//! Markdown rendering + Fan+ image handling for route handlers.

use axum::{
    http::StatusCode,
    response::{IntoResponse, Response},
};

/// Render markdown to HTML, stripping raw HTML events to prevent XSS.
///
/// Strict preset: no images, no raw HTML, dangerous-scheme filtering. Use this
/// for content from non-Fan+ users. Fan+ subscribers get image embeds via
/// [`render_markdown_plus`].
pub(crate) fn render_markdown(input: &str) -> String {
    docengine::render_strict(input)
}

/// Render markdown to HTML with image embeds permitted. Otherwise identical to
/// the strict preset, raw HTML is still stripped, dangerous schemes filtered,
/// links get `nofollow`. Use for Fan+ subscriber content.
pub(crate) fn render_markdown_plus(input: &str) -> String {
    let html = docengine::Renderer::strict()
        .with_strip_images(false)
        .render(input);
    proxy_external_images(&html)
}

/// Rewrite external `<img src="http(s)://…">` in rendered Fan+ HTML to load
/// through the same-origin image proxy (`/img-proxy?u=…`), so the page CSP can
/// stay `img-src 'self'` while still showing embedded external images. Uploaded
/// images are served from same-origin `/uploads/…` (no scheme), so they don't
/// match and aren't proxied. docengine has already attribute-escaped the URL, so
/// `&amp;` in a query string is unescaped back to `&` before percent-encoding.
fn proxy_external_images(html: &str) -> String {
    static IMG_SRC_RE: std::sync::LazyLock<regex_lite::Regex> = std::sync::LazyLock::new(|| {
        regex_lite::Regex::new(r#"(<img\b[^>]*?\bsrc=")(https?://[^"]+)(")"#).unwrap()
    });
    IMG_SRC_RE
        .replace_all(html, |caps: &regex_lite::Captures| {
            let url = caps[2].replace("&amp;", "&");
            format!(
                "{}/img-proxy?u={}{}",
                &caps[1],
                percent_encode_query(&url),
                &caps[3]
            )
        })
        .into_owned()
}

/// RFC 3986 percent-encode a string for use as a URL query value. Keeps the
/// unreserved set (`A-Za-z0-9-_.~`) and escapes everything else, so the proxied
/// URL round-trips intact through axum's query decoder.
fn percent_encode_query(s: &str) -> String {
    use std::fmt::Write as _;
    let mut out = String::with_capacity(s.len());
    for &b in s.as_bytes() {
        match b {
            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
                out.push(b as char);
            }
            _ => {
                let _ = write!(out, "%{b:02X}");
            }
        }
    }
    out
}

/// Render markdown to HTML, resolving `@mentions` to profile links for valid community members.
pub(crate) fn render_markdown_with_mentions(
    input: &str,
    community_slug: &str,
    valid_usernames: &std::collections::HashSet<String>,
    allow_images: bool,
) -> String {
    let template = format!("/p/{community_slug}/u/{{username}}");
    let resolved = docengine::resolve_mentions(input, valid_usernames, &template);
    if allow_images {
        render_markdown_plus(&resolved)
    } else {
        docengine::render_strict(&resolved)
    }
}

/// Reject submissions that contain image embeds. Used to give non-Fan+ users
/// a clear error rather than silently stripping their image at render time.
///
/// Only matches the markdown image syntax `![alt](url)`. Raw HTML `<img>` /
/// `<video>` / `<iframe>` are stripped by all renderers (`strip_raw_html` is
/// true in both `render_strict` and `render_markdown_plus`), so we don't need
/// to reject them here, and rejecting them would surprise users pasting code
/// blocks containing HTML.
#[allow(clippy::result_large_err)]
pub(crate) fn reject_embeds_for_free_user(body: &str) -> Result<(), Response> {
    static EMBED_RE: std::sync::LazyLock<regex_lite::Regex> =
        std::sync::LazyLock::new(|| regex_lite::Regex::new(r"!\[[^\]]*\]\([^\)]+\)").unwrap());
    if EMBED_RE.is_match(body) {
        return Err((
            StatusCode::UNPROCESSABLE_ENTITY,
            "Image embeds are a Fan+ feature.",
        )
            .into_response());
    }
    Ok(())
}

#[cfg(test)]
mod proxy_image_tests {
    use super::{percent_encode_query, proxy_external_images};

    #[test]
    fn external_image_is_routed_through_proxy() {
        let html = r#"<p><img src="https://example.com/a.png" alt="x"></p>"#;
        let out = proxy_external_images(html);
        assert!(
            out.contains(r#"src="/img-proxy?u=https%3A%2F%2Fexample.com%2Fa.png""#),
            "got: {out}"
        );
    }

    #[test]
    fn same_origin_upload_is_not_proxied() {
        let html = r#"<img src="/uploads/abc-123" alt="x">"#;
        assert_eq!(
            proxy_external_images(html),
            html,
            "relative uploads must be left alone"
        );
    }

    #[test]
    fn query_string_ampersands_round_trip() {
        // docengine attribute-escapes `&` to `&amp;`; the proxied value must carry
        // the real `&` (percent-encoded), not the entity.
        let html = r#"<img src="https://x.test/i?w=1&amp;h=2">"#;
        let out = proxy_external_images(html);
        assert!(
            out.contains("u=https%3A%2F%2Fx.test%2Fi%3Fw%3D1%26h%3D2"),
            "got: {out}"
        );
        assert!(
            !out.contains("&amp;h=2"),
            "the entity must not leak into the query"
        );
    }

    #[test]
    fn percent_encode_keeps_unreserved() {
        assert_eq!(percent_encode_query("aZ0-_.~"), "aZ0-_.~");
        assert_eq!(percent_encode_query("a/b?c=d&e"), "a%2Fb%3Fc%3Dd%26e");
    }
}