--

--	loona - tiny CMS

--	Written by Timm S. Mueller <tmueller at neoscientists.org>

--	See copyright notice in COPYRIGHT

--

require "tek"

require "tek.cgi"

require "tek.cgi.request"

require "tek.cgi.request.args"

require "tek.cgi.header"

require "tek.cgi.session"

require "tek.posix"

require "tek.web"

require "tek.web.markup"

require "tek.util"

local boxed_G = { 

	string = string, table = table,

	assert = assert, collectgarbage = collectgarbage, dofile = dofile,

	error = error, getfenv = getfenv, getmetatable = getmetatable,

	ipairs = ipairs, load = load, loadfile = loadfile, loadstring = loadstring,

	next = next, pairs = pairs, pcall = pcall, print = print,

	rawequal = rawequal, rawget = rawget, rawset = rawset, require = require,

	select = select, setfenv = setfenv, setmetatable = setmetatable,

	tonumber = tonumber, tostring = tostring, type = type, unpack = unpack,

	xpcall = xpcall

}

local tek, table, string, assert, unpack, ipairs, pairs, type, require =

	tek, table, string, assert, unpack, ipairs, pairs, type, require

local setmetatable, setfenv, getfenv = setmetatable, setfenv, getfenv

local open, remove, rename, getenv, time =

	io.open, os.remove, os.rename, os.getenv, os.time

local sectionfname, langs, locale

module "loona"

_VERSION = 2

_REVISION = 0

out = tek.web.out

setheader = tek.web.setheader

cgi = tek.cgi

session = cgi.session

request = cgi.request

args = request.args

posix = tek.posix

encodeform = cgi.encodeform

loadhtml = tek.web.include.load

source = tek.source

domarkup = tek.web.markup.main

expire = tek.util.expire

local function dbmsg(msg, detail)

	return msg and msg .. 

		(detail and (config.debug == true and (" : " .. detail)) or "")

end

local function checkprofilename(c)

	assert(c:match("^%w+$") and c ~= "current", dbmsg(loc("INVALID_NAME"), c))

	return c

end

local function checksectionname(s)

	s = s or "main"

	assert(s:match("^[%w_]*%w+[%w_]*$"), dbmsg(loc("INVALID_NAME"), s))

	return s

end

local function deletedir(dst)

	for e in tek.util.readdir(dst) do

		local success, msg = remove(dst .. "/" .. e)

		assert(success, dbmsg("Error removing entry in profile", msg))

	end

	return remove(dst)

end

local function copyprofile(contentdir, lang, srcprofile, newprofile)

	local src = contentdir .. "/" .. srcprofile .. "_" .. lang

	assert(posix.stat(src, "mode") == "directory",

		dbmsg("Not a directory", src))

	local dst = contentdir .. "/" .. newprofile .. "_" .. lang

	local success, msg = posix.mkdir(dst)

	assert(success, dbmsg("Error creating profile directory", msg))

	for e in tek.util.readdir(src) do

		local ext = e:match("^[^.].*%.([^.]*)$")

		if ext ~= "LOCK" then

			local f = src .. "/" .. e

			if posix.stat(f, "mode") == "file" then

				success, msg = tek.copyfile(f, dst .. "/" .. e)

				assert(success, dbmsg("Error copying file", msg))

			end

		end

	end

end

local function publishprofile(contentdir, lang, profile)

	local newpath = contentdir .. "/current_" .. lang

	local tmppath = newpath .. "." .. session.sessionname

	local success, msg = posix.symlink(profile .. "_" .. lang, tmppath)

	assert(success, dbmsg("Cannot create symlink", msg))

	success, msg = rename(tmppath, newpath)

	assert(success, dbmsg("Cannot put symlink in place", msg))

end

local function lookupname(tab, val)

	if tab then

		for i, v in ipairs(tab) do

			if v.name == val then

				return i

			end

		end

	end

end

--	Index sections, determine accessibility and visibility in menu

local function indexsections(s)

	s = s or config.sections

	for _, e in ipairs(s) do

		if e.subs then

			indexsections(e.subs)

		end

		e.notvalid = (not secure and e.secure) or 

			(not authuser and e.secret) or nil

		e.notvisible = e.notvalid or not authuser and e.hidden or nil

		s[e.name] = e

	end

end

--	Decompose section path into a stack of sections, returning only up to

--	the last valid element in the path. additionally returns the table of

--	the last section path element (or the default section)

local function getsection(config, section, authuser, path, default)

	local tab = { { entries = config.sections, name = default } }

	local sections = config.sections

	local sectionpath

	(path or default):gsub("(%w+)/?", function(a)

		if sections then

			local s = sections[a]

			if s and not s.notvalid then

				sectionpath = s

				tab[#tab].name = a

				sections = s.subs

				if sections then

					table.insert(tab, { entries = sections })

				end

			else

				sections = nil -- stop.

			end

		end

	end)

	if not section and not sectionpath then

		sectionpath = config.sections[default]

		if sectionpath then

			table.insert(tab, { entries = sectionpath.subs })

		end

	end

	return tab, sectionpath

end

local function getpath(sections, delimiter)

	local t = { }

	for _, menu in ipairs(sections) do

		if menu.name then

			table.insert(t, menu.name)

		end

	end

	return table.concat(t, delimiter or "/")

end

--	Descending into the sections table alongside the current path,

--	return the filename to include, defaulting to its parent value

--	(or the default specified)

local function getsectionfile(sections, path, ext, default)

	local t, val = { }

	for _, menu in ipairs(sections) do

		if menu.entries and menu.entries[menu.name] then

			table.insert(t, menu.name)

			local fn = table.concat(t, "_") .. ext

			if posix.stat(path .. "/" .. fn, "mode") == "file" then

				val = fn

			end

		end

	end

	return val or default

end

local function deletenode(dir, fname)

	local fullname = dir .. "/" .. fname

	local success, msg = remove(fullname)

	if success then

		local pat = "^" .. 

			fname:gsub("%^%$%(%)%%%.%[%]%*%+%-%?", "%%%1") .. "%..*$"

		for e in tek.util.readdir(dir) do

			if e:match(pat) then

				remove(dir .. "/" .. e)

			end

		end

	end

	return success, msg

end

--	Add element to path

local function addtopath(tab, path, e)

	path:gsub("(%w+)/?", function(a)

		if tab then

			local s = tab[a]

			if s then

				if not s.subs then

					s.subs = { }

				end

				tab = s.subs

			else

				table.insert(tab, e)

				tab[a] = e

 				tab = nil -- stop

			end

		end

	end)

end

--	Remove element from path

local function rmpath(tab, path)

	local parent

	path:gsub("(%w+)/?", function(a)

		if tab then

			local idx = lookupname(tab, a)

			if idx then

				if tab[idx].subs then

					parent = tab[idx]

					tab = tab[idx].subs

				else

					table.remove(tab, idx)

					if #tab == 0 and parent then

						parent.subs = nil

					end

					tab = nil

				end

			end

		end

	end)

end

-------------------------------------------------------------------------------

--	Produce page title

function title()

	return section and (section.title or section.label or section.name) or ""

end

--	Return locale string

function loc(s)

	if not locale then

		for _, l in ipairs(langs) do

			locale = source(config.localedir .. "/" .. l)

			if locale then

				break

			end		

		end

	end

	return locale and encodeform(locale[s]) or 

		'nonlocalized message: "' .. s .. '"'

end

--	Find element in path

function checkpath(tab, path)

	local res, idx

	path:gsub("(%w+)/?", function(a)

		if tab then

			local i = lookupname(tab, a)

			if i then

				res, idx = tab, i

				tab = tab[i].subs

			else

				res, idx = nil, nil

			end

		end

	end)

	return res, idx

end

--	Run a site function snippet, with full error recovery

--	(also recovers from errors in error handling function)

function dosnippet(config, func, errfunc)

	local ret = { tek.catch(func) }

	if ret[1] == 0 or (errfunc and tek.catch(errfunc) == 0) then

		return unpack(ret)

	end

	out("<h2>Error</h2>")

	out("<h3>" .. (ret[2] or "") .. "</h3>")

	if config.debug == true then

		if type(ret[3]) == "string" then

			out("<p>" .. ret[3] .. "</p>")

		end

		if ret[4] and config.debug == true then

			out("<pre>" .. ret[4] .. "</pre>")

		end

	end

end	

function lockfile(newfile)

	return not session and true or 

		posix.symlink(session.filename, newfile .. ".LOCK")

end

function unlockfile(dstfile)

	return not session and true or remove(dstfile .. ".LOCK")

end

function savenode(dir, fname, content)

	fname = dir .. "/" .. fname

	local f, msg = open(fname, "wb")

	assert(f, dbmsg("Could not open file for writing", msg))

	f:write(content or "")

	f:close()

end

--	Run extension in a controlled environment

function include(fname, ...)

	assert(not fname:match("%W"), dbmsg(loc("INVALID_NAME"), fname))

	local fname2 = config.extdir .. "/" .. fname .. ".lua"

	local f, msg = open(fname2)

	assert(f, dbmsg("Cannot open file", msg))

	local parsed, msg = loadhtml(f, "loona.out", fname2)

	assert(parsed, dbmsg("Syntax error", msg))

 	local fenv = {

 		arg = arg,

 		loona = {

 			out = out,

 			setheader = setheader,

			hidden = hidden,

			link = link,

			elink = elink,

			href = href,

			checkpath = checkpath,

			authuser = authuser,

			document = document,

			contentdir = contentdir,

			profile = profile,

			pubprofile = pubprofile,

			lang = lang,

			secure = secure,

			config = config,

			session = session,

			sectionpath = sectionpath,

		}

	}

 	setmetatable(fenv, { __index = boxed_G }) -- boxed global environment

	setfenv(parsed, fenv)

	return parsed()

end

function href(section, ...)

	local target = cgi.document.Name

	target = section and target .. "/" .. section or target

	if session or args.profile and args.profile ~= pubprofile then

		return tek.web.gethref(target, "lang", "profile", "session",

			unpack(arg))

	end

	return tek.web.gethref(target, "lang", unpack(arg))

end

function link(section, text, ...) -- normal link

	return '<a href="' .. href(section, unpack(arg)) .. '">' ..

		(text or section) .. '</a>'

end

function uilink(section, text, ...) -- active link

	return '<a class="loonaUILink" href="' .. href(section, unpack(arg)) ..

		'">' .. (text or section) .. '</a>'

end

function elink(target, text) -- external link

	return '<a class="loonaExtLink" href="' .. target .. 

		'" onclick="void(window.open(this.href, \'\', \'\')); return false;">'

		.. (text or target) .. '</a>'

end

function hidden(name, value)

	return not value and "" or 

		'<input type="hidden" name="' .. name .. '" value="' .. value .. '" />'

end

function getprofiles(contentdir, lang)

	local t = { }

	for f in tek.util.readdir(contentdir) do

		if posix.lstat(contentdir .. "/" .. f, "mode") == "directory" then

			local e = f:match("^(%w+)_" .. lang .. "$")

 			if e then

	 			t[e] = e

 	 		end

		end

	end

	return t

end

-- Init

local function init()

	-- get list of languages, in order of preference

	langs = { args.lang and args.lang:match("^%w+$") }

	if config.browserlang == true then

		local s = getenv("HTTP_ACCEPT_LANGUAGE")

		while s do

			local l, r = s:match("^([%w.=]+)[,;](.*)$")

			l = l or s

			s = r

			if l:match("^%w+$") then

				table.insert(langs, l)

			end

		end

	end

	table.insert(langs, config.deflang)

	-- get list of possible profiles

	local profiles = { }

	for e in tek.util.readdir(config.contentdir) do

		profiles[e] = e

	end

	-- get pubprofile

	for _, lang in ipairs(langs) do

		local p = posix.readlink(config.contentdir .. "/current_" .. lang)

		p = p and p:match("^(%w+)_" .. lang .. "$")

		if p then

			pubprofile = p

			break

		end

	end

	-- get profile

	local checkprofile = authuser and args.profile or pubprofile or "default"

	for _, l in ipairs(langs) do

		if profiles[checkprofile .. "_" .. l] then

			profile = checkprofile

			lang = l

			break

		end

	end

	assert(profile and lang, "Invalid profile or language")

	-- write back language and profile into args

	args.lang = lang ~= config.deflang and lang or nil

	args.profile = profile

	-- determine content directory pathname and section filename

	contentdir = config.contentdir .. "/" .. profile .. "_" .. lang

	sectionfname = contentdir .. "/.sections"

	-- load sections

	config.sections = source(sectionfname)

	-- index sections, determine visibility in menu

	indexsections(config.sections)

	-- decompose section path, produce a stack of sections

	submenus, section = getsection(config, section, authuser, 

		cgi.document.VirtualPath or "", not authuser and config.defname)

	-- handle redirects if not logged on

	if not authuser and section and section.redirect then

		submenus, section = getsection(config, section, authuser, 

			section.redirect, not authuser and config.defname)

	end

	-- section path and document name (refined)

	sectionpath = getpath(submenus)

end

--	Handle state modifications (create/save/delete, profile management)

local function handlestate()

	if args.editkey == "main" then

		-- In main editable section:

		local save

		if args.actioncreate then

			-- Create new node

			local editname = args.editname:lower()

			assert(not editname:match("%W"),

				dbmsg(loc("INVALID_NAME"), editname))

			if not (section and (section.subs or section)[editname]) then

				local newpath = 

					(sectionpath and (sectionpath .. "/")) .. editname

				addtopath(config.sections, newpath, { name = editname,

					label = args.editlabel ~= "" and args.editlabel or nil,

					title = args.edittitle ~= "" and args.edittitle or nil,

					creator = authuser,

					creationdate = time() })

				save = true

			end

		elseif args.actionsave then

			-- Save node

			section.revisiondate = time()

			section.revisioner = authuser

			save = true

		elseif args.actiondelete then

			-- Delete node

			if not args.actionconfirm then

				useralert = {

					text = loc("ALERT_DELETE_NODE"),

					confirm =

						'<input type="submit" name="actiondelete" value="' .. 

						loc("DELETE") .. '" /> ' ..

						hidden("actionconfirm", "true")

				}

			else

				deletenode(contentdir, sectionpath:gsub("/", "_"))

				rmpath(config.sections, sectionpath)

				save = true

			end

		elseif args.actionsaveprops then

			-- Save properties

			section.hidden = args.editvisibility and true

			section.secret = args.editsecrecy and true

			section.secure = args.editsecure and true

			section.label = args.editlabel ~= "" and args.editlabel or nil

			section.title = args.edittitle ~= "" and args.edittitle or nil

			section.redirect =

				args.editredirect ~= "" and args.editredirect or nil

			save = true

		elseif args.actionup then

			-- Move node up

			local t, i = checkpath(config.sections, sectionpath)

			if t and i > 1 then

				local item = table.remove(t, i)

				table.insert(t, i - 1, item)

				save = true

			end

		elseif args.actiondown then

			-- Move node down

			local t, i = checkpath(config.sections, sectionpath)

			if t and i < #t then

				local item = table.remove(t, i)

				table.insert(t, i + 1, item)

				save = true

			end

		elseif args.actioncreateprofile and args.createprofile then

			-- Create profile

			local c = checkprofilename(args.createprofile:lower())

			if c == profile then

				useralert = { text = loc("ALERT_CANNOT_COPY_PROFILE_TO_SELF") }

			else

				local profiles = getprofiles(config.contentdir, lang)

				if profiles[c] and not args.actionconfirm then

					useralert = {

						text = c == pubprofile and 

							loc("ALERT_OVERWRITE_PUBLISHED_PROFILE") or

							loc("ALERT_OVERWRITE_EXISTING_PROFILE"),

						confirm =

							'<input type="submit" name="actioncreateprofile" value="' .. 

							loc("OVERWRITE") .. '" /> ' ..

							hidden("actionconfirm", "true") .. 

							hidden("createprofile", c)

					}

				else

					if profiles[c] then

						deletedir(config.contentdir .. "/" .. c .. "_" .. lang)

					end

					copyprofile(config.contentdir, lang, profile, c)

				end

			end

		elseif args.actiondeleteprofile and args.deleteprofile then

			-- Delete profile

			local c = checkprofilename(args.deleteprofile:lower())

			assert(c ~= pubprofile,

				dbmsg(loc("CANNOT_DELETE_PUBLISHED_PROFILE"), c))

			if args.actionconfirm then

				deletedir(config.contentdir .. "/" .. c .. "_" .. lang)

				profile = nil

				args.profile = nil

				init() -- get new sectionfname etc.

				save = true

			else

				useralert = { 

					text = loc("ALERT_DELETE_PROFILE"),

					confirm = 

						'<input type="submit" name="actiondeleteprofile" value="' .. 

						loc("DELETE") .. '" /> ' ..

						hidden("actionconfirm", "true") ..

						hidden("deleteprofile", c)

				}

			end

		elseif args.actionchangeprofile and args.changeprofile then

			-- Change profile

			local c = checkprofilename(args.changeprofile:lower())

			profile = c

			args.profile = c

			save = true

		elseif args.actionpublishprofile and args.publishprofile then

			-- Publish profile

			local c = checkprofilename(args.publishprofile:lower())

			if c ~= _publicprofile then

				if args.actionconfirm then

					publishprofile(config.contentdir, lang, c)

					save = true

				else

					useralert = {

						text = loc("ALERT_PUBLISH_PROFILE"),

						confirm =

							'<input type="submit" name="actionpublishprofile" value="' ..

							loc("PUBLISH") .. '" /> ' ..

							hidden("actionconfirm", "true") ..

							hidden("publishprofile", c)

					}

				end

			end

		end

		if save then

			-- Write sections atomically, reload

			local tempname = sectionfname .. "." .. session.sessionname

			local f, msg = open(tempname, "wb")

			assert(f, dbmsg("Error opening section file for writing", msg))

			tek.dump(config.sections, function(...)

				f:write(unpack(arg))

			end)

			f:close()

			local success, msg = rename(tempname, sectionfname)

			assert(success, dbmsg("Error renaming section file", msg))

			init()

		end

	elseif args.editkey and checksectionname(args.editkey) then

		if args.actiondelete then

			-- Delete node in secondary editable section:

			deletenode(contentdir,

				sectionpath:gsub("/", "_") .. "." .. args.editkey)

		end

	end

end

--	Load configuration

config = source("../etc/config.lua") or { }

config.passwdfile = posix.abspath(config.passwdfile or "../etc/passwd.lua")

config.sessiondir = posix.abspath(config.sessiondir or "../var/sessions")

config.extdir = posix.abspath(config.extdir or "../extensions")

config.contentdir = posix.abspath(config.contentdir or "../content")

config.localedir = posix.abspath(config.localedir or "../locale")

config.defname = config.defname or "home"

config.deflang = config.deflang or "en"

config.sessionmaxage = config.sessionmaxage or 600

config.secureport = config.secureport or 443

--	manage login and establish session

session.init(config.sessiondir, args.session, config.sessionmaxage)

if args.login then

	if args.login == "false" then

		session.delete()

		session = nil

	elseif args.password then

		local pwddb = source(config.passwdfile)

		local pwdentry = pwddb[args.login]

		if pwdentry and pwdentry.password == args.password then

			session.data.authuser = pwdentry.username

			session.data.id = session.id

		end

	end

end

secure = cgi.request.Port == config.secureport

authuser = session and session.data.authuser

if not authuser then

	session = nil

	args.session = nil

end

-- get lang, locale, profile, section

init()

if authuser then

	handlestate()

end

-- current document

document = cgi.document.Name

document = sectionpath and document .. "/" .. sectionpath

-- get content filename from section path

local fname = sectionpath:gsub("/", "_")

-- add links for creating new nodes

if authuser then

	local newent = { name = "new", 

		label = "[" .. loc("NEW") .. "]",

		action = "actionnew=true" }

	for _, s in ipairs(submenus) do

		table.insert(s.entries, newent)

	end

	if submenus[#submenus].name then

		table.insert(submenus, {

			name = "new", 

			entries = { [1] = newent }

		})

	end

end

--	create section function

local func, msg = loadhtml(open("loona/editable.lua"),

	"tek.web.out", "loona/editable.lua")

assert(func, dbmsg("Syntax error", msg))

local editable = func()

function body(name)

	name = checksectionname(name)

	if name == "main" then

		dosnippet(config, editable("main", contentdir, fname, fname))

	else

		local ext = "." .. name

		dosnippet(config, editable(name, contentdir,

			getsectionfile(submenus, contentdir, ext), fname .. ext))

	end

end

--	write back session state

if session then

	session.save()

end

-- do

-- 	local f = open("/tmp/foo", "wb")

-- 	tek.dump(config.sections, function(s)

-- 		f:write(s)

-- 	end)

-- end