module Gem::GemcutterUtilities

# File lib/rubygems/gemcutter_utilities.rb, line 24
def add_key_option
  add_option("-k", "--key KEYNAME", Symbol,
             "Use the given API key",
             "from #{Gem.configuration.credentials_path}") do |value,options|
    options[:key] = value
  end
end

# File lib/rubygems/gemcutter_utilities.rb, line 35
def add_otp_option
  add_option("--otp CODE",
             "Digit code for multifactor authentication",
             "You can also use the environment variable GEM_HOST_OTP_CODE") do |value, options|
    options[:otp] = value
  end
end

# File lib/rubygems/gemcutter_utilities.rb, line 46
def api_key
  if ENV["GEM_HOST_API_KEY"]
    ENV["GEM_HOST_API_KEY"]
  elsif options[:key]
    verify_api_key options[:key]
  elsif Gem.configuration.api_keys.key?(host)
    Gem.configuration.api_keys[host]
  else
    Gem.configuration.rubygems_api_key
  end
end

# File lib/rubygems/gemcutter_utilities.rb, line 69
def host
  configured_host = Gem.host unless
    Gem.configuration.disable_default_gem_server

  @host ||=
    begin
      env_rubygems_host = ENV["RUBYGEMS_HOST"]
      env_rubygems_host = nil if env_rubygems_host&.empty?

      env_rubygems_host || configured_host
    end
end

# File lib/rubygems/gemcutter_utilities.rb, line 122
def mfa_unauthorized?(response)
  response.is_a?(Gem::Net::HTTPUnauthorized) && response.body.start_with?("You have enabled multifactor authentication")
end

# File lib/rubygems/gemcutter_utilities.rb, line 61
def otp
  options[:otp] || ENV["GEM_HOST_OTP_CODE"]
end

# File lib/rubygems/gemcutter_utilities.rb, line 87
def rubygems_api_request(method, path, host = nil, allowed_push_host = nil, scope: nil, credentials: {}, &block)
  require_relative "vendored_net_http"

  self.host = host if host
  unless self.host
    alert_error "You must specify a gem server"
    terminate_interaction(ERROR_CODE)
  end

  if allowed_push_host
    allowed_host_uri = Gem::URI.parse(allowed_push_host)
    host_uri         = Gem::URI.parse(self.host)

    unless (host_uri.scheme == allowed_host_uri.scheme) && (host_uri.host == allowed_host_uri.host)
      alert_error "#{self.host.inspect} is not allowed by the gemspec, which only allows #{allowed_push_host.inspect}"
      terminate_interaction(ERROR_CODE)
    end
  end

  uri = Gem::URI.parse "#{self.host}/#{path}"
  response = request_with_otp(method, uri, &block)

  if mfa_unauthorized?(response)
    fetch_otp(credentials)
    response = request_with_otp(method, uri, &block)
  end

  if api_key_forbidden?(response)
    update_scope(scope)
    request_with_otp(method, uri, &block)
  else
    response
  end
end

# File lib/rubygems/gemcutter_utilities.rb, line 237
def set_api_key(host, key)
  if default_host?
    Gem.configuration.rubygems_api_key = key
  else
    Gem.configuration.set_api_key host, key
  end
end

# File lib/rubygems/gemcutter_utilities.rb, line 152
def sign_in(sign_in_host = nil, scope: nil)
  sign_in_host ||= host
  return if api_key

  pretty_host = pretty_host(sign_in_host)

  say "Enter your #{pretty_host} credentials."
  say "Don't have an account yet? " \
      "Create one at #{sign_in_host}/sign_up"

  identifier = ask "Username/email: "
  password   = ask_for_password "      Password: "
  say "\n"

  key_name     = get_key_name(scope)
  scope_params = get_scope_params(scope)
  profile      = get_user_profile(identifier, password)
  mfa_params   = get_mfa_params(profile)
  all_params   = scope_params.merge(mfa_params)
  warning      = profile["warning"]
  credentials  = { identifier: identifier, password: password }

  say "#{warning}\n" if warning

  response = rubygems_api_request(:post, "api/v1/api_key",
                                  sign_in_host, credentials: credentials, scope: scope) do |request|
    request.basic_auth identifier, password
    request["OTP"] = otp if otp
    request.body = Gem::URI.encode_www_form({ name: key_name }.merge(all_params))
  end

  with_response response do |resp|
    say "Signed in with API key: #{key_name}."
    set_api_key host, resp.body
  end
end

# File lib/rubygems/gemcutter_utilities.rb, line 126
def update_scope(scope)
  sign_in_host        = host
  pretty_host         = pretty_host(sign_in_host)
  update_scope_params = { scope => true }

  say "The existing key doesn't have access of #{scope} on #{pretty_host}. Please sign in to update access."

  identifier = ask "Username/email: "
  password   = ask_for_password "      Password: "

  response = rubygems_api_request(:put, "api/v1/api_key",
                                  sign_in_host, scope: scope) do |request|
    request.basic_auth identifier, password
    request["OTP"] = otp if otp
    request.body = Gem::URI.encode_www_form({ api_key: api_key }.merge(update_scope_params))
  end

  with_response response do |_resp|
    say "Added #{scope} scope to the existing API key"
  end
end

# File lib/rubygems/gemcutter_utilities.rb, line 193
def verify_api_key(key)
  if Gem.configuration.api_keys.key? key
    Gem.configuration.api_keys[key]
  else
    alert_error "No such API key. Please add it to your configuration (done automatically on initial `gem push`)."
    terminate_interaction(ERROR_CODE)
  end
end

# File lib/rubygems/gemcutter_utilities.rb, line 210
def with_response(response, error_prefix = nil)
  case response
  when Gem::Net::HTTPSuccess then
    if block_given?
      yield response
    else
      say clean_text(response.body)
    end
  when Gem::Net::HTTPPermanentRedirect, Gem::Net::HTTPRedirection then
    message = "The request has redirected permanently to #{response["location"]}. Please check your defined push host URL."
    message = "#{error_prefix}: #{message}" if error_prefix

    say clean_text(message)
    terminate_interaction(ERROR_CODE)
  else
    message = response.body
    message = "#{error_prefix}: #{message}" if error_prefix

    say clean_text(message)
    terminate_interaction(ERROR_CODE)
  end
end