#include "pch.h"
#include "serverauthentication.h"
#include "limits.h"
#include "cvar.h"
#include "convar.h"
#include "masterserver.h"
#include "serverpresence.h"
#include "hoststate.h"
#include "bansystem.h"
#include "concommand.h"
#include "dedicated.h"
#include "nsprefix.h"
#include "tier0.h"
#include "r2engine.h"
#include "r2client.h"
#include "r2server.h"

#include "httplib.h"

#include <fstream>
#include <filesystem>
#include <thread>

AUTOHOOK_INIT()

const char* AUTHSERVER_VERIFY_STRING = "I am a northstar server!";

// global vars
ServerAuthenticationManager* g_pServerAuthentication;

void ServerAuthenticationManager::StartPlayerAuthServer()
{
	if (m_bRunningPlayerAuthThread)
	{
		spdlog::warn("ServerAuthenticationManager::StartPlayerAuthServer was called while m_bRunningPlayerAuthThread is true");
		return;
	}

	g_pServerPresence->SetAuthPort(Cvar_ns_player_auth_port->GetInt()); // set auth port for presence
	m_bRunningPlayerAuthThread = true;

	// listen is a blocking call so thread this
	std::thread serverThread(
		[this]
		{
			// this is just a super basic way to verify that servers have ports open, masterserver will try to read this before ensuring
			// server is legit
			m_PlayerAuthServer.Get(
				"/verify",
				[](const httplib::Request& request, httplib::Response& response)
				{ response.set_content(AUTHSERVER_VERIFY_STRING, "text/plain"); });

			m_PlayerAuthServer.Post(
				"/authenticate_incoming_player",
				[this](const httplib::Request& request, httplib::Response& response)
				{
					if (!request.has_param("id") || !request.has_param("authToken") || request.body.size() >= R2::PERSISTENCE_MAX_SIZE ||
						!request.has_param("serverAuthToken") ||
						strcmp(
							g_pMasterServerManager->m_sOwnServerAuthToken,
							request.get_param_value("serverAuthToken")
								.c_str()))
					{
						response.set_content("{\"success\":false}", "application/json");
						return;
					}

					RemoteAuthData newAuthData {};
					strncpy_s(newAuthData.uid, sizeof(newAuthData.uid), request.get_param_value("id").c_str(), sizeof(newAuthData.uid) - 1);
					strncpy_s(
						newAuthData.username,
						sizeof(newAuthData.username), request.get_param_value("username").c_str(),
						sizeof(newAuthData.username) - 1);

					newAuthData.pdataSize = request.body.size();
					newAuthData.pdata = new char[newAuthData.pdataSize];
					memcpy(newAuthData.pdata, request.body.c_str(), newAuthData.pdataSize);

					std::lock_guard<std::mutex> guard(m_AuthDataMutex);
					m_RemoteAuthenticationData.insert(std::make_pair(request.get_param_value("authToken"), newAuthData));

					response.set_content("{\"success\":true}", "application/json");
				});

			m_PlayerAuthServer.listen("0.0.0.0", Cvar_ns_player_auth_port->GetInt());
		});

	serverThread.detach();
}

void ServerAuthenticationManager::StopPlayerAuthServer()
{
	if (!m_bRunningPlayerAuthThread)
	{
		spdlog::warn("ServerAuthenticationManager::StopPlayerAuthServer was called while m_bRunningPlayerAuthThread is false");
		return;
	}

	m_bRunningPlayerAuthThread = false;
	m_PlayerAuthServer.stop();
}

void ServerAuthenticationManager::AddPlayerData(R2::CBaseClient* player, const char* pToken) 
{
	PlayerAuthenticationData additionalData;
	additionalData.pdataSize = m_RemoteAuthenticationData[pToken].pdataSize;
	additionalData.usingLocalPdata = player->m_iPersistenceReady == R2::ePersistenceReady::READY_INSECURE;

	m_PlayerAuthenticationData.insert(std::make_pair(player, additionalData));
}

void ServerAuthenticationManager::VerifyPlayerName(R2::CBaseClient* player, char* authToken, char* name)
{
	std::lock_guard<std::mutex> guard(m_AuthDataMutex);

	if (!m_RemoteAuthenticationData.empty() && m_RemoteAuthenticationData.count(std::string(authToken)))
	{
		RemoteAuthData authData = m_RemoteAuthenticationData[authToken];

		bool nameAccepted = (!*authData.username || !strcmp(name, authData.username));

		if (!nameAccepted && g_pMasterServerManager->m_bRequireClientAuth && !CVar_ns_auth_allow_insecure->GetInt())
		{
			// limit name length to 64 characters just in case something changes, this technically shouldn't be needed given the master
			// server gets usernames from origin but we have it just in case
			strncpy_s(name, 64, authData.username, 63);
		}
	}
}

bool ServerAuthenticationManager::AuthenticatePlayer(R2::CBaseClient* player, uint64_t uid, char* authToken)
{
	std::string strUid = std::to_string(uid);
	std::lock_guard<std::mutex> guard(m_AuthDataMutex);

	bool authFail = true;
	if (!m_RemoteAuthenticationData.empty() && m_RemoteAuthenticationData.count(std::string(authToken)))
	{
		// use stored auth data
		RemoteAuthData authData = m_RemoteAuthenticationData[authToken];

		if (!strcmp(strUid.c_str(), authData.uid)) // connecting client's uid is the same as auth's uid
		{
			// copy uuid
			strcpy(player->m_UID, strUid.c_str());

			// if we're resetting let script handle the reset
			if (!m_bForceResetLocalPlayerPersistence || strcmp(authData.uid, R2::g_pLocalPlayerUserID))
			{
				// copy pdata into buffer
				memcpy(player->m_PersistenceBuffer, authData.pdata, authData.pdataSize);
			}

			// set persistent data as ready
			player->m_iPersistenceReady = R2::ePersistenceReady::READY_REMOTE;
			authFail = false;
		}
	}

	if (authFail)
	{
		if (CVar_ns_auth_allow_insecure->GetBool())
		{
			// copy uuid
			strcpy((char*)player + 0xF500, strUid.c_str());

			// set persistent data as ready
			// note: actual persistent data is populated in script with InitPersistentData()
			player->m_iPersistenceReady = R2::ePersistenceReady::READY_INSECURE;
			return true;
		}
		else
			return false;
	}

	return true; // auth successful, client stays on
}

bool ServerAuthenticationManager::RemovePlayerAuthData(R2::CBaseClient* player)
{
	if (!Cvar_ns_erase_auth_info->GetBool()) // keep auth data forever
		return false;

	// hack for special case where we're on a local server, so we erase our own newly created auth data on disconnect
	if (m_bNeedLocalAuthForNewgame && !strcmp(player->m_UID, R2::g_pLocalPlayerUserID))
		return false;

	// we don't have our auth token at this point, so lookup authdata by uid
	for (auto& auth : m_RemoteAuthenticationData)
	{
		if (!strcmp(player->m_UID, auth.second.uid))
		{
			// pretty sure this is fine, since we don't iterate after the erase
			// i think if we iterated after it'd be undefined behaviour tho
			std::lock_guard<std::mutex> guard(m_AuthDataMutex);

			delete[] auth.second.pdata;
			m_RemoteAuthenticationData.erase(auth.first);
			return true;
		}
	}

	return false;
}

void ServerAuthenticationManager::WritePersistentData(R2::CBaseClient* player)
{
	if (player->m_iPersistenceReady == R2::ePersistenceReady::READY_REMOTE)
	{
		g_pMasterServerManager->WritePlayerPersistentData(
			player->m_UID, (const char*)player->m_PersistenceBuffer, m_PlayerAuthenticationData[player].pdataSize);
	}
	else if (CVar_ns_auth_allow_insecure_write->GetBool())
	{
		// todo: write pdata to disk here
	}
}

// auth hooks

// store these in vars so we can use them in CBaseClient::Connect
// this is fine because ptrs won't decay by the time we use this, just don't use it outside of calls from cbaseclient::connectclient
char* pNextPlayerToken;
uint64_t iNextPlayerUid;

AUTOHOOK(CBaseServer__ConnectClient, engine.dll + 0x114430,
void*,, (
	void* server,
	void* a2,
	void* a3,
	uint32_t a4,
	uint32_t a5,
	int32_t a6,
	void* a7,
	void* a8,
	char* serverFilter,
	void* a10,
	char a11,
	void* a12,
	char a13,
	char a14,
	int64_t uid,
	uint32_t a16,
	uint32_t a17))
{
	// auth tokens are sent with serverfilter, can't be accessed from player struct to my knowledge, so have to do this here
	pNextPlayerToken = serverFilter;
	iNextPlayerUid = uid;

	return CBaseServer__ConnectClient(server, a2, a3, a4, a5, a6, a7, a8, serverFilter, a10, a11, a12, a13, a14, uid, a16, a17);
}

AUTOHOOK(CBaseClient__Connect, engine.dll + 0x101740,
bool,, (R2::CBaseClient* self, char* name, __int64 netchan_ptr_arg, char b_fake_player_arg, __int64 a5, char* Buffer, void* a7))
{
	// try changing name before all else
	g_pServerAuthentication->VerifyPlayerName(self, pNextPlayerToken, name);

	// try to auth player, dc if it fails
	// we connect regardless of auth, because returning bad from this function can fuck client state p bad
	bool ret = CBaseClient__Connect(self, name, netchan_ptr_arg, b_fake_player_arg, a5, Buffer, a7);
	if (!ret)
		return ret;

	if (!g_pBanSystem->IsUIDAllowed(iNextPlayerUid))
	{
		R2::CBaseClient__Disconnect(self, 1, "Banned from server");
		return ret;
	}

	if (strlen(name) >= 64) // fix for name overflow bug
		R2::CBaseClient__Disconnect(self, 1, "Invalid name");
	else if (
		!g_pServerAuthentication->AuthenticatePlayer(self, iNextPlayerUid, pNextPlayerToken) &&
		g_pMasterServerManager->m_bRequireClientAuth)
		R2::CBaseClient__Disconnect(self, 1, "Authentication Failed");

	g_pServerAuthentication->AddPlayerData(self, pNextPlayerToken);
	g_pServerLimits->AddPlayer(self);

	return ret;
}

AUTOHOOK(CBaseClient__ActivatePlayer, engine.dll + 0x100F80,
void,, (R2::CBaseClient* self))
{
	// if we're authed, write our persistent data
	// RemovePlayerAuthData returns true if it removed successfully, i.e. on first call only, and we only want to write on >= second call
	// (since this func is called on map loads)
	if (self->m_iPersistenceReady >= R2::ePersistenceReady::READY && !g_pServerAuthentication->RemovePlayerAuthData(self))
	{
		g_pServerAuthentication->m_bForceResetLocalPlayerPersistence = false;
		g_pServerAuthentication->WritePersistentData(self);
		g_pServerPresence->SetPlayerCount(g_pServerAuthentication->m_PlayerAuthenticationData.size());
	}

	CBaseClient__ActivatePlayer(self);
}

AUTOHOOK(_CBaseClient__Disconnect, engine.dll + 0x1012C0,
void,, (R2::CBaseClient* self, uint32_t unknownButAlways1, const char* pReason, ...))
{
	// have to manually format message because can't pass varargs to original func
	char buf[1024];

	va_list va;
	va_start(va, pReason);
	vsprintf(buf, pReason, va);
	va_end(va);

	// this reason is used while connecting to a local server, hacky, but just ignore it
	if (strcmp(pReason, "Connection closing"))
	{
		spdlog::info("Player {} disconnected: \"{}\"", self->m_Name, buf);

		// dcing, write persistent data
		if (g_pServerAuthentication->m_PlayerAuthenticationData[self].needPersistenceWriteOnLeave)
			g_pServerAuthentication->WritePersistentData(self);
		g_pServerAuthentication->RemovePlayerAuthData(self); // won't do anything 99% of the time, but just in case
	}

	if (g_pServerAuthentication->m_PlayerAuthenticationData.count(self))
	{
		g_pServerAuthentication->m_PlayerAuthenticationData.erase(self);
		g_pServerPresence->SetPlayerCount(g_pServerAuthentication->m_PlayerAuthenticationData.size());
	}

	_CBaseClient__Disconnect(self, unknownButAlways1, buf);
}

void ConCommand_ns_resetpersistence(const CCommand& args)
{
	if (*R2::g_pServerState == R2::server_state_t::ss_active)
	{
		spdlog::error("ns_resetpersistence must be entered from the main menu");
		return;
	}

	spdlog::info("resetting persistence on next lobby load...");
	g_pServerAuthentication->m_bForceResetLocalPlayerPersistence = true;
}

ON_DLL_LOAD_RELIESON("engine.dll", ServerAuthentication, (ConCommand, ConVar), (CModule module))
{
	AUTOHOOK_DISPATCH()

	g_pServerAuthentication = new ServerAuthenticationManager;

	g_pServerAuthentication->Cvar_ns_player_auth_port = new ConVar("ns_player_auth_port", "8081", FCVAR_GAMEDLL, "");
	g_pServerAuthentication->Cvar_ns_erase_auth_info =
		new ConVar("ns_erase_auth_info", "1", FCVAR_GAMEDLL, "Whether auth info should be erased from this server on disconnect or crash");
	g_pServerAuthentication->CVar_ns_auth_allow_insecure =
		new ConVar("ns_auth_allow_insecure", "0", FCVAR_GAMEDLL, "Whether this server will allow unauthenicated players to connect");
	g_pServerAuthentication->CVar_ns_auth_allow_insecure_write = new ConVar(
		"ns_auth_allow_insecure_write",
		"0",
		FCVAR_GAMEDLL,
		"Whether the pdata of unauthenticated clients will be written to disk when changed");	

	RegisterConCommand(
		"ns_resetpersistence", ConCommand_ns_resetpersistence, "resets your pdata when you next enter the lobby", FCVAR_NONE);
	
	// patch to disable kicking based on incorrect serverfilter in connectclient, since we repurpose it for use as an auth token
	module.Offset(0x114655).Patch("EB");
	
	// patch to disable fairfight marking players as cheaters and kicking them
	module.Offset(0x101012).Patch("E9 90 00");
	
	// patch to allow same of multiple account
	module.Offset(0x114510).Patch("EB");
}