# frozen_string_literal: true

class GraphqlController < ApplicationController
  include Gitlab::Auth::AuthFinders
  extend ::Gitlab::Utils::Override

  ERROR_STATUS_MAP = {
    StandardError => { status: :internal },

    # ApplicationController has similar rescues but we declare these again here because the
    # `rescue_from StandardError` above would prevent these from bubbling up to ApplicationController.
    # These also return errors in a JSON format similar to GraphQL errors.
    ActionController::InvalidAuthenticityToken => { status: :unprocessable_entity },

    # Domain errors -> 422
    Gitlab::Graphql::Variables::Invalid => { status: :unprocessable_entity },
    Gitlab::Graphql::Errors::ArgumentError => { status: :unprocessable_entity },
    Issuables::GroupMembersFilterable::TooManyGroupMembersError => { status: :unprocessable_entity },
    Issuables::GroupMembersFilterable::TooManyAssignedIssuesError => { status: :unprocessable_entity },

    # Auth errors
    Gitlab::Auth::RestrictedLanguageServerClientError => { status: :unauthorized },
    Gitlab::Auth::DpopValidationError => { status: :unauthorized },

    # # Other errors
    Gitlab::Auth::TooManyIps => { status: :forbidden },
    RateLimitedService::RateLimitedError => { status: :too_many_requests },
    Gitlab::Git::ResourceExhaustedError => { status: :service_unavailable },
    ActiveRecord::QueryAborted => { status: :service_unavailable },
    ActiveRecord::QueryCanceled => {
      status: :service_unavailable,
      custom_message: 'Request timed out. Please try a less complex query or a smaller set of records.'
    }
  }.freeze

  # Unauthenticated users have access to the API for public data
  skip_before_action :authenticate_user!
  # This is already handled by authorize_access_api!
  skip_before_action :active_user_check
  # CSRF protection is only necessary when the request is authenticated via a session cookie.
  # Also, we allow anonymous users to access the API without a CSRF token so that it is easier for users
  # to get started with our GraphQL API.
  skip_before_action :verify_authenticity_token, if: -> {
    current_user.nil? || sessionless_user? || !any_mutating_query?
  }
  skip_before_action :check_two_factor_requirement, if: -> { sessionless_user? }

  # Header can be passed by tests to disable SQL query limits.
  DISABLE_SQL_QUERY_LIMIT_HEADER = 'HTTP_X_GITLAB_DISABLE_SQL_QUERY_LIMIT'

  # Max size of the query text in characters
  MAX_QUERY_SIZE = 10_000

  # Operations temporarily allowed to exceed MAX_QUERY_SIZE during the
  # work-item widgets => features migration. Remove entries as the migration
  # completes. Tracked in https://gitlab.com/gitlab-org/gitlab/-/issues/587970
  EXTENDED_QUERY_SIZE_ALLOWLIST = %w[
    workItemById
    namespaceWorkItem
    workItemUpdate
    createWorkItem
    workItemConvert
    addLinkedItems
    workItemUpdated
    getWorkItemsFull
    getWorkItemsFullEE
    getWorkItemsSlim
    getWorkItemsSlimEE
  ].to_set.freeze

  EXTENDED_MAX_QUERY_SIZE = 12_000

  # The query string of a standard IntrospectionQuery, used to compare incoming requests for caching
  CACHED_INTROSPECTION_QUERY_STRING = CachedIntrospectionQuery.query_string
  INTROSPECTION_QUERY_OPERATION_NAME = 'IntrospectionQuery'

  # must come first: current_user is set up here
  prepend_before_action { authenticate_sessionless_user!(:graphql_api) }

  before_action :authorize_access_api!
  before_action(only: [:execute]) { check_dpop! }
  before_action :set_user_last_activity
  before_action :track_vs_code_usage
  before_action :track_jetbrains_usage
  before_action :track_jetbrains_bundled_usage
  before_action :track_gitlab_cli_usage
  before_action :track_visual_studio_usage
  before_action :track_neovim_plugin_usage
  before_action :disable_query_limiting
  before_action :limit_query_size
  before_action :enforce_language_server_restrictions

  before_action :disallow_mutations_for_get

  # Since we deactivate authentication from the main ApplicationController and
  # defer it to :authorize_access_api!, we need to override the bypass session
  # callback execution order here
  around_action :sessionless_bypass_admin_mode!, if: :sessionless_user?

  # The default feature category is overridden to read from request
  feature_category :not_owned # rubocop:todo Gitlab/AvoidFeatureCategoryNotOwned

  # We don't know what the query is going to be, so we can't set a high urgency
  # See https://gitlab.com/groups/gitlab-org/-/epics/5841 for the work that will
  # allow us to specify an urgency per query.
  # Currently, all queries have a default urgency. And this is measured in the `graphql_queries`
  # SLI. But queries could be multiplexed, so the total duration could be longer.
  urgency :low, [:execute]

  rescue_from(*ERROR_STATUS_MAP.keys, with: :handle_exception)

  def execute
    result = if multiplex?
               execute_multiplex
             else
               introspection_query? ? execute_introspection_query : execute_query
             end

    render json: result
  end

  def handle_internal_error(exception)
    if Rails.env.test? || Rails.env.development?
      render_error("Internal server error: #{exception.message}", raised_at: exception.backtrace[0..10].join(' <-- '))
    else
      render_error("Internal server error")
    end
  end

  override :feature_category
  def feature_category
    ::Gitlab::FeatureCategories.default.from_request(request) || super
  end

  private

  def handle_exception(exception)
    @exception_object = exception
    http_status = ERROR_STATUS_MAP.dig(exception.class, :status)
    custom_message = ERROR_STATUS_MAP.dig(exception.class, :custom_message)

    response.headers.merge!(exception.headers) if exception.respond_to?(:headers)

    # For exceptions that support logging of the request
    exception.try(:log_request, request, current_user)

    log_exception(exception)

    return handle_internal_error(exception) if http_status.nil? || http_status == :internal

    render_error(custom_message || exception.message, status: http_status)
  end

  def check_dpop!
    return unless !!sessionless_user? # DPoP is only enforced on token-based authentication
    return unless current_user && Feature.enabled?(:dpop_authentication, current_user)

    token = extract_personal_access_token
    return unless PersonalAccessToken.find_by_token(token.to_s) # The token is not PAT, exit early

    # For authenticated requests we check if the user has DPoP enabled
    ::Auth::DpopAuthenticationService.new(current_user: current_user,
      personal_access_token_plaintext: token,
      request: current_request).execute
  end

  def enforce_language_server_restrictions
    response = Gitlab::Auth::EditorExtensions::LanguageServerClientVerifier.new(
      current_user: current_user,
      request: current_request
    ).execute

    raise Gitlab::Auth::RestrictedLanguageServerClientError, response.message if response.error?
  end

  def permitted_params
    @permitted_params ||= multiplex? ? permitted_multiplex_params : permitted_standalone_query_params
  end

  def permitted_standalone_query_params
    params.permit(:query, :operationName, :remove_deprecated, variables: {}).tap do |permitted_params|
      permitted_params[:variables] = params[:variables]
    end
  end

  def permitted_multiplex_params
    params.permit(:remove_deprecated, _json: [:query, :operationName, { variables: {} }])
  end

  def disallow_mutations_for_get
    return unless request.get? || request.head?
    return unless any_mutating_query?

    raise ::Gitlab::Graphql::Errors::ArgumentError, "Mutations are forbidden in #{request.request_method} requests"
  end

  def limit_query_size
    if multiplex?
      total_size = multiplex_param.sum { |query_info| query_info[:query].size }
      raise ::Gitlab::Graphql::Errors::ArgumentError, "Query too large" if total_size > MAX_QUERY_SIZE
    else
      max = if permitted_params[:operationName].to_s.in?(EXTENDED_QUERY_SIZE_ALLOWLIST)
              EXTENDED_MAX_QUERY_SIZE
            else
              MAX_QUERY_SIZE
            end

      raise ::Gitlab::Graphql::Errors::ArgumentError, "Query too large" if query.size > max
    end
  end

  def any_mutating_query?
    if multiplex?
      multiplex_param.any? { |q| mutation?(q[:query], q[:operationName]) }
    else
      mutation?(query)
    end
  end

  def mutation?(query_string, operation_name = permitted_params[:operationName])
    parsed = GraphQL.parse(query_string)
    operations = parsed.definitions.select { |d| d.is_a?(GraphQL::Language::Nodes::OperationDefinition) }

    if operation_name.present?
      target = operations.find { |op| op.name == operation_name }
      return target.operation_type == "mutation" if target
    end

    operations.any? { |op| op.operation_type == "mutation" }
  rescue GraphQL::ParseError
    false
  end

  # Tests may mark some GraphQL queries as exempt from SQL query limits
  def disable_query_limiting
    return unless Gitlab::QueryLimiting.enabled_for_env?

    disable_reference = request.headers[DISABLE_SQL_QUERY_LIMIT_HEADER]
    return unless disable_reference

    first, second = disable_reference.split(',')

    if first.match?(/^\d+$/)
      Gitlab::QueryLimiting.disable!(second, new_threshold: first&.to_i)
    else
      Gitlab::QueryLimiting.disable!(first)
    end
  end

  def set_user_last_activity
    return unless current_user

    # TODO: add namespace & project - https://gitlab.com/gitlab-org/gitlab/-/issues/387951
    Users::ActivityService.new(author: current_user).execute
  end

  def track_vs_code_usage
    Gitlab::UsageDataCounters::VSCodeExtensionActivityUniqueCounter
      .track_api_request_when_trackable(user_agent: request.user_agent, user: current_user)
  end

  def track_jetbrains_usage
    Gitlab::UsageDataCounters::JetBrainsPluginActivityUniqueCounter
      .track_api_request_when_trackable(user_agent: request.user_agent, user: current_user)
  end

  def track_jetbrains_bundled_usage
    Gitlab::UsageDataCounters::JetBrainsBundledPluginActivityUniqueCounter
      .track_api_request_when_trackable(user_agent: request.user_agent, user: current_user)
  end

  def track_visual_studio_usage
    Gitlab::UsageDataCounters::VisualStudioExtensionActivityUniqueCounter
      .track_api_request_when_trackable(user_agent: request.user_agent, user: current_user)
  end

  def track_neovim_plugin_usage
    Gitlab::UsageDataCounters::NeovimPluginActivityUniqueCounter
      .track_api_request_when_trackable(user_agent: request.user_agent, user: current_user)
  end

  def track_gitlab_cli_usage
    Gitlab::UsageDataCounters::GitLabCliActivityUniqueCounter
      .track_api_request_when_trackable(user_agent: request.user_agent, user: current_user)
  end

  def execute_multiplex
    GitlabSchema.multiplex(multiplex_queries, context: context)
  end

  def execute_query
    variables = build_variables(permitted_params[:variables])
    operation_name = permitted_params[:operationName]
    GitlabSchema.execute(query, variables: variables, context: context, operation_name: operation_name)
  end

  def query
    @query ||= GraphQL::Language.escape_single_quoted_newlines(permitted_params.fetch(:query, '').to_s)
  end

  def multiplex_param
    permitted_multiplex_params[:_json]
  end

  def multiplex_queries
    multiplex_param.map do |single_query_info|
      {
        query: single_query_info[:query],
        variables: build_variables(single_query_info[:variables]),
        operation_name: single_query_info[:operationName],
        context: context
      }
    end
  end

  # When modifying the context, also update GraphqlChannel#context if needed
  # so that we have similar context when executing queries, mutations, and subscriptions
  def context
    api_user = !!sessionless_user?
    @context ||= {
      current_user: current_user,
      is_sessionless_user: api_user,
      current_organization: Current.organization,
      request: request,
      scope_validator: ::Gitlab::Auth::ScopeValidator.new(api_user, request_authenticator),
      remove_deprecated: Gitlab::Utils.to_boolean(permitted_params[:remove_deprecated], default: false),
      access_token: access_token
    }
  end

  def build_variables(variable_info)
    Gitlab::Graphql::Variables.new(variable_info).to_h
  end

  # We support Apollo-style query batching where an array of queries will be in the `_json:` key.
  # https://graphql-ruby.org/queries/multiplex.html#apollo-query-batching
  def multiplex?
    params[:_json].is_a?(Array)
  end

  def authorize_access_api!
    if current_user.nil? &&
        request_authenticator.authentication_token_present?
      return render_error('Invalid token', status: :unauthorized)
    end

    return if can?(current_user, :access_api)

    render_error('API not accessible for user', status: :forbidden)
  end

  # Overridden from the ApplicationController to make the response look like
  # a GraphQL response. That is nicely picked up in Graphiql.
  def render_404
    render_error("Not found!", status: :not_found)
  end

  def render_error(message, status: 500, raised_at: nil)
    error = { errors: [message: message] }
    error[:errors].first['raisedAt'] = raised_at if raised_at

    render json: error, status: status
  end

  def append_info_to_payload(payload)
    super

    # Merging to :metadata will ensure these are logged as top level keys
    payload[:metadata] ||= {}
    payload[:metadata][:graphql] = logs

    payload[:exception_object] = @exception_object if @exception_object
  end

  def logs
    RequestStore.store[:graphql_logs].to_a
  end

  def execute_introspection_query
    context[:introspection] = true

    return execute_query if Gitlab.dev_or_test_env?

    load_static_schema
  end

  def load_static_schema
    @static_schema ||= begin
      schema_path = if Gitlab::Utils.to_boolean(permitted_params[:remove_deprecated]) === true
                      Rails.root.join("public/-/graphql/introspection_result_no_deprecated.json")
                    else
                      Rails.root.join("public/-/graphql/introspection_result.json")
                    end

      if File.exist?(schema_path)
        # rubocop:disable Gitlab/JsonSafeParse -- safe_parse has to restrictive limits for the introspection query result
        Gitlab::Json.parse(File.read(schema_path))
        # rubocop:enable Gitlab/JsonSafeParse
      else
        execute_query
      end
    end
  end

  def introspection_query?
    if permitted_params.key?(:operationName)
      permitted_params[:operationName] == INTROSPECTION_QUERY_OPERATION_NAME
    else
      query.include?('__schema') ||
        (query.include?('__type') && query.exclude?('__typename')) ||
        graphql_query_object.selected_operation_name == INTROSPECTION_QUERY_OPERATION_NAME
    end
  end

  def graphql_query_object
    @graphql_query_object ||= GraphQL::Query.new(GitlabSchema, query: query,
      variables: build_variables(permitted_params[:variables]))
  end
end

GraphqlController.prepend_mod_with('GraphqlController')