#
# This file is licensed under the Affero General Public License (AGPL) version 3.
#
# Copyright 2016 OpenMarket Ltd
# Copyright (C) 2023 New Vector, Ltd
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# See the GNU Affero General Public License for more details:
# <https://www.gnu.org/licenses/agpl-3.0.html>.
#
# Originally licensed under the Apache License, Version 2.0:
# <http://www.apache.org/licenses/LICENSE-2.0>.
#
# [This file includes modifications made by New Vector Limited]
#
#

import logging
from http import HTTPStatus
from typing import TYPE_CHECKING, Any

import attr
from canonicaljson import encode_canonical_json

from synapse.api.constants import (
    MAX_TO_DEVICE_CONTENT_SIZE,
    SOFT_MAX_EDU_SIZE,
    EduTypes,
    EventContentFields,
    ToDeviceEventTypes,
)
from synapse.api.errors import Codes, EventSizeError, SynapseError
from synapse.api.ratelimiting import Ratelimiter
from synapse.logging.context import run_in_background
from synapse.logging.opentracing import (
    SynapseTags,
    get_active_span_text_map,
    log_kv,
    set_tag,
)
from synapse.types import JsonDict, Requester, StreamKeyType, UserID, get_domain_from_id
from synapse.util import split_dict_to_fit_to_size
from synapse.util.json import json_encoder
from synapse.util.stringutils import random_string_insecure_fast

if TYPE_CHECKING:
    from synapse.server import HomeServer


logger = logging.getLogger(__name__)


@attr.s(slots=True, frozen=True, auto_attribs=True)
class DehydratedEvents:
    events: list[JsonDict]
    stream_id: str
    limited: bool


class DeviceMessageHandler:
    def __init__(self, hs: "HomeServer"):
        """
        Args:
            hs: server
        """
        self.store = hs.get_datastores().main
        self.notifier = hs.get_notifier()
        self.is_mine = hs.is_mine
        self.device_handler = hs.get_device_handler()
        if hs.config.experimental.msc3814_enabled:
            self.event_sources = hs.get_event_sources()

        # We only need to poke the federation sender explicitly if its on the
        # same instance. Other federation sender instances will get notified by
        # `synapse.app.generic_worker.FederationSenderHandler` when it sees it
        # in the to-device replication stream.
        self.federation_sender = None
        if hs.should_send_federation():
            self.federation_sender = hs.get_federation_sender()

        # If we can handle the to device EDUs we do so, otherwise we route them
        # to the appropriate worker.
        if hs.get_instance_name() in hs.config.worker.writers.to_device:
            hs.get_federation_registry().register_edu_handler(
                EduTypes.DIRECT_TO_DEVICE, self.on_direct_to_device_edu
            )
        else:
            hs.get_federation_registry().register_instances_for_edu(
                EduTypes.DIRECT_TO_DEVICE,
                hs.config.worker.writers.to_device,
            )

        # a rate limiter for room key requests.  The keys are
        # (sending_user_id, sending_device_id).
        self._ratelimiter = Ratelimiter(
            store=self.store,
            clock=hs.get_clock(),
            cfg=hs.config.ratelimiting.rc_key_requests,
        )

    async def on_direct_to_device_edu(self, origin: str, content: JsonDict) -> None:
        """
        Handle receiving to-device messages from remote homeservers.

        Note that any errors thrown from this method will cause the federation /send
        request to receive an error response.

        Args:
            origin: The remote homeserver.
            content: The JSON dictionary containing the to-device messages.
        """
        local_messages = {}
        sender_user_id = content["sender"]
        if origin != get_domain_from_id(sender_user_id):
            logger.warning(
                "Dropping device message from %r with spoofed sender %r",
                origin,
                sender_user_id,
            )
        message_type = content["type"]
        message_id = content["message_id"]
        for user_id, by_device in content["messages"].items():
            # we use UserID.from_string to catch invalid user ids
            if not self.is_mine(UserID.from_string(user_id)):
                logger.warning("To-device message to non-local user %s", user_id)
                raise SynapseError(400, "Not a user here")

            if not by_device:
                continue

            # Ratelimit key requests by the sending user.
            if message_type == ToDeviceEventTypes.RoomKeyRequest:
                allowed, _ = await self._ratelimiter.can_do_action(
                    None, (sender_user_id, None)
                )
                if not allowed:
                    logger.info(
                        "Dropping room_key_request from %s to %s due to rate limit",
                        sender_user_id,
                        user_id,
                    )
                    continue

            messages_by_device = {
                device_id: {
                    "content": message_content,
                    "type": message_type,
                    "sender": sender_user_id,
                }
                for device_id, message_content in by_device.items()
            }
            local_messages[user_id] = messages_by_device

            await self._check_for_unknown_devices(
                message_type, sender_user_id, by_device
            )

        # Add messages to the database.
        # Retrieve the stream id of the last-processed to-device message.
        last_stream_id = await self.store.add_messages_from_remote_to_device_inbox(
            origin, message_id, local_messages
        )

        # Notify listeners that there are new to-device messages to process,
        # handing them the latest stream id.
        self.notifier.on_new_event(
            StreamKeyType.TO_DEVICE, last_stream_id, users=local_messages.keys()
        )

    async def _check_for_unknown_devices(
        self,
        message_type: str,
        sender_user_id: str,
        by_device: dict[str, dict[str, Any]],
    ) -> None:
        """Checks inbound device messages for unknown remote devices, and if
        found marks the remote cache for the user as stale.
        """

        if message_type != "m.room_key_request":
            return

        # Get the sending device IDs
        requesting_device_ids = set()
        for message_content in by_device.values():
            device_id = message_content.get("requesting_device_id")
            requesting_device_ids.add(device_id)

        # Check if we are tracking the devices of the remote user.
        room_ids = await self.store.get_rooms_for_user(sender_user_id)
        if not room_ids:
            logger.info(
                "Received device message from remote device we don't"
                " share a room with: %s %s",
                sender_user_id,
                requesting_device_ids,
            )
            return

        # If we are tracking check that we know about the sending
        # devices.
        cached_devices = await self.store.get_cached_devices_for_user(sender_user_id)

        unknown_devices = requesting_device_ids - set(cached_devices)
        if unknown_devices:
            logger.info(
                "Received device message from remote device not in our cache: %s %s",
                sender_user_id,
                unknown_devices,
            )
            await self.store.mark_remote_users_device_caches_as_stale((sender_user_id,))

            # Immediately attempt a resync in the background
            run_in_background(
                self.device_handler.device_list_updater.multi_user_device_resync,
                user_ids=[sender_user_id],
            )

    async def send_device_message(
        self,
        requester: Requester,
        message_type: str,
        messages: dict[str, dict[str, JsonDict]],
    ) -> None:
        """
        Handle a request from a user to send to-device message(s).

        Args:
            requester: The user that is sending the to-device messages.
            message_type: The type of to-device messages that are being sent.
            messages: A dictionary containing recipients mapped to messages intended for them.
        """
        sender_user_id = requester.user.to_string()

        set_tag(SynapseTags.TO_DEVICE_TYPE, message_type)
        set_tag(SynapseTags.TO_DEVICE_SENDER, sender_user_id)
        local_messages = {}
        # Map from destination (server) -> recipient (user ID) -> device_id -> JSON message content
        remote_messages: dict[str, dict[str, dict[str, JsonDict]]] = {}
        for user_id, by_device in messages.items():
            if not UserID.is_valid(user_id):
                logger.warning(
                    "Ignoring attempt to send device message to invalid user: %r",
                    user_id,
                )
                continue

            # add an opentracing log entry for each message
            for device_id, message_content in by_device.items():
                # Check the size of each message, as if these are too large we
                # can't send them over federation.
                #
                # We do this for all to-device messages, even those that aren't
                # over federation, so as to more easily catch clients that are
                # sending excessively large messages.
                if (
                    message_len := len(encode_canonical_json(message_content))
                ) > MAX_TO_DEVICE_CONTENT_SIZE:
                    # 413 is currently an unspecced response for `/sendToDevice` but is
                    # probably the best thing we can do.
                    # https://github.com/matrix-org/matrix-spec/pull/2340 tracks adding
                    # this to the spec
                    raise EventSizeError(
                        f"To-device message for {user_id}:{device_id} is too large to send ({message_len} > {MAX_TO_DEVICE_CONTENT_SIZE})",
                        unpersistable=True,
                    )

                log_kv(
                    {
                        "event": "send_to_device_message",
                        "user_id": user_id,
                        "device_id": device_id,
                        EventContentFields.TO_DEVICE_MSGID: message_content.get(
                            EventContentFields.TO_DEVICE_MSGID
                        ),
                    }
                )

            # Ratelimit local cross-user key requests by the sending device.
            if (
                message_type == ToDeviceEventTypes.RoomKeyRequest
                and user_id != sender_user_id
            ):
                allowed, _ = await self._ratelimiter.can_do_action(
                    requester, (sender_user_id, requester.device_id)
                )
                if not allowed:
                    log_kv({"message": f"dropping key requests to {user_id}"})
                    logger.info(
                        "Dropping room_key_request from %s to %s due to rate limit",
                        sender_user_id,
                        user_id,
                    )
                    continue

            # we use UserID.from_string to catch invalid user ids
            if self.is_mine(UserID.from_string(user_id)):
                messages_by_device = {
                    device_id: {
                        "content": message_content,
                        "type": message_type,
                        "sender": sender_user_id,
                    }
                    for device_id, message_content in by_device.items()
                }
                if messages_by_device:
                    local_messages[user_id] = messages_by_device
            else:
                destination = get_domain_from_id(user_id)
                remote_messages.setdefault(destination, {})[user_id] = by_device

        # Add local messages to the database.
        # Retrieve the stream id of the last-processed to-device message.
        last_stream_id = (
            await self.store.add_local_messages_from_client_to_device_inbox(
                local_messages
            )
        )
        for destination, messages in remote_messages.items():
            split_edus = split_device_messages_into_edus(
                sender_user_id, message_type, messages
            )
            for edu in split_edus:
                edu["org.matrix.opentracing_context"] = json_encoder.encode(
                    get_active_span_text_map()
                )
                # Add remote messages to the database.
                last_stream_id = (
                    await self.store.add_remote_messages_from_client_to_device_inbox(
                        {destination: edu}
                    )
                )
                log_kv(
                    {
                        "destination": destination,
                        "message_id": edu["message_id"],
                    }
                )

        # Notify listeners that there are new to-device messages to process,
        # handing them the latest stream id.
        self.notifier.on_new_event(
            StreamKeyType.TO_DEVICE, last_stream_id, users=local_messages.keys()
        )

        if self.federation_sender:
            # Enqueue a new federation transaction to send the new
            # device messages to each remote destination.
            await self.federation_sender.send_device_messages(remote_messages.keys())

    async def get_events_for_dehydrated_device(
        self,
        requester: Requester,
        device_id: str,
        since_token: str | None,
        limit: int,
    ) -> DehydratedEvents:
        """Fetches up to `limit` events sent to `device_id` starting from `since_token`
        and returns the new since token. If there are no more messages, returns an empty
        array.

        Args:
            requester: the user requesting the messages
            device_id: ID of the dehydrated device
            since_token: stream id to start from when fetching messages
            limit: the number of messages to fetch
        Returns:
            A DehydratedEvents containing the to-device `events` and `stream_id` token that the
            client can provide in the next call to fetch the next batch of messages. If there are
            more messages which will arrive in the next batch, `limited` is True, otherwise False.
        """

        user_id = requester.user.to_string()

        # only allow fetching messages for the dehydrated device id currently associated
        # with the user
        dehydrated_device = await self.device_handler.get_dehydrated_device(user_id)
        if dehydrated_device is None:
            raise SynapseError(
                HTTPStatus.FORBIDDEN,
                "No dehydrated device exists",
                Codes.FORBIDDEN,
            )

        dehydrated_device_id, _ = dehydrated_device
        if device_id != dehydrated_device_id:
            raise SynapseError(
                HTTPStatus.FORBIDDEN,
                "You may only fetch messages for your dehydrated device",
                Codes.FORBIDDEN,
            )

        since_stream_id = 0
        if since_token:
            if not since_token.startswith("d"):
                raise SynapseError(
                    HTTPStatus.BAD_REQUEST,
                    "from parameter %r has an invalid format" % (since_token,),
                    errcode=Codes.INVALID_PARAM,
                )

            try:
                since_stream_id = int(since_token[1:])
            except Exception:
                raise SynapseError(
                    HTTPStatus.BAD_REQUEST,
                    "from parameter %r has an invalid format" % (since_token,),
                    errcode=Codes.INVALID_PARAM,
                )

        to_token = self.event_sources.get_current_token().to_device_key

        messages, stream_id = await self.store.get_messages_for_device(
            user_id, device_id, since_stream_id, to_token, limit
        )

        for message in messages:
            # Remove the message id before sending to client
            message_id = message.pop("message_id", None)
            if message_id:
                set_tag(SynapseTags.TO_DEVICE_EDU_ID, message_id)

        logger.debug(
            "Returning %d to-device messages between %d and %d (current token: %d) for "
            "dehydrated device %s, user_id %s",
            len(messages),
            since_stream_id,
            stream_id,
            to_token,
            device_id,
            user_id,
        )

        return DehydratedEvents(
            events=messages,
            stream_id=f"d{stream_id}",
            limited=(stream_id != to_token),
        )


def split_device_messages_into_edus(
    sender_user_id: str,
    message_type: str,
    messages_by_user_then_device: dict[str, dict[str, JsonDict]],
) -> list[JsonDict]:
    """
    This function takes many to-device messages and fits/splits them into several EDUs
    as necessary. We split the messages up as the overall request can overrun the
    `max_request_body_size` and prevent outbound federation traffic because of the size
    of the transaction (cf. `SOFT_MAX_EDU_SIZE`).

    Args:
        sender_user_id: The user that is sending the to-device messages.
        message_type: The type of to-device messages that are being sent.
        messages_by_user_then_device: Dictionary of recipient user_id to recipient device_id to message.

    Returns:
        Bin-packed list of EDU JSON content for the given to_device messages
    """
    split_edus_content: list[JsonDict] = []

    # The header size of the full EDU.
    base_edu_size = _EMPTY_EDU_SIZE + len(sender_user_id) + len(message_type)

    # First split up the top-level dict of user_id to device messages.
    for subset_messages, estimated_size in split_dict_to_fit_to_size(
        messages_by_user_then_device,
        soft_max_size=SOFT_MAX_EDU_SIZE,
        wrapping_object_size=base_edu_size,
    ):
        # The returned subset might be larger than the soft max size if it
        # contains a single entry that is larger than the soft max size.
        if estimated_size <= SOFT_MAX_EDU_SIZE:
            # This message fits in a single EDU, add it as is.
            content = create_new_to_device_edu_content(
                sender_user_id, message_type, subset_messages
            )
            split_edus_content.append(content)
            logger.debug(
                "Created EDU with %d recipients from %s (message_id=%s), (total EDUs so far: %d)",
                len(subset_messages),
                sender_user_id,
                content["message_id"],
                len(split_edus_content),
            )
        else:
            # This message doesn't fit in a single EDU. We split the message up
            # further by device.
            #
            # Note: `subset` should only have a single entry in it.
            for recipient, messages_by_device in subset_messages.items():
                # The header size of the EDU for this recipient, which includes
                # the size of the recipient user ID and the wrapping structure
                # for the device messages.
                subset_base_size = len(
                    encode_canonical_json(
                        _create_new_to_device_edu(
                            sender_user_id, message_type, {recipient: {}}
                        )
                    )
                )

                for subset_messages, _estimated_size in split_dict_to_fit_to_size(
                    messages_by_device,
                    soft_max_size=SOFT_MAX_EDU_SIZE,
                    wrapping_object_size=subset_base_size,
                ):
                    # Again, the returned subset might be larger than the soft
                    # max size, but we can't split it any further so we have to
                    # add it as is.
                    content = create_new_to_device_edu_content(
                        sender_user_id, message_type, {recipient: subset_messages}
                    )
                    split_edus_content.append(content)
                    logger.debug(
                        "Created EDU with %d recipients from %s (message_id=%s), (total EDUs so far: %d)",
                        len(subset_messages),
                        sender_user_id,
                        content["message_id"],
                        len(split_edus_content),
                    )

    return split_edus_content


def create_new_to_device_edu_content(
    sender_user_id: str,
    message_type: str,
    messages_by_user_then_device: dict[str, dict[str, JsonDict]],
) -> JsonDict:
    """
    Create a new `m.direct_to_device` EDU `content` object with a unique message ID.
    """
    # The EDU contains a "message_id" property which is used for
    # idempotence. Make up a random one.
    message_id = random_string_insecure_fast(16)
    content = {
        "sender": sender_user_id,
        "type": message_type,
        "message_id": message_id,
        "messages": messages_by_user_then_device,
    }
    return content


def _create_new_to_device_edu(
    sender_user_id: str,
    message_type: str,
    messages_by_user_then_device: dict[str, dict[str, JsonDict]],
) -> dict[str, Any]:
    """Create a new `m.direct_to_device` EDU, returning the full EDU dict."""
    return {
        "edu_type": EduTypes.DIRECT_TO_DEVICE,
        "content": create_new_to_device_edu_content(
            sender_user_id, message_type, messages_by_user_then_device
        ),
    }


# The size of an empty EDU with no messages, which we use as the base size when
# packing messages into EDUs. The size of the sender and message type must be
# added to this when calculating the size of an EDU.
_EMPTY_EDU_SIZE = len(encode_canonical_json(_create_new_to_device_edu("", "", {})))
