# JSDoc: Source: utils/sessionUtils.js

# Source: utils/sessionUtils.js

    /*Canopy - The next generation of stoner streaming software
    Copyright (C) 2024-2025 Rainbownapkin and the TTN Community

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU Affero General Public License as
    published by the Free Software Foundation, either version 3 of the
    License, or (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU Affero General Public License for more details.

    You should have received a copy of the GNU Affero General Public License
    along with this program.  If not, see <https://www.gnu.org/licenses/>.*/

    //Local Imports
    const config = require('../../config.json');
    const {userModel} = require('../schemas/user/userSchema.js');
    const userBanModel = require('../schemas/user/userBanSchema.js')
    const altchaUtils = require('../utils/altchaUtils.js');
    const loggerUtils = require('../utils/loggerUtils.js');

    /**
     * Create failed sign-in cache since it's easier and more preformant to implement it this way than adding extra burdon to the database
     * Server restarts are far and few between. It would take multiple during a single bruteforce attempt for this to become an issue.
     */
    const failedAttempts = new Map();

    /**
     * How many failed attempts required to throttle with altcha
     */
    const throttleAttempts = 5;

    /**
     * How many attempts to lock user account out for the day
     */
    const maxAttempts = 200;

    /**
     * Sole and Singular Session Authentication method.
     * All logins should happen through here, all other site-wide authentication should happen by sessions authenticated by this model.
     * This is important, as reducing authentication endpoints reduces attack surface.
     * @param {String} user - Username to login as
     * @param {String} pass - Password to authenticat session with
     * @param {express.Request} req - Express request object w/ session to authenticate
     * @returns Username of authticated user upon success
     */
    module.exports.authenticateSession = async function(user, pass, req){
        //Fuck you yoda
        try{
            //Grab previous attempts
            const attempt = failedAttempts.get(user);

            //If we're proxied use passthrough IP
            const ip = config.proxied ? req.headers['x-forwarded-for'] : req.ip;

            //Look for ban by IP
            const ipBanDB = await userBanModel.checkBanByIP(ip);

            //If this ip is randy bobandy
            if(ipBanDB != null){
                //Make the number a little prettier despite the lack of precision since we're not doing calculations here :P
                const expiration = ipBanDB.getDaysUntilExpiration() < 1 ? 0 : ipBanDB.getDaysUntilExpiration();

                //If the ban is permanent
                if(ipBanDB.permanent){
                    //tell it to fuck off
                    throw loggerUtils.exceptionSmith(`The IP address you are trying to login from has been permanently banned. Your cleartext IP has been saved to the database. Any associated accounts will be nuked in ${expiration} day(s).`, "unauthorized");
                }else{
                    //tell it to fuck off
                    throw loggerUtils.exceptionSmith(`The IP address you are trying to login from has been temporarily banned. Your cleartext IP has been saved to the database until the ban expires in ${expiration} day(s).`, "unauthorized");
                }
            }

            //If we have failed attempts
            if(attempt != null){
                //If we have more failed attempts than allowed
                if(attempt.count > maxAttempts){
                    throw loggerUtils.exceptionSmith("This account has been locked for at 24 hours due to a large amount of failed log-in attempts", "unauthorized");
                }

                //If we're throttling logins
                if(attempt.count > throttleAttempts){
                    //Verification doesnt get sanatized or checked since that would most likely break the cryptography
                    //Since we've already got access to the request and dont need to import anything, why bother getting it from a parameter?
                    if(req.body.verification == null){
                        throw loggerUtils.exceptionSmith("Verification failed!", "unauthorized");
                    }else if(!altchaUtils.verify(req.body.verification, user)){
                        throw loggerUtils.exceptionSmith("Verification failed!", "");
                    }
                }
            }

            //Authenticate the session
            const userDB = await userModel.authenticate(user, pass);

            //Check for user ban
            const userBanDB = await userBanModel.checkBanByUserDoc(userDB);

            //If the user is banned
            if(userBanDB){
                //Make the number a little prettier despite the lack of precision since we're not doing calculations here :P
                const expiration = userBanDB.getDaysUntilExpiration() < 1 ? 0 : userBanDB.getDaysUntilExpiration();
                if(userBanDB.permanent){
                    throw loggerUtils.exceptionSmith(`Your account has been permanently banned, and will be nuked from the database in: ${expiration} day(s)`, "unauthorized");
                }else{
                    throw loggerUtils.exceptionSmith(`Your account has been temporarily banned, and will be reinstated in: ${expiration} day(s)`, "unauthorized");
                }
            }

            //Tattoo the session with user and metadata
            //unfortunately store.all() does not return sessions w/ their ID so we had to improvise...
            //Not sure if this is just how connect-mongo is implemented or if it's an express issue, but connect-mongodb-session seems to not implement the all() function what so ever...
            req.session.seshid = req.session.id;
            req.session.authdate = new Date();
            req.session.user = {
                user: userDB.user,
                id: userDB.id,
                rank: userDB.rank
            }

            //Tattoo hashed IP address to user account for seven days
            userDB.tattooIPRecord(ip);

            //If we got to here then the log-in was successful. We should clear-out any failed attempts.
            failedAttempts.delete(user);

            //return user
            return userDB.user;
        }catch(err){
            //Look for previous failed attempts
            var attempt = failedAttempts.get(user);

            //If this is the first attempt
            if(attempt == null){
                //Create new attempt object
                attempt = {
                    count: 1,
                    lastAttempt: new Date()
                }
            }else{
                //Create updated attempt object
                attempt = {
                    count: attempt.count + 1,
                    lastAttempt: new Date()
                }
            }

            //Commit the failed attempt to the failed sign-in cache
            failedAttempts.set(user, attempt);

            //y33t
            throw err;
        }
    }

    /**
     * Logs user out and destroys all server-side traces of a given session
     * @param {express-session.session} session
     */
    module.exports.killSession = async function(session){
        session.destroy();
    }

    /**
     * Returns how many failed login attempts within the past day or so since the last login has occured for a given user
     * @param {String} user - User to check map against
     * @returns {Number} of failed login attempts
     */
    module.exports.getLoginAttempts = function(user){
        //Read the code, i'm not explaining this
        return failedAttempts.get(user);
    }

    /**
     * Nightly Function Call which iterates through the failed login attempts map, removing any which haven't been attempted in over a da yeahy
     */
    module.exports.processExpiredAttempts = function(){
        for(user of failedAttempts.keys()){
            //Get attempt by user
            const attempt = failedAttempts.get(user);
            //Check how long its been
            const daysSinceLastAttempt = ((new Date() - attempt.lastAttempt) / (1000 * 60 * 60 * 24)).toFixed(1);

            //If it's been more than a day since anyones tried to log in as this user
            if(daysSinceLastAttempt >= 1){
                //Clear out the attempts so that they don't need to fuck with a captcha anymore
                failedAttempts.delete(user);
            }
        }
    }

    module.exports.throttleAttempts = throttleAttempts;
    module.exports.maxAttempts = maxAttempts;