import { URL } from "node:url";
import httpSignature from "@peertube/http-signature";
import perform from "../../remote/activitypub/perform.js";
import Logger from "../../services/logger.js";
import { registerOrFetchInstanceDoc } from "../../services/register-or-fetch-instance-doc.js";
import { Instances } from "../../models/index.js";
import { apRequestChart, federationChart, instanceChart } from "../../services/chart/index.js";
import { fetchMeta } from "../../misc/fetch-meta.js";
import { toPuny, extractDbHost } from "../../misc/convert-host.js";
import { getApId } from "../../remote/activitypub/type.js";
import { fetchInstanceMetadata } from "../../services/fetch-instance-metadata.js";
import DbResolver from "../../remote/activitypub/db-resolver.js";
import { resolvePerson } from "../../remote/activitypub/models/person.js";
import { LdSignature } from "../../remote/activitypub/misc/ld-signature.js";
import { StatusError } from "../../misc/fetch.js";
import { shouldBlockInstance } from "../../misc/should-block-instance.js";
import { verifySignature } from "../../remote/activitypub/check-fetch.js";
import { createQueue, defaultJobOpts, processorTimeout } from "./index.js";
import config from "../../config/index.js";
import { tickInbox } from "../../metrics.js";
export const inboxLogger = new Logger("inbox");
// Processing when an activity arrives in the user's inbox
async function process(job) {
    if (job.data == null || Object.keys(job.data).length === 0) {
        job.opts.removeOnComplete = true;
        return "Skip (data was null or empty)";
    }
    const signature = job.data.signature; // HTTP-signature
    let activity = job.data.activity;
    //#region Log
    const info = Object.assign({}, activity);
    info["@context"] = undefined;
    inboxLogger.debug(JSON.stringify(info, null, 2));
    if (!signature?.keyId) {
        throw new Error(`Invalid signature: ${signature}`);
    }
    //#endregion
    const host = toPuny(new URL(signature.keyId).hostname);
    // interrupt if blocked
    const meta = await fetchMeta();
    if (await shouldBlockInstance(host, meta)) {
        return `Blocked request: ${host}`;
    }
    // only allowlisted instances in private mode
    if (meta.privateMode && !meta.allowedHosts.includes(host)) {
        return `Blocked request: ${host}`;
    }
    const keyIdLower = signature.keyId.toLowerCase();
    if (keyIdLower.startsWith("acct:")) {
        return `Old keyId is no longer supported. ${keyIdLower}`;
    }
    const dbResolver = new DbResolver();
    // HTTP-Signature keyId from DB
    let authUser = await dbResolver.getAuthUserFromKeyId(signature.keyId);
    // keyIdでわからなければ、activity.actorを元にDBから取得 || activity.actorを元にリモートから取得
    if (authUser == null) {
        try {
            authUser = await dbResolver.getAuthUserFromApId(getApId(activity.actor));
        } catch (e) {
            // Skip if target is 4xx
            if (e instanceof StatusError) {
                if (!e.isRetryable) {
                    return `skip: Ignored deleted actors on both ends ${activity.actor} - ${e.statusCode}`;
                }
                throw new Error(`Error in actor ${activity.actor} - ${e.statusCode || e}`);
            }
        }
    }
    // それでもわからなければ終了
    if (authUser == null) {
        return "skip: failed to resolve user";
    }
    // publicKey がなくても終了
    if (authUser.key == null) {
        return "skip: failed to resolve user publicKey";
    }
    // HTTP-Signatureの検証
    let httpSignatureValidated = httpSignature.verifySignature(signature, authUser.key.keyPem);
    // If signature validation failed, try refetching the actor
    if (!httpSignatureValidated) {
        authUser.key = await dbResolver.refetchPublicKeyForApId(authUser.user);
        if (authUser.key == null) {
            return "skip: failed to re-resolve user publicKey";
        }
        httpSignatureValidated = httpSignature.verifySignature(signature, authUser.key.keyPem);
    }
    if (httpSignatureValidated) {
        if (!verifySignature(signature, authUser.key)) return `skip: Invalid HTTP signature`;
    }
    // また、signatureのsignerは、activity.actorと一致する必要がある
    if (!httpSignatureValidated || authUser.user.uri !== activity.actor) {
        // 一致しなくても、でもLD-Signatureがありそうならそっちも見る
        if (activity.signature) {
            if (activity.signature.type !== "RsaSignature2017") {
                return `skip: unsupported LD-signature type ${activity.signature.type}`;
            }
            // activity.signature.creator: https://example.oom/users/user#main-key
            // みたいになっててUserを引っ張れば公開キーも入ることを期待する
            if (activity.signature.creator) {
                const candicate = activity.signature.creator.replace(/#.*/, "");
                await resolvePerson(candicate).catch(()=>null);
            }
            // keyIdからLD-Signatureのユーザーを取得
            authUser = await dbResolver.getAuthUserFromKeyId(activity.signature.creator);
            if (authUser == null) {
                return "skip: LD-Signatureのユーザーが取得できませんでした";
            }
            if (authUser.key == null) {
                return "skip: LD-SignatureのユーザーはpublicKeyを持っていませんでした";
            }
            // LD-Signature検証
            const ldSignature = new LdSignature();
            const signature = activity.signature;
            delete activity["signature"];
            activity = await ldSignature.compactToWellKnown(activity);
            if (ldSignature.containsForbiddenDirectives(activity)) {
                return "skip: activity contains forbidden directives";
            }
            const verified = await ldSignature.verifyRsaSignature2017(activity, signature, authUser.key.keyPem);
            if (!verified) {
                return "skip: LD-Signatureの検証に失敗しました";
            }
            // もう一度actorチェック
            if (authUser.user.uri !== activity.actor) {
                return `skip: LD-Signature user(${authUser.user.uri}) !== activity.actor(${activity.actor})`;
            }
            // ブロックしてたら中断
            const ldHost = extractDbHost(authUser.user.uri);
            if (await shouldBlockInstance(ldHost, meta)) {
                return `Blocked request: ${ldHost}`;
            }
        } else {
            return `skip: http-signature verification failed and no LD-Signature. keyId=${signature.keyId}`;
        }
    }
    // activity.idがあればホストが署名者のホストであることを確認する
    if (typeof activity.id !== "string") {
        return 'skip: activity.id is not a string';
    }
    const signerHost = extractDbHost(authUser.user.uri);
    const activityIdHost = extractDbHost(activity.id);
    if (signerHost !== activityIdHost) {
        return `skip: signerHost(${signerHost}) !== activity.id host(${activityIdHost}`;
    }
    // Update stats
    registerOrFetchInstanceDoc(authUser.user.host).then((i)=>{
        Instances.update(i.id, {
            latestRequestReceivedAt: new Date(),
            lastCommunicatedAt: new Date(),
            isNotResponding: false
        });
        fetchInstanceMetadata(i);
        instanceChart.requestReceived(i.host);
        apRequestChart.inbox();
        federationChart.inbox(i.host);
    });
    const inbox = authUser.user.sharedInbox ?? authUser.user.inbox;
    if (inbox !== null) {
        const { host: inboxHost } = new URL(inbox);
        if (inboxHost !== authUser.user.host) {
            registerOrFetchInstanceDoc(inboxHost).then((i)=>{
                Instances.update(i.id, {
                    latestRequestReceivedAt: new Date(),
                    lastCommunicatedAt: new Date(),
                    isNotResponding: false
                });
                fetchInstanceMetadata(i);
                instanceChart.requestReceived(i.host);
                apRequestChart.inbox();
                federationChart.inbox(i.host);
            });
        }
    }
    tickInbox();
    // アクティビティを処理
    return await perform(authUser.user, activity);
}
export const [inboxQueue, inboxInit] = createQueue("inbox", processorTimeout(process, 5 * 60), {
    limitPerSec: config.inboxJobPerSec || 16,
    concurrency: config.inboxJobConcurrency || 16
});
export function inboxJob(activity, signature) {
    const data = {
        activity: activity,
        signature
    };
    return inboxQueue.add("default", data, {
        attempts: config.inboxJobMaxAttempts || 8,
        backoff: {
            type: "custom"
        },
        ...defaultJobOpts
    });
}