<commit_before>// Copyright (c) 2015 Mattermost, Inc. All Rights Reserved.
// See License.txt for license information.

package api

import (
	"crypto/tls"
	"fmt"
	"io/ioutil"
	"net/http"
	"net/url"
	"strings"

	l4g "github.com/alecthomas/log4go"
	"github.com/dotcominternet/platform/model"
	"github.com/dotcominternet/platform/utils"
	"github.com/gorilla/mux"
)

type CommandProvider interface {
	GetTrigger() string
	GetCommand(c *Context) *model.Command
	DoCommand(c *Context, channelId string, message string) *model.CommandResponse
}

var commandProviders = make(map[string]CommandProvider)

func RegisterCommandProvider(newProvider CommandProvider) {
	commandProviders[newProvider.GetTrigger()] = newProvider
}

func GetCommandProvider(name string) CommandProvider {
	provider, ok := commandProviders[name]
	if ok {
		return provider
	}

	return nil
}

func InitCommand(r *mux.Router) {
	l4g.Debug(utils.T("api.command.init.debug"))

	sr := r.PathPrefix("/commands").Subrouter()

	sr.Handle("/execute", ApiUserRequired(executeCommand)).Methods("POST")
	sr.Handle("/list", ApiUserRequired(listCommands)).Methods("GET")

	sr.Handle("/create", ApiUserRequired(createCommand)).Methods("POST")
	sr.Handle("/list_team_commands", ApiUserRequired(listTeamCommands)).Methods("GET")
	sr.Handle("/regen_token", ApiUserRequired(regenCommandToken)).Methods("POST")
	sr.Handle("/delete", ApiUserRequired(deleteCommand)).Methods("POST")

	sr.Handle("/test", ApiAppHandler(testCommand)).Methods("POST")
	sr.Handle("/test", ApiAppHandler(testCommand)).Methods("GET")
	sr.Handle("/test_e", ApiAppHandler(testEphemeralCommand)).Methods("POST")
	sr.Handle("/test_e", ApiAppHandler(testEphemeralCommand)).Methods("GET")
}

func listCommands(c *Context, w http.ResponseWriter, r *http.Request) {
	commands := make([]*model.Command, 0, 32)
	seen := make(map[string]bool)
	for _, value := range commandProviders {
		cpy := *value.GetCommand(c)
		if cpy.AutoComplete && !seen[cpy.Id] {
			cpy.Sanitize()
			seen[cpy.Trigger] = true
			commands = append(commands, &cpy)
		}
	}

	if *utils.Cfg.ServiceSettings.EnableCommands {
		if result := <-Srv.Store.Command().GetByTeam(c.Session.TeamId); result.Err != nil {
			c.Err = result.Err
			return
		} else {
			teamCmds := result.Data.([]*model.Command)
			for _, cmd := range teamCmds {
				if cmd.AutoComplete && !seen[cmd.Id] {
					cmd.Sanitize()
					seen[cmd.Trigger] = true
					commands = append(commands, cmd)
				}
			}
		}
	}

	w.Write([]byte(model.CommandListToJson(commands)))
}

func executeCommand(c *Context, w http.ResponseWriter, r *http.Request) {
	props := model.MapFromJson(r.Body)
	command := strings.TrimSpace(props["command"])
	channelId := strings.TrimSpace(props["channelId"])

	if len(command) <= 1 || strings.Index(command, "/") != 0 {
		c.Err = model.NewLocAppError("executeCommand", "api.command.execute_command.start.app_error", nil, "")
		return
	}

	if len(channelId) > 0 {
		cchan := Srv.Store.Channel().CheckPermissionsTo(c.Session.TeamId, channelId, c.Session.UserId)

		if !c.HasPermissionsToChannel(cchan, "checkCommand") {
			return
		}
	}

	parts := strings.Split(command, " ")
	trigger := parts[0][1:]
	message := strings.Join(parts[1:], " ")
	provider := GetCommandProvider(trigger)

	if provider != nil {
		response := provider.DoCommand(c, channelId, message)
		handleResponse(c, w, response, channelId, provider.GetCommand(c), true)
		return
	} else {

		if !*utils.Cfg.ServiceSettings.EnableCommands {
			c.Err = model.NewLocAppError("executeCommand", "api.command.disabled.app_error", nil, "")
			c.Err.StatusCode = http.StatusNotImplemented
			return
		}

		chanChan := Srv.Store.Channel().Get(channelId)
		teamChan := Srv.Store.Team().Get(c.Session.TeamId)
		userChan := Srv.Store.User().Get(c.Session.UserId)

		if result := <-Srv.Store.Command().GetByTeam(c.Session.TeamId); result.Err != nil {
			c.Err = result.Err
			return
		} else {

			var team *model.Team
			if tr := <-teamChan; tr.Err != nil {
				c.Err = tr.Err
				return
			} else {
				team = tr.Data.(*model.Team)

			}

			var user *model.User
			if ur := <-userChan; ur.Err != nil {
				c.Err = ur.Err
				return
			} else {
				user = ur.Data.(*model.User)
			}

			var channel *model.Channel
			if cr := <-chanChan; cr.Err != nil {
				c.Err = cr.Err
				return
			} else {
				channel = cr.Data.(*model.Channel)
			}

			teamCmds := result.Data.([]*model.Command)
			for _, cmd := range teamCmds {
				if trigger == cmd.Trigger {
					l4g.Debug(fmt.Sprintf(utils.T("api.command.execute_command.debug"), trigger, c.Session.UserId))

					p := url.Values{}
					p.Set("token", cmd.Token)

					p.Set("team_id", cmd.TeamId)
					p.Set("team_domain", team.Name)

					p.Set("channel_id", channelId)
					p.Set("channel_name", channel.Name)

					p.Set("user_id", c.Session.UserId)
					p.Set("user_name", user.Username)

					p.Set("command", "/"+trigger)
					p.Set("text", message)
					p.Set("response_url", "not supported yet")

					method := "POST"
					if cmd.Method == model.COMMAND_METHOD_GET {
						method = "GET"
					}

					tr := &http.Transport{
						TLSClientConfig: &tls.Config{InsecureSkipVerify: *utils.Cfg.ServiceSettings.EnableInsecureOutgoingConnections},
					}
					client := &http.Client{Transport: tr}

					req, _ := http.NewRequest(method, cmd.URL, strings.NewReader(p.Encode()))
					req.Header.Set("Accept", "application/json")
					if cmd.Method == model.COMMAND_METHOD_POST {
						req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
					}

					if resp, err := client.Do(req); err != nil {
						c.Err = model.NewLocAppError("command", "api.command.execute_command.failed.app_error", map[string]interface{}{"Trigger": trigger}, err.Error())
					} else {
						if resp.StatusCode == http.StatusOK {
							response := model.CommandResponseFromJson(resp.Body)
							if response == nil {
								c.Err = model.NewLocAppError("command", "api.command.execute_command.failed_empty.app_error", map[string]interface{}{"Trigger": trigger}, "")
							} else {
								handleResponse(c, w, response, channelId, cmd, false)
							}
						} else {
							body, _ := ioutil.ReadAll(resp.Body)
							c.Err = model.NewLocAppError("command", "api.command.execute_command.failed_resp.app_error", map[string]interface{}{"Trigger": trigger, "Status": resp.Status}, string(body))
						}
					}

					return
				}
			}

		}
	}

	c.Err = model.NewLocAppError("command", "api.command.execute_command.not_found.app_error", map[string]interface{}{"Trigger": trigger}, "")
}

func handleResponse(c *Context, w http.ResponseWriter, response *model.CommandResponse, channelId string, cmd *model.Command, builtIn bool) {

	post := &model.Post{}
	post.ChannelId = channelId

	if !builtIn {
		post.AddProp("from_webhook", "true")
	}

	if utils.Cfg.ServiceSettings.EnablePostUsernameOverride {
		if len(cmd.Username) != 0 {
			post.AddProp("override_username", cmd.Username)
		} else if len(response.Username) != 0 {
			post.AddProp("override_username", response.Username)
			//		} else {
			//			post.AddProp("override_username", model.DEFAULT_WEBHOOK_USERNAME)
		}
	}

	if utils.Cfg.ServiceSettings.EnablePostIconOverride {
		if len(cmd.IconURL) != 0 {
			post.AddProp("override_icon_url", cmd.IconURL)
		} else if len(response.IconURL) != 0 {
			post.AddProp("override_icon_url", response.IconURL)
			//		} else {
			//			post.AddProp("override_icon_url", model.DEFAULT_WEBHOOK_ICON)
		}
	}

	if len(response.Props) > 0 {
		for key, val := range response.Props {
			if key != "attachments" && key != "override_icon_url" && key != "override_username" && key != "from_webhook" {
				post.AddProp(key, val)
			}
		}
	}

	if response.ResponseType == model.COMMAND_RESPONSE_TYPE_IN_CHANNEL {
		post.Message = response.Text
		if _, err := CreatePost(c, post, true); err != nil {
			c.Err = model.NewLocAppError("command", "api.command.execute_command.save.app_error", nil, "")
		}
	} else if response.ResponseType == model.COMMAND_RESPONSE_TYPE_EPHEMERAL {
		post.Message = response.Text
		post.CreateAt = model.GetMillis()
		SendEphemeralPost(
			c.Session.TeamId,
			c.Session.UserId,
			post,
		)
	}

	w.Write([]byte(response.ToJson()))
}

func createCommand(c *Context, w http.ResponseWriter, r *http.Request) {
	if !*utils.Cfg.ServiceSettings.EnableCommands {
		c.Err = model.NewLocAppError("createCommand", "api.command.disabled.app_error", nil, "")
		c.Err.StatusCode = http.StatusNotImplemented
		return
	}

	if *utils.Cfg.ServiceSettings.EnableOnlyAdminIntegrations {<commit_msg>Allow commands to override from_webhook if they are responding as the invoking user<commit_after>// Copyright (c) 2015 Mattermost, Inc. All Rights Reserved.
// See License.txt for license information.

package api

import (
	"crypto/tls"
	"fmt"
	"io/ioutil"
	"net/http"
	"net/url"
	"strings"

	l4g "github.com/alecthomas/log4go"
	"github.com/dotcominternet/platform/model"
	"github.com/dotcominternet/platform/utils"
	"github.com/gorilla/mux"
)

type CommandProvider interface {
	GetTrigger() string
	GetCommand(c *Context) *model.Command
	DoCommand(c *Context, channelId string, message string) *model.CommandResponse
}

var commandProviders = make(map[string]CommandProvider)

func RegisterCommandProvider(newProvider CommandProvider) {
	commandProviders[newProvider.GetTrigger()] = newProvider
}

func GetCommandProvider(name string) CommandProvider {
	provider, ok := commandProviders[name]
	if ok {
		return provider
	}

	return nil
}

func InitCommand(r *mux.Router) {
	l4g.Debug(utils.T("api.command.init.debug"))

	sr := r.PathPrefix("/commands").Subrouter()

	sr.Handle("/execute", ApiUserRequired(executeCommand)).Methods("POST")
	sr.Handle("/list", ApiUserRequired(listCommands)).Methods("GET")

	sr.Handle("/create", ApiUserRequired(createCommand)).Methods("POST")
	sr.Handle("/list_team_commands", ApiUserRequired(listTeamCommands)).Methods("GET")
	sr.Handle("/regen_token", ApiUserRequired(regenCommandToken)).Methods("POST")
	sr.Handle("/delete", ApiUserRequired(deleteCommand)).Methods("POST")

	sr.Handle("/test", ApiAppHandler(testCommand)).Methods("POST")
	sr.Handle("/test", ApiAppHandler(testCommand)).Methods("GET")
	sr.Handle("/test_e", ApiAppHandler(testEphemeralCommand)).Methods("POST")
	sr.Handle("/test_e", ApiAppHandler(testEphemeralCommand)).Methods("GET")
}

func listCommands(c *Context, w http.ResponseWriter, r *http.Request) {
	commands := make([]*model.Command, 0, 32)
	seen := make(map[string]bool)
	for _, value := range commandProviders {
		cpy := *value.GetCommand(c)
		if cpy.AutoComplete && !seen[cpy.Id] {
			cpy.Sanitize()
			seen[cpy.Trigger] = true
			commands = append(commands, &cpy)
		}
	}

	if *utils.Cfg.ServiceSettings.EnableCommands {
		if result := <-Srv.Store.Command().GetByTeam(c.Session.TeamId); result.Err != nil {
			c.Err = result.Err
			return
		} else {
			teamCmds := result.Data.([]*model.Command)
			for _, cmd := range teamCmds {
				if cmd.AutoComplete && !seen[cmd.Id] {
					cmd.Sanitize()
					seen[cmd.Trigger] = true
					commands = append(commands, cmd)
				}
			}
		}
	}

	w.Write([]byte(model.CommandListToJson(commands)))
}

func executeCommand(c *Context, w http.ResponseWriter, r *http.Request) {
	props := model.MapFromJson(r.Body)
	command := strings.TrimSpace(props["command"])
	channelId := strings.TrimSpace(props["channelId"])

	if len(command) <= 1 || strings.Index(command, "/") != 0 {
		c.Err = model.NewLocAppError("executeCommand", "api.command.execute_command.start.app_error", nil, "")
		return
	}

	if len(channelId) > 0 {
		cchan := Srv.Store.Channel().CheckPermissionsTo(c.Session.TeamId, channelId, c.Session.UserId)

		if !c.HasPermissionsToChannel(cchan, "checkCommand") {
			return
		}
	}

	parts := strings.Split(command, " ")
	trigger := parts[0][1:]
	message := strings.Join(parts[1:], " ")
	provider := GetCommandProvider(trigger)

	if provider != nil {
		response := provider.DoCommand(c, channelId, message)
		handleResponse(c, w, response, channelId, provider.GetCommand(c), true)
		return
	} else {

		if !*utils.Cfg.ServiceSettings.EnableCommands {
			c.Err = model.NewLocAppError("executeCommand", "api.command.disabled.app_error", nil, "")
			c.Err.StatusCode = http.StatusNotImplemented
			return
		}

		chanChan := Srv.Store.Channel().Get(channelId)
		teamChan := Srv.Store.Team().Get(c.Session.TeamId)
		userChan := Srv.Store.User().Get(c.Session.UserId)

		if result := <-Srv.Store.Command().GetByTeam(c.Session.TeamId); result.Err != nil {
			c.Err = result.Err
			return
		} else {

			var team *model.Team
			if tr := <-teamChan; tr.Err != nil {
				c.Err = tr.Err
				return
			} else {
				team = tr.Data.(*model.Team)

			}

			var user *model.User
			if ur := <-userChan; ur.Err != nil {
				c.Err = ur.Err
				return
			} else {
				user = ur.Data.(*model.User)
			}

			var channel *model.Channel
			if cr := <-chanChan; cr.Err != nil {
				c.Err = cr.Err
				return
			} else {
				channel = cr.Data.(*model.Channel)
			}

			teamCmds := result.Data.([]*model.Command)
			for _, cmd := range teamCmds {
				if trigger == cmd.Trigger {
					l4g.Debug(fmt.Sprintf(utils.T("api.command.execute_command.debug"), trigger, c.Session.UserId))

					p := url.Values{}
					p.Set("token", cmd.Token)

					p.Set("team_id", cmd.TeamId)
					p.Set("team_domain", team.Name)

					p.Set("channel_id", channelId)
					p.Set("channel_name", channel.Name)

					p.Set("user_id", c.Session.UserId)
					p.Set("user_name", user.Username)

					p.Set("command", "/"+trigger)
					p.Set("text", message)
					p.Set("response_url", "not supported yet")

					method := "POST"
					if cmd.Method == model.COMMAND_METHOD_GET {
						method = "GET"
					}

					tr := &http.Transport{
						TLSClientConfig: &tls.Config{InsecureSkipVerify: *utils.Cfg.ServiceSettings.EnableInsecureOutgoingConnections},
					}
					client := &http.Client{Transport: tr}

					req, _ := http.NewRequest(method, cmd.URL, strings.NewReader(p.Encode()))
					req.Header.Set("Accept", "application/json")
					if cmd.Method == model.COMMAND_METHOD_POST {
						req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
					}

					if resp, err := client.Do(req); err != nil {
						c.Err = model.NewLocAppError("command", "api.command.execute_command.failed.app_error", map[string]interface{}{"Trigger": trigger}, err.Error())
					} else {
						if resp.StatusCode == http.StatusOK {
							response := model.CommandResponseFromJson(resp.Body)
							if response == nil {
								c.Err = model.NewLocAppError("command", "api.command.execute_command.failed_empty.app_error", map[string]interface{}{"Trigger": trigger}, "")
							} else {
								handleResponse(c, w, response, channelId, cmd, false)
							}
						} else {
							body, _ := ioutil.ReadAll(resp.Body)
							c.Err = model.NewLocAppError("command", "api.command.execute_command.failed_resp.app_error", map[string]interface{}{"Trigger": trigger, "Status": resp.Status}, string(body))
						}
					}

					return
				}
			}

		}
	}

	c.Err = model.NewLocAppError("command", "api.command.execute_command.not_found.app_error", map[string]interface{}{"Trigger": trigger}, "")
}

func handleResponse(c *Context, w http.ResponseWriter, response *model.CommandResponse, channelId string, cmd *model.Command, builtIn bool) {

	post := &model.Post{}
	post.ChannelId = channelId

	defaultUser := false
	defaultIcon := false

	if utils.Cfg.ServiceSettings.EnablePostUsernameOverride {
		if len(cmd.Username) != 0 {
			post.AddProp("override_username", cmd.Username)
		} else if len(response.Username) != 0 {
			post.AddProp("override_username", response.Username)
			//		} else {
			//			post.AddProp("override_username", model.DEFAULT_WEBHOOK_USERNAME)
		} else {
			defaultUser = true
		}
	}

	if utils.Cfg.ServiceSettings.EnablePostIconOverride {
		if len(cmd.IconURL) != 0 {
			post.AddProp("override_icon_url", cmd.IconURL)
		} else if len(response.IconURL) != 0 {
			post.AddProp("override_icon_url", response.IconURL)
			//		} else {
			//			post.AddProp("override_icon_url", model.DEFAULT_WEBHOOK_ICON)
		} else {
			defaultIcon = true
		}
	}

	notBot := false
	if len(response.Props) > 0 {
		for key, val := range response.Props {
			if key == "from_webhook" {
				if val == "false" {
					notBot = true
				}
			} else if key != "attachments" && key != "override_icon_url" && key != "override_username" && key != "from_webhook" {
				post.AddProp(key, val)
			}
		}
	}

	if !builtIn && !(defaultUser && defaultIcon && notBot) {
		post.AddProp("from_webhook", "true")
	}

	if response.ResponseType == model.COMMAND_RESPONSE_TYPE_IN_CHANNEL {
		post.Message = response.Text
		if _, err := CreatePost(c, post, true); err != nil {
			c.Err = model.NewLocAppError("command", "api.command.execute_command.save.app_error", nil, "")
		}
	} else if response.ResponseType == model.COMMAND_RESPONSE_TYPE_EPHEMERAL {
		post.Message = response.Text
		post.CreateAt = model.GetMillis()
		SendEphemeralPost(
			c.Session.TeamId,
			c.Session.UserId,
			post,
		)
	}

	w.Write([]byte(response.ToJson()))
}

func createCommand(c *Context, w http.ResponseWriter, r *http.Request) {
	if !*utils.Cfg.ServiceSettings.EnableCommands {
		c.Err = model.NewLocAppError("createCommand", "api.command.disabled.app_error", nil, "")
		c.Err.StatusCode = http.StatusNotImplemented
		return
	}

	if *utils.Cfg.ServiceSettings.EnableOnlyAdminIntegrations {
{'fraction_non_alphanumeric': 0.15592909184785728, 'fraction_numerical': 0.002524238425793127, 'mean_word_length': 3.938243626062323, 'pattern_counts': {'":': 10, '<': 15, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6908486', 'n_tokens_mistral': 6715, 'n_tokens_neox': 5877, 'n_words': 1034}