--

--	loona - tiny CMS

--	Written by Timm S. Mueller <tmueller at neoscientists.org>

--	See copyright notice in COPYRIGHT

--

require "tek"

require "tek.cgi"

require "tek.cgi.request"

require "tek.cgi.request.args"

require "tek.cgi.header"

require "tek.cgi.session"

require "tek.posix"

require "tek.web"

require "tek.web.markup"

require "tek.util"

local boxed_G = { 

	string = string, table = table,

	assert = assert, collectgarbage = collectgarbage, dofile = dofile,

	error = error, getfenv = getfenv, getmetatable = getmetatable,

	ipairs = ipairs, load = load, loadfile = loadfile, loadstring = loadstring,

	next = next, pairs = pairs, pcall = pcall, print = print,

	rawequal = rawequal, rawget = rawget, rawset = rawset, require = require,

	select = select, setfenv = setfenv, setmetatable = setmetatable,

	tonumber = tonumber, tostring = tostring, type = type, unpack = unpack,

	xpcall = xpcall

}

local tek, table, string, assert, unpack, ipairs, pairs, type, require =

	tek, table, string, assert, unpack, ipairs, pairs, type, require

local setmetatable, setfenv, getfenv = setmetatable, setfenv, getfenv

local open, remove, rename, getenv, time =

	io.open, os.remove, os.rename, os.getenv, os.time

local sectionfname, langs, locale

module "loona"

_VERSION = 2

_REVISION = 0

out = tek.web.out

setheader = tek.web.setheader

cgi = tek.cgi

session = cgi.session

request = cgi.request

args = request.args

posix = tek.posix

encodeform = cgi.encodeform

loadhtml = tek.web.include.load

source = tek.source

domarkup = tek.web.markup.main

expire = tek.util.expire

local function checkprofilename(c)

	assert(c:match("^%w+$") and c ~= "current", loc("INVALID_NAME"))

	return c

end

local function checksectionname(s)

	s = s or "main"

	assert(s:match("^[%w_]*%w+[%w_]*$"), loc("INVALID_NAME"))

	return s

end

local function deletedir(dst)

	for e in tek.util.readdir(dst) do

		local success, msg = remove(dst .. "/" .. e)

		assert(success, msg and "Error removing entry in profile" .. msg)

	end

	return remove(dst)

end

local function copyprofile(contentdir, lang, srcprofile, newprofile)

	local src = contentdir .. "/" .. srcprofile .. "_" .. lang

	assert(posix.stat(src, "mode") == "directory", "Not a directory : " .. src)

	local dst = contentdir .. "/" .. newprofile .. "_" .. lang

	local success, msg = posix.mkdir(dst)

	assert(success, msg and 

		"Error creating profile directory " .. dst .. " : " .. msg)

	for e in tek.util.readdir(src) do

		local ext = e:match("^[^.].*%.([^.]*)$")

		if ext ~= "LOCK" then

			local f = src .. "/" .. e

			if posix.stat(f, "mode") == "file" then

				success, msg = tek.copyfile(f, dst .. "/" .. e)

				assert(success, msg and 

					"Error copying file : " .. f .. " : " .. msg)

			end

		end

	end

end

local function publishprofile(contentdir, lang, profile)

	local oldpath = profile .. "_" .. lang

	local newpath = contentdir .. "/current_" .. lang

	local success, msg = posix.symlink(oldpath, newpath .. ".temp")

	assert(success, msg and 

		"Cannot create symlink " .. newpath .. " : " .. msg)

	success, msg = rename(newpath .. ".temp", newpath)

	assert(success, msg and 

		"Cannot overwrite symlink " .. newpath .. " : " .. msg)

end

local function lookup(tab, key, value)

	if tab then

		for i, v in ipairs(tab) do

			if v[key] == value then

				return i

			end

		end

	end

end

local function processsections(s)

	s = s or config.sections

	for _, e in ipairs(s) do

		if e.subs then

			processsections(e.subs)

		end

		e.notvalid = (not secure and e.secure) or 

			(not authuser and e.secret) or nil

		e.notvisible = e.notvalid or not authuser and e.hidden or nil

		s[e.name] = e

	end

end

--	decompose section path into a stack of sections, returning only up to

--	the last valid element in the path. additionally returns the table of

--	the last section path element (or the default section)

local function getsection(config, section, authuser, path, default)

	local tab = { { entries = config.sections, name = default } }

	local sections = config.sections

	local sectionpath

	(path or default):gsub("(%w+)/?", function(a)

		if sections then

			local i = lookup(sections, "name", a)

			if i and (authuser or not sections[i].secret) and

				(not sections[i].secure or secure) then

				sectionpath = sections[i]

				tab[#tab].name = a

				sections = sections[i].subs

				if sections then

					table.insert(tab, { entries = sections })

				end

			else

				sections = nil -- stop.

			end

		end

	end)

	if not section and not sectionpath then

		sectionpath = config.sections[lookup(config.sections, "name", default)]

		if sectionpath then

			table.insert(tab, { entries = sectionpath.subs })

		end

	end

	return tab, sectionpath

end

local function getpath(sections, delimiter)

	local t = { }

	for _, menu in ipairs(sections) do

		if menu.name then

			table.insert(t, menu.name)

		end

	end

	return table.concat(t, delimiter or "/")

end

--	descending into the sections table alongside the current path,

--	return the filename to include as the sideborder, defaulting to

--	its parent value, or the default specified

local function getsidefile(sections, path, ext, default)

	local val

	local fname = ""

	for _, menu in ipairs(sections) do

		if lookup(menu.entries, "name", menu.name) then

			fname = fname .. menu.name

			local fn = fname .. ext

			if posix.stat(path .. "/" .. fn, "mode") == "file" then

				val = fn

			end

			fname = fname .. "_"

		end

	end

	return val or default

end

local function deletenode(dir, fname)

	local fullname = dir .. "/" .. fname

	local success, msg = remove(fullname)

	if success then

		local pat = "^" .. 

			fname:gsub("%^%$%(%)%%%.%[%]%*%+%-%?", "%%%1") .. "%..*$"

		for e in tek.util.readdir(dir) do

			if e:match(pat) then

				remove(dir .. "/" .. e)

			end

		end

	end

	return success, msg

end

--	add element to path

local function addtopath(tab, path, set)

	local stop

	path:gsub("(%w+)/?", function(a)

		if not stop and tab then

			local i = lookup(tab, "name", a)

			if i then

				if not tab[i].subs then

					tab[i].subs = {}

				end

				tab = tab[i].subs

			else

				table.insert(tab, set)

				stop = true

			end

		end

	end)

end

--	overwrite element in path

local function overwritepath(tab, path, set)

	local stop, parent

	path:gsub("(%w+)/?", function(a)

		if not stop and tab then

			local i = lookup(tab, "name", a)

			if i then

				if tab[i].subs then

					parent = tab[i]

					tab = tab[i].subs

				else

					if not set then

						table.remove(tab, i)

						if #tab == 0 and parent then

							parent.subs = nil

						end

					else

						tab[i] = set

					end

					stop = true

				end

			end

		end

	end)

end

-------------------------------------------------------------------------------

--	Return locale string

function loc(s)

	if not locale then

		for _, l in ipairs(langs) do

			locale = source(config.localedir .. "/" .. l)

			if locale then

				break

			end		

		end

	end

	return locale and locale[s] or 'nonlocalized message: "' .. s .. '"'

end

--	Find element in path

function checkpath(tab, path)

	local res, idx

	path:gsub("(%w+)/?", function(a)

		if tab then

			local i = lookup(tab, "name", a)

			if i then

				res, idx = tab, i

				tab = tab[i].subs

			else

				res, idx = nil, nil

			end

		end

	end)

	return res, idx

end

--	Run a site function snippet, with full error recovery

--	(also recovers from errors in error handling function)

function dosnippet(config, func, errfunc, showdetail)

	local ret = { tek.catch(func) }

	if ret[1] == 0 or (errfunc and tek.catch(errfunc) == 0) then

		return unpack(ret)

	end

	out("<h2>Error</h2>")

	out("<h3>" .. cgi.encodeform(ret[2]) .. "</h3>")

	if showdetail or config.debug == true then

		if type(ret[3]) == "string" then

			out("<p>" .. cgi.encodeform(ret[3]) .. "</p>")

		end

		if ret[4] and config.debug == true then

			out("<pre>" .. cgi.encodeform(ret[4]) .. "</pre>")

		end

	end

end	

function lockfile(newfile)

	return not session and true or 

		posix.symlink(session.filename, newfile .. ".LOCK")

end

function unlockfile(dstfile)

	return not session and true or remove(dstfile .. ".LOCK")

end

function savenode(dir, fname, content)

	fname = dir .. "/" .. fname

	local f, msg = open(fname, "wb")

	assert(f, msg and 

		"Could not open file " .. fname .. " for writing : " .. msg)

	f:write(content or "")

	f:close()

end

function include(fname, ...)

	assert(not fname:match("%W"), loc("INVALID_NAME") .. " : " .. fname)

	local fname2 = config.extdir .. "/" .. fname .. ".lua"

	local f, msg = open(fname2)

	assert(f, msg)

	local parsed, msg = loadhtml(f, "loona.out", fname2)

	assert(parsed, msg and "Syntax error : " .. msg)

 	local fenv = {

 		arg = arg,

 		loona = {

 			out = out,

 			setheader = setheader,

			hidden = hidden,

			alink = alink,

			elink = elink,

			href = href,

			checkpath = checkpath,

			authuser = authuser,

			document = document,

			contentdir = contentdir,

			profile = profile,

			pubprofile = pubprofile,

			lang = lang,

			secure = secure,

			config = config,

			session = session,

			sectionpath = sectionpath,

		}

	}

 	setmetatable(fenv, { __index = boxed_G }) -- boxed global environment

	setfenv(parsed, fenv)

	return parsed()

end

function href(section, ...)

	local target = cgi.document.Name

	target = section and target .. "/" .. section or target

	if session or args.profile and args.profile ~= pubprofile then

		return tek.web.gethref(target, "lang", "profile", "session",

			unpack(arg))

	end

	return tek.web.gethref(target, "lang", unpack(arg))

end

function link(section, text, ...) -- normal link

	return '<a href="' .. href(section, unpack(arg)) .. '">' ..

		(text or section) .. '</a>'

end

function alink(section, text, ...) -- active link

	return '<a class="active" href="' .. href(section, unpack(arg)) ..

		'">' .. (text or section) .. '</a>'

end

function elink(target, text) -- external link

	return '<a href="' .. target .. 

		'" onclick="void(window.open(this.href, \'\', \'\')); return false;">'

		.. (text or target) .. '</a>'

end

function hidden(name, value)

	return not value and "" or 

		'<input type="hidden" name="' .. name .. '" value="' .. value .. '" />'

end

function getprofiles(contentdir, lang)

	local t = { }

	for f in tek.util.readdir(contentdir) do

		if posix.lstat(contentdir .. "/" .. f, "mode") == "directory" then

			local e = f:match("^(%w+)_" .. lang .. "$")

 			if e then

	 			t[e] = e

 	 		end

		end

	end

	return t

end

-- Init

local function init()

	-- get list of languages, in order of preference

	langs = { args.lang and args.lang:match("^%w+$") }

	if config.browserlang == true then

		local s = getenv("HTTP_ACCEPT_LANGUAGE")

		while s do

			local l, r = s:match("^([%w.=]+)[,;](.*)$")

			l = l or s

			s = r

			if l:match("^%w+$") then

				table.insert(langs, l)

			end

		end

	end

	table.insert(langs, config.deflang)

	-- get list of possible profiles

	local profiles = { }

	for e in tek.util.readdir(config.contentdir) do

		profiles[e] = e

	end

	-- get pubprofile

	for _, lang in ipairs(langs) do

		local p = posix.readlink(config.contentdir .. "/current_" .. lang)

		p = p and p:match("^(%w+)_" .. lang .. "$")

		if p then

			pubprofile = p

			break

		end

	end

	-- get profile

	local checkprofile = authuser and args.profile or pubprofile or "default"

	for _, l in ipairs(langs) do

		if profiles[checkprofile .. "_" .. l] then

			profile = checkprofile

			lang = l

			break

		end

	end

	assert(lang, "No content for the default language")

	-- write back language and profile into args

	args.lang = lang ~= config.deflang and lang or nil

	args.profile = profile

	-- determine content directory pathname and section filename

	contentdir = config.contentdir .. "/" .. profile .. "_" .. lang

	sectionfname = contentdir .. "/.sections"

	-- load sections

	config.sections = source(sectionfname)

	-- index sections, determine visibility

	processsections(config.sections)

	-- decompose section path, produce a stack of sections

	submenus, section = getsection(config, section, authuser, 

		cgi.document.VirtualPath or "", not authuser and config.defname)

	-- handle redirects if not logged on

	if not authuser and section and section.redirect then

		submenus, section = getsection(config, section, authuser, 

			section.redirect, not authuser and config.defname)

	end

	-- section path and document name (refined)

	sectionpath = getpath(submenus)

end

--	Handle state modifications (creating/saving/deleting, profile management)

local function handlestate()

	if args.editkey == "main" then

		--

		--	in main editable section:

		--

		local reload = false

		if args.actioncreate then

			--

			--	create new node

			--

			local editname = args.editname:lower()

			assert(not editname:match("%W"), loc("INVALID_NAME"))

			if not (section and lookup(section.subs or section, "name", editname)) then

				local newpath = (sectionpath and (sectionpath .. "/")) .. editname

				addtopath(config.sections, newpath, { name = editname,

					label = args.editlabel ~= "" and args.editlabel or nil,

					title = args.edittitle ~= "" and args.edittitle or nil,

					creator = authuser,

					creationdate = time(),

				})

				reload = true

			end

		elseif args.actionsave then

			--

			--	save node

			--

			section.revisiondate = time()

			section.revisioner = authuser

			reload = true

		elseif args.actiondelete then

			--

			--	delete node

			--

			if not args.actionconfirm then

				useralert = { text = loc("ALERT_DELETE_NODE"), confirm =

					'<input type="submit" name="actiondelete" value="' ..

					loc("DELETE") .. '" /> ' ..

					hidden("actionconfirm", "true") }

			else

				deletenode(contentdir, sectionpath:gsub("/", "_"))

				overwritepath(config.sections, sectionpath, nil)

				reload = true

			end

		elseif args.actionsaveprops then

			--

			--	save properties

			--

			section.hidden = args.editvisibility and true

			section.secret = args.editsecrecy and true

			section.secure = args.editsecure and true

			section.label = args.editlabel ~= "" and args.editlabel or nil

			section.title = args.edittitle ~= "" and args.edittitle or nil

			section.redirect = args.editredirect ~= "" and args.editredirect or nil

			reload = true

		elseif args.actionup then

			--

			--	move node up

			--

			local t, i = checkpath(config.sections, sectionpath)

			if t and i > 1 then

				local item = table.remove(t, i)

				table.insert(t, i - 1, item)

				reload = true

			end

		elseif args.actiondown then

			--

			--	move node down

			--

			local t, i = checkpath(config.sections, sectionpath)

			if t and i < #t then

				local item = table.remove(t, i)

				table.insert(t, i + 1, item)

				reload = true

			end

		elseif args.actioncreateprofile and args.createprofile then

			--

			--	create profile

			--

			local c = checkprofilename(args.createprofile:lower())

			if c == profile then

				useralert = { text = loc("ALERT_CANNOT_COPY_PROFILE_TO_SELF") }

			else

				local profiles = getprofiles(config.contentdir, lang)

				if profiles[c] and not args.actionconfirm then

					useralert = { text = c == pubprofile and 

							loc("ALERT_OVERWRITE_PUBLISHED_PROFILE") or

							loc("ALERT_OVERWRITE_EXISTING_PROFILE"),

						confirm =

						'<input type="submit" name="actioncreateprofile" value="' .. loc("OVERWRITE") .. '" /> ' ..

						hidden("actionconfirm", "true") .. hidden("createprofile", c) }

				else

					if profiles[c] then

						deletedir(config.contentdir .. "/" .. c .. "_" .. lang)

					end

					copyprofile(config.contentdir, lang, profile, c)

				end

			end

		elseif args.actiondeleteprofile and args.deleteprofile then

			--

			--	delete profile

			--

			local c = checkprofilename(args.deleteprofile:lower())

			assert(c ~= pubprofile, loc("CANNOT_DELETE_PUBLISHED_PROFILE"))

			if args.actionconfirm then

				deletedir(config.contentdir .. "/" .. c .. "_" .. lang)

				profile = nil

				args.profile = nil

				init()	-- for getting new sectionfname etc.

				reload = true

			else

				useralert = { text = loc("ALERT_DELETE_PROFILE"), confirm = 

					'<input type="submit" name="actiondeleteprofile" value="' .. loc("DELETE") .. '" /> ' ..

					hidden("actionconfirm", "true") ..

					hidden("deleteprofile", c) }

			end

		elseif args.actionchangeprofile and args.changeprofile then

			--

			--	change profile

			--

			local c = checkprofilename(args.changeprofile:lower())

			profile = c

			args.profile = c

			reload = true

		elseif args.actionpublishprofile and args.publishprofile then

			--

			--	publish profile

			--

			local c = checkprofilename(args.publishprofile:lower())

			if c ~= _publicprofile then

				if args.actionconfirm then

					publishprofile(config.contentdir, lang, c)

					reload = true

				else

					useralert = { text = loc("ALERT_PUBLISH_PROFILE"), confirm = 

						'<input type="submit" name="actionpublishprofile" value="' .. loc("PUBLISH") .. '" /> ' ..

						hidden("actionconfirm", "true") ..

						hidden("publishprofile", c) }

				end					

			end					

		end

		if reload then

			--

			--	write sections, reload

			--

			local tempname = sectionfname .. ".temp"

			local f, msg = open(tempname, "wb")

			assert(f, msg and "Error opening section file for writing : " .. msg)

			tek.dump(config.sections, function(...)

				f:write(unpack(arg))

			end)

			f:close()

			local success, msg = rename(tempname, sectionfname)

			assert(success, msg and "Error renaming section file : " .. msg)

			init()

		end

	elseif args.editkey and checksectionname(args.editkey) then

		if args.actiondelete then

			--

			--	delete node in secondary editable section:

			--

			deletenode(contentdir, sectionpath:gsub("/", "_") .. "." .. args.editkey)

		end

	end

end

--	load configuration

config = source("../etc/config.lua") or { }

config.title = config.title or "Loona CMS"

config.localedir = posix.abspath(config.localedir or "../locale")

config.contentdir = posix.abspath(config.contentdir or "../content")

config.sessiondir = posix.abspath(config.sessiondir or "../var/sessions")

config.extdir = posix.abspath(config.extdir or "../extensions")

config.passwdfile = posix.abspath(config.passwdfile or "../etc/passwd.lua")

config.sessionmaxage = config.sessionmaxage or 600

config.defname = config.defname or "home"

config.deflang = config.deflang or "en"

config.secureport = config.secureport or 443

--	manage login and establish session

session.init(config.sessiondir, args.session, config.sessionmaxage)

if args.login then

	if args.login == "false" then

		session.delete()

		session = nil

	elseif args.password then

		local pwddb = source(config.passwdfile)

		local pwdentry = pwddb[args.login]

		if pwdentry and pwdentry.password == args.password then

			session.data.authuser = pwdentry.username

			session.data.id = session.id

		end

	end

end

if not (session and session.data.authuser) then

	session = nil

	args.session = nil

end

authuser = session and session.data.authuser

secure = cgi.request.Port == config.secureport

-- get lang, locale, profile, section

init()

-- handle state modifications

if authuser then

	handlestate()

end

-- current document

document = cgi.document.Name

document = sectionpath and document .. "/" .. sectionpath

-- get content filename from section path

local fname = sectionpath:gsub("/", "_")

-- add links for creating new nodes

if authuser then

	for _, s in ipairs(submenus) do

		table.insert(s.entries, { name = "new", label = "[" .. loc("NEW") .. "]", action = "actionnew=true" })

	end

	if submenus[#submenus].name then

		table.insert(submenus, { name = "new", entries = { [1] = { name = "new", label = "[" .. loc("NEW") .. "]", action = "actionnew=true" }}})

	end

end

--	create section function

local func, msg = loadhtml(open("loona/editable.lua"),

	"tek.web.out", "loona/editable.lua")

assert(func, msg and "Syntax error : " .. msg)

local editable = func()

function body(name)

	name = checksectionname(name)

	if name == "main" then

		dosnippet(config, editable("main", contentdir, fname, fname))

	else

		local ext = "." .. name

		dosnippet(config, editable(name, contentdir,

			getsidefile(submenus, contentdir, ext), fname .. ext))

	end

end

--	write back session state

if session then

	session.save()

end

-- do

-- 	local f = open("/tmp/foo", "wb")

-- 	tek.dump(config.sections, function(s)

-- 		f:write(s)

-- 	end)

-- end