfirm", "true") ..

						hidden("deleteprofile", c)

				}

			end

		elseif args.actionchangeprofile and args.changeprofile then

			-- Change profile

			local c = checkprofilename(args.changeprofile:lower())

			profile = c

			args.profile = c

			save = true

		elseif args.actionpublishprofile and args.publishprofile then

			-- Publish profile

			local c = checkprofilename(args.publishprofile:lower())

			if c ~= _publicprofile then

				if args.actionconfirm then

					publishprofile(config.contentdir, lang, c)

					save = true

				else

					useralert = {

						text = locale.ALERT_PUBLISH_PROFILE,

						confirm =

							'<input type="submit" name="actionpublishprofile" value="' ..

							locale.PUBLISH .. '" /> ' ..

							hidden("actionconfirm", "true") ..

							hidden("publishprofile", c)

					}

				end

			end

		end

		if save then

			-- Write sections atomically, reload

			local tempname = sectionfname .. "." .. session.name

			local f, msg = open(tempname, "wb")

			assert(f, dbmsg("Error opening section file for writing", msg))

			tek.dump(sections, function(...)

				f:write(unpack(arg))

			end)

			f:close()

			local success, msg = rename(tempname, sectionfname)

			assert(success, dbmsg("Error renaming section file", msg))

			init()

		end

	elseif args.editkey and checkbodyname(args.editkey) then

		if args.actiondelete then

			-- Delete section in secondary editable body:

			deletesection(contentdir, sectionname .. "." .. args.editkey)

		end

	end

end

--	Load/create configuration

config = source("../etc/config.lua") or { }

config.defname = config.defname or "home"

config.deflang = config.deflang or "en"

config.sessionmaxage = config.sessionmaxage or 600

config.secureport = config.secureport or 443

--	Check paths and make them absolute

config.passwdfile = posix.abspath(config.passwdfile or "../etc/passwd.lua")

config.sessiondir = posix.abspath(config.sessiondir or "../var/sessions")

config.extdir = posix.abspath(config.extdir or "../extensions")

config.contentdir = posix.abspath(config.contentdir or "../content")

config.localedir = posix.abspath(config.localedir or "../locale")

--	Manage login and establish session

session.init(config.sessiondir, args.session, config.sessionmaxage)

if args.login then

	if args.login == "false" then

		session.delete()

		session = nil

	elseif args.password then

		local pwddb = source(config.passwdfile)

		local pwdentry = pwddb[args.login]

		if pwdentry and pwdentry.password == args.password then

			session.data.authuser = pwdentry.username

			session.data.id = session.id

		end

	end

end

secure = request.Port == config.secureport

authuser = session and session.data.authuser

if not authuser then

	session = nil

	args.session = nil

end

--	get lang, locale, profile, section

init()

if authuser then

	-- handle state modifications

	handlestate()

	assert(authuser) -- TODO?

end

--	add links for creating new sections

if authuser then

	local newent = { name = "new", 

		label = "[" .. locale.NEW .. "]",

		action = "actionnew=true" }

	for _, s in ipairs(submenus) do

		table.insert(s.entries, newent)

	end

	if submenus[#submenus].name then

		table.insert(submenus, {

			name = "new", 

			entries = { [1] = newent }

		})

	end

end

--	current document

docname = cgi.document.Name

assert(sectionpath) -- TODO?

document = docname .. "/" .. sectionpath

--	create section function

local func, msg = loadhtml(open("loona/editable.lua"),

	"tek.web.out", "loona/editable.lua")

assert(func, dbmsg("Syntax error", msg))

local editable = func()

function body(name)

	name = checkbodyname(name)

	if name == "main" then

		dosnippet(config, editable("main", contentdir, sectionname, sectionname))

	else

		local ext = "." .. name

		dosnippet(config, editable(name, contentdir,

			getsectionfile(submenus, contentdir, ext), sectionname .. ext))

	end

end

--	write back session state

if session then

	session.save()

end