#!/bin/sh /etc/rc.common

. /usr/share/libubox/jshn.sh

START=99
USE_PROCD=1
PROG=/usr/bin/openlist2

is_safe_log_path() {
	local path="$1"
	local base="${path##*/}"

	case "$path" in
		/var/log/*) ;;
		*) return 1 ;;
	esac

	[ "$path" = "/var/log/$base" ] || return 1

	printf '%s\n' "$base" | grep -Eq '^openlist2([._-][A-Za-z0-9._-]+)?$'
}

append_dest_port() {
	local value="$1"

	[ -n "$value" ] && [ "$value" != "-1" ] || return 0
	dest_ports="${dest_ports:+$dest_ports }$value"
}

json_add_filter_object() {
	json_add_object ""
		json_add_string "cidr" "$1"
		json_add_string "path" "$2"
		json_add_string "method" "$3"
	json_close_object
}

json_add_csv_array() {
	local name="$1"
	local values="$2"
	local oldifs="$IFS"
	local noglob_set=0
	local item
	local count=0

	json_add_array "$name"
	case "$-" in
		*f*) noglob_set=1 ;;
		*) set -f ;;
	esac
	IFS=','
	for item in $values; do
		IFS="$oldifs"
		item="$(printf '%s' "$item" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
		IFS=','
		if [ -n "$item" ]; then
			json_add_string "" "$item"
			count=$((count + 1))
		fi
	done
	IFS="$oldifs"
	[ "$noglob_set" = "1" ] || set +f
	[ "$count" -eq 0 ] && json_add_string "" "*"
	json_close_array
}

get_config() {
	uci_changed=0

	config_get_bool enabled "$1" enabled 1
	config_get debug "$1" debug 0
	config_get allow_wan "$1" allow_wan 0
	config_get delayed_start "$1" delayed_start 0

	config_get force "$1" force 1
	config_get site_url "$1" site_url ""
	config_get cdn "$1" cdn ""
	config_get jwt_secret "$1" jwt_secret ""
	config_get data_dir "$1" data_dir "/etc/openlist2"
	config_get temp_dir "$1" temp_dir "/tmp/openlist2"
	config_get token_expires_in "$1" token_expires_in 48
	config_get proxy_address "$1" proxy_address ""
	config_get auto_memory_limit "$1" auto_memory_limit 4
	config_get min_free_memory "$1" min_free_memory 0
	config_get max_block_limit "$1" max_block_limit 0
	config_get max_connections "$1" max_connections 0
	config_get max_concurrency "$1" max_concurrency 64
	config_get tls_insecure_skip_verify "$1" tls_insecure_skip_verify 0

	# log
	config_get log "$1" log 1
	config_get log_path "$1" log_path '/var/log/openlist2.log'
	if ! is_safe_log_path "$log_path"; then
		log_path='/var/log/openlist2.log'
		uci -q set openlist2.@openlist2[0].log_path="$log_path"
		uci_changed=1
	fi
	config_get log_max_size "$1" log_max_size 50
	config_get log_max_backups "$1" log_max_backups 30
	config_get log_max_age "$1" log_max_age 28
	config_get log_compress "$1" log_compress 0
	config_get log_filter "$1" log_filter 0
	config_get log_filter_cidr "$1" log_filter_cidr ""
	config_get log_filter_path "$1" log_filter_path ""
	config_get log_filter_method "$1" log_filter_method ""

	# scheme
	config_get force_https "$1" force_https 0
	config_get ssl_cert "$1" ssl_cert ""
	config_get ssl_key "$1" ssl_key ""
	config_get listen_addr "$1" listen_addr "0.0.0.0"
	config_get listen_http_port "$1" listen_http_port "5244"
	config_get listen_https_port "$1" listen_https_port "-1"
	config_get listen_unix_file "$1" listen_unix_file ""
	config_get listen_unix_file_perm "$1" listen_unix_file_perm ""
	config_get listen_enable_h2c "$1" listen_enable_h2c 0
	config_get listen_enable_h3 "$1" listen_enable_h3 0

	# database
	config_get database_type "$1" database_type "sqlite3"
	config_get mysql_host "$1" mysql_host ""
	config_get mysql_port "$1" mysql_port "0"
	case "$database_type:$mysql_port" in
		mysql:|mysql:0) mysql_port="3306" ;;
		postgres:|postgres:0) mysql_port="5432" ;;
	esac
	config_get mysql_username "$1" mysql_username ""
	config_get mysql_password "$1" mysql_password ""
	config_get mysql_database "$1" mysql_database ""
	config_get mysql_table_prefix "$1" mysql_table_prefix "x_"
	config_get mysql_ssl_mode "$1" mysql_ssl_mode ""
	config_get mysql_dsn "$1" mysql_dsn ""
	config_get meilisearch_host "$1" meilisearch_host "http://localhost:7700"
	config_get meilisearch_api_key "$1" meilisearch_api_key ""
	config_get meilisearch_index "$1" meilisearch_index "openlist"

	# tasks
	config_get download_workers "$1" download_workers 5
	config_get download_max_retry "$1" download_max_retry 1
	config_get download_task_persistant "$1" download_task_persistant 0
	config_get transfer_workers "$1" transfer_workers 5
	config_get transfer_max_retry "$1" transfer_max_retry 2
	config_get transfer_task_persistant "$1" transfer_task_persistant 0
	config_get upload_workers "$1" upload_workers 5
	config_get upload_max_retry "$1" upload_max_retry 0
	config_get upload_task_persistant "$1" upload_task_persistant 0
	config_get copy_workers "$1" copy_workers 5
	config_get copy_max_retry "$1" copy_max_retry 2
	config_get copy_task_persistant "$1" copy_task_persistant 0
	config_get move_workers "$1" move_workers 5
	config_get move_max_retry "$1" move_max_retry 2
	config_get move_task_persistant "$1" move_task_persistant 0
	config_get decompress_workers "$1" decompress_workers 5
	config_get decompress_max_retry "$1" decompress_max_retry 2
	config_get decompress_task_persistant "$1" decompress_task_persistant 0
	config_get decompress_upload_workers "$1" decompress_upload_workers 5
	config_get decompress_upload_max_retry "$1" decompress_upload_max_retry 2
	config_get decompress_upload_task_persistant "$1" decompress_upload_task_persistant 0
	config_get allow_retry_canceled "$1" allow_retry_canceled 0

	# cors
	config_get cors_allow_origins "$1" cors_allow_origins '*'
	config_get cors_allow_methods "$1" cors_allow_methods '*'
	config_get cors_allow_headers "$1" cors_allow_headers '*'

	# s3
	config_get s3 "$1" s3 0
	config_get s3_port "$1" s3_port 5246
	config_get s3_ssl "$1" s3_ssl 0

	# ftp
	config_get ftp "$1" ftp 0
	config_get ftp_port "$1" ftp_port 5221
	config_get find_pasv_port_attempts "$1" find_pasv_port_attempts 50
	config_get active_transfer_port_non_20 "$1" active_transfer_port_non_20 0
	config_get idle_timeout "$1" idle_timeout 900
	config_get connection_timeout "$1" connection_timeout 30
	config_get disable_active_mode "$1" disable_active_mode 0
	config_get default_transfer_binary "$1" default_transfer_binary 0
	config_get enable_active_conn_ip_check "$1" enable_active_conn_ip_check 1
	config_get enable_pasv_conn_ip_check "$1" enable_pasv_conn_ip_check 1

	# sftp
	config_get sftp "$1" sftp 0
	config_get sftp_port "$1" sftp_port 5222

	# mcp
	config_get mcp "$1" mcp 0

	# init jwt_secret
	if [ -z "$jwt_secret" ]; then
		jwt_secret=$(tr -cd "a-zA-Z0-9" < "/dev/urandom" | head -c16)
		uci -q set openlist2.@openlist2[0].jwt_secret="$jwt_secret"
		uci_changed=1
	fi
	[ "$uci_changed" = "1" ] && uci commit openlist2
}

set_firewall() {
	if [ "$external_access" = "allow" ]; then
		dest_ports=""
		append_dest_port "$http_port"
		append_dest_port "$https_port"
		[ "$s3" = "1" ] && append_dest_port "$s3_port"
		[ "$ftp" = "1" ] && append_dest_port "$ftp_port"
		[ "$sftp" = "1" ] && append_dest_port "$sftp_port"

		uci -q delete firewall.openlist
		uci -q delete firewall.openlist2
		uci -q delete firewall.openlist2_quic
		if [ -z "$dest_ports" ]; then
			uci commit firewall
			/etc/init.d/firewall reload >/dev/null 2>&1
			return 0
		fi

		uci set firewall.openlist2=rule
		uci set firewall.openlist2.name="openlist2"
		uci set firewall.openlist2.target="ACCEPT"
		uci set firewall.openlist2.src="wan"
		uci set firewall.openlist2.proto="tcp"
		uci set firewall.openlist2.dest_port="$dest_ports"
		uci set firewall.openlist2.enabled="1"
		if [ "$listen_enable_h3" = "1" ] && [ -n "$https_port" ] && [ "$https_port" != "-1" ]; then
			uci set firewall.openlist2_quic=rule
			uci set firewall.openlist2_quic.name="openlist2 QUIC"
			uci set firewall.openlist2_quic.target="ACCEPT"
			uci set firewall.openlist2_quic.src="wan"
			uci set firewall.openlist2_quic.proto="udp"
			uci set firewall.openlist2_quic.dest_port="$https_port"
			uci set firewall.openlist2_quic.enabled="1"
		fi
		uci commit firewall
		/etc/init.d/firewall reload >/dev/null 2>&1
	elif [ "$external_access" = "deny" ]; then
		uci -q delete firewall.openlist
		uci -q delete firewall.openlist2
		uci -q delete firewall.openlist2_quic
		uci commit firewall
		/etc/init.d/firewall reload >/dev/null 2>&1
	fi
}

start_service() {
	config_load openlist2
	config_foreach get_config openlist2

	# Remove firewall rules when stopping openlist process via uci
	external_access="deny" set_firewall

	[ "$enabled" -ne 1 ] && return 1
	mkdir -p "$temp_dir" "$data_dir"
	[ -n "$listen_http_port" ] || listen_http_port="5244"
	[ -n "$listen_https_port" ] || listen_https_port="-1"
	http_port="$listen_http_port"
	https_port="$listen_https_port"
	if [ -e /proc/uptime ]; then
		boot_uptime="$(awk -F. '{print $1}' /proc/uptime)"
		[ "$boot_uptime" -lt "120" ] || delayed_start=0
	fi

	[ "$allow_wan" -eq "1" ] && external_access="allow" || external_access="deny"

	set_firewall

	log_dir="${log_path%/*}"
	[ "$log_dir" != "$log_path" ] && mkdir -p "$log_dir"
	: > "$log_path"

	last_launched_version=""
	if command -v jsonfilter >/dev/null 2>&1 && [ -s "$data_dir/config.json" ]; then
		last_launched_version="$(jsonfilter -qi "$data_dir/config.json" -e '@.last_launched_version' 2>/dev/null)"
	fi

	# init config
	json_init
	json_add_boolean "force" "$force"
	json_add_string "site_url" "$site_url"
	json_add_string "cdn" "$cdn"
	json_add_string "jwt_secret" "$jwt_secret"
	json_add_int "token_expires_in" "$token_expires_in"

	# database
	json_add_object 'database'
		json_add_string "type" "$database_type"
		json_add_string "host" "$mysql_host"
		json_add_int "port" "$mysql_port"
		json_add_string "user" "$mysql_username"
		json_add_string "password" "$mysql_password"
		json_add_string "name" "$mysql_database"
		json_add_string "db_file" "$data_dir/data.db"
		json_add_string "table_prefix" "$mysql_table_prefix"
		json_add_string "ssl_mode" "$mysql_ssl_mode"
		json_add_string "dsn" "$mysql_dsn"
	json_close_object

	# meilisearch
	json_add_object "meilisearch"
		json_add_string "host" "$meilisearch_host"
		json_add_string "api_key" "$meilisearch_api_key"
		json_add_string "index" "$meilisearch_index"
	json_close_object

	# scheme
	json_add_object "scheme"
		json_add_string "address" "$listen_addr"
		json_add_int "http_port" "$http_port"
		json_add_int "https_port" "$https_port"
		json_add_boolean "force_https" "$force_https"
		json_add_string "cert_file" "$ssl_cert"
		json_add_string "key_file" "$ssl_key"
		json_add_string "unix_file" "$listen_unix_file"
		json_add_string "unix_file_perm" "$listen_unix_file_perm"
		json_add_boolean "enable_h2c" "$listen_enable_h2c"
		json_add_boolean "enable_h3" "$listen_enable_h3"
	json_close_object

	json_add_string "temp_dir" "$temp_dir"
	json_add_string "bleve_dir" "$data_dir/bleve"
	json_add_string "dist_dir" ""

	# log
	json_add_object "log"
		json_add_boolean "enable" "$log"
		json_add_string "name" "$log_path"
		json_add_int "max_size" "$log_max_size"
		json_add_int "max_backups" "$log_max_backups"
		json_add_int "max_age" "$log_max_age"
		json_add_boolean "compress" "$log_compress"
		json_add_object "filter"
			json_add_boolean "enable" "$log_filter"
			json_add_array "filters"
				json_add_filter_object "" "/ping" ""
				json_add_filter_object "" "" "HEAD"
				json_add_filter_object "" "/dav/" "PROPFIND"
				if [ -n "$log_filter_cidr" ] || [ -n "$log_filter_path" ] || [ -n "$log_filter_method" ]; then
					json_add_filter_object "$log_filter_cidr" "$log_filter_path" "$log_filter_method"
				fi
			json_close_array
		json_close_object
	json_close_object

	json_add_int "delayed_start" "$delayed_start"
	json_add_int "auto_memory_limit" "$auto_memory_limit"
	json_add_int "min_free_memory" "$min_free_memory"
	json_add_int "max_block_limit" "$max_block_limit"
	json_add_int "max_connections" "$max_connections"
	json_add_int "max_concurrency" "$max_concurrency"
	json_add_boolean "tls_insecure_skip_verify" "$tls_insecure_skip_verify"

	# tasks
	json_add_object "tasks"
		json_add_object "download"
			json_add_int "workers" "$download_workers"
			json_add_int "max_retry" "$download_max_retry"
			json_add_boolean "task_persistant" "$download_task_persistant"
		json_close_object
		json_add_object "transfer"
			json_add_int "workers" "$transfer_workers"
			json_add_int "max_retry" "$transfer_max_retry"
			json_add_boolean "task_persistant" "$transfer_task_persistant"
		json_close_object
		json_add_object "upload"
			json_add_int "workers" "$upload_workers"
			json_add_int "max_retry" "$upload_max_retry"
			json_add_boolean "task_persistant" "$upload_task_persistant"
		json_close_object
		json_add_object "copy"
			json_add_int "workers" "$copy_workers"
			json_add_int "max_retry" "$copy_max_retry"
			json_add_boolean "task_persistant" "$copy_task_persistant"
		json_close_object
		json_add_object "move"
			json_add_int "workers" "$move_workers"
			json_add_int "max_retry" "$move_max_retry"
			json_add_boolean "task_persistant" "$move_task_persistant"
		json_close_object
		json_add_object "decompress"
			json_add_int "workers" "$decompress_workers"
			json_add_int "max_retry" "$decompress_max_retry"
			json_add_boolean "task_persistant" "$decompress_task_persistant"
		json_close_object
		json_add_object "decompress_upload"
			json_add_int "workers" "$decompress_upload_workers"
			json_add_int "max_retry" "$decompress_upload_max_retry"
			json_add_boolean "task_persistant" "$decompress_upload_task_persistant"
		json_close_object
		json_add_boolean "allow_retry_canceled" "$allow_retry_canceled"
	json_close_object

	# cors
	json_add_object "cors"
		json_add_csv_array "allow_origins" "$cors_allow_origins"
		json_add_csv_array "allow_methods" "$cors_allow_methods"
		json_add_csv_array "allow_headers" "$cors_allow_headers"
	json_close_object

	# s3
	json_add_object "s3"
		json_add_boolean "enable" "$s3"
		json_add_int "port" "$s3_port"
		json_add_boolean "ssl" "$s3_ssl"
	json_close_object

	# ftp
	json_add_object "ftp"
		json_add_boolean "enable" "$ftp"
		json_add_string "listen" ":$ftp_port"
		json_add_int "find_pasv_port_attempts" "$find_pasv_port_attempts"
		json_add_boolean "active_transfer_port_non_20" "$active_transfer_port_non_20"
		json_add_int "idle_timeout" "$idle_timeout"
		json_add_int "connection_timeout" "$connection_timeout"
		json_add_boolean "disable_active_mode" "$disable_active_mode"
		json_add_boolean "default_transfer_binary" "$default_transfer_binary"
		json_add_boolean "enable_active_conn_ip_check" "$enable_active_conn_ip_check"
		json_add_boolean "enable_pasv_conn_ip_check" "$enable_pasv_conn_ip_check"
	json_close_object

	# sftp
	json_add_object "sftp"
		json_add_boolean "enable" "$sftp"
		json_add_string "listen" ":$sftp_port"
	json_close_object

	# mcp
	json_add_object "mcp"
		json_add_boolean "enable" "$mcp"
	json_close_object

	json_add_string "last_launched_version" "$last_launched_version"
	json_add_string "proxy_address" "$proxy_address"

	json_dump > "$data_dir/config.json"

	procd_open_instance openlist2
	procd_set_param env OPENLIST_ADMIN_PASSWORD=admin
	procd_set_param command $PROG
	procd_append_param command server
	procd_append_param command --data "$data_dir"
	procd_append_param command --no-prefix
	[ "$debug" = "1" ] && procd_append_param command --debug
	[ "$debug" = "1" ] && procd_set_param stderr 1
	procd_set_param respawn
	procd_set_param limits core="unlimited"
	procd_set_param limits nofile="200000 200000"
	procd_close_instance openlist2
}

service_triggers() {
	procd_add_reload_trigger "openlist2"
}

reload_service() {
	stop
	start
	return 0
}

stop_service() {
	external_access="deny"
	set_firewall
}