bindAPI/src/Controller/RequestController.php

<?php declare(strict_types=1);

namespace App\Controller;

error_reporting(error_level: E_ALL);

use App\Repository\ApikeyRepository;
use App\Repository\DomainRepository;
use DI\Container;
use DI\ContainerBuilder;
use OpenApi\Annotations\ServerVariable;
use OpenApi\Annotations\Tag;
use OpenApi\Generator;
use UnhandledMatchError;
use function DI\autowire;
use OpenApi\Attributes as OAT;

/**
 *
 */
#[OAT\Info(version: '0.0.1', title: 'bindAPI' )]
class RequestController
{
	//private DatabaseConnection $databaseConnection;
	private DomainRepository $domainRepository;
	private ApikeyRepository $apikeyRepository;
	private Container $container;
	private string $header;
	private array $result;
	private string $status;
	private string $message;
	
	/**
	 * @param array  $config
	 * @param String $requestMethod
	 * @param array  $uri
	 *
	 * @throws \Exception
	 */
	public function __construct(private array $config, private string $requestMethod, private array $uri)
	{
		$this->requestMethod = strtoupper(string: $requestMethod);
		
		$containerBuilder = new ContainerBuilder();
		$containerBuilder->addDefinitions([
			DatabaseConnection::class => autowire()->constructorParameter(parameter: 'config', value: $this->config),
		]);
		$this->container = $containerBuilder->build();
		
		$this->domainRepository = $this->container->get(name: DomainRepository::class);
		$this->apikeyRepository = $this->container->get(name: ApikeyRepository::class);
		
	}

	
	/**
	 * @OA\Server(
	 *   url = "https://ns2.24unix.net/api"
	 * )
	 * @OA\Tag(name = "Server")
	 * @OA\Get(
	 *     path = "/ping",
	 *     summary = "Returning pong.",
	 *     description = "Can be used to check API or server availability.",
	 *     tags={"Server"},
	 *     @OA\Response(response = "200", description = "OK"),
	 *     @OA\Response(response = "401", description = "API key is missing or invalid."),
	 *     security={
	 *         {"Authorization":{"read"}}
	 *     }
	 * )
	 *
	 * @OA\SecurityScheme (name="bindAPISecurity",
	 *     type="apiKey",
	 *     description="description",
	 *     name="X-API-Key",
	 *     in="header",
	 *     securityScheme="Authorization"
	 *
	 * )
	 * @SwaggerDefinition(
	 *     securityDefinition = @SecurityDefinition(
	 *         apiKeyAuthDefinitions = {
	 *             @ApiKeyAuthDefinition(
	 *                 key = "X-API-Key", in = ApiKeyAuthDefinition.ApiKeyLocation.HEADER, name = "X-API-KEY"
	 *             )
	 *         }
	 *     )
	 * )
	 * @OA\Tag(name = "Domains")
	 * @OA\Get(
	 *     path="/domains",
	 *     summary="Listing all domains.",
	 *     description="desc",
	 *     tags={"Domains"},
	 *     @OA\Response(response="200", description="OK"),
	 *     @OA\Response(response = "401", description = "API key is missing or invalid."),
	 *     @OA\Response(response="404", description="Domain not found."),
	 *     security={
	 *         {"Authorization":{"read":"write"}}
	 *     }
	 * )
	 * @OA\Post(
	 *     path="/domains",
	 *     summary="Create a domain.",
	 *     description="Creates a new domain.",
	 *     tags={"Domains"},
	 *     @OA\Response(response="201", description="Created"),
	 *     @OA\Response(response = "400", description = "Invalid request body."),
	 *     @OA\Response(response = "401", description = "API key is missing or invalid."),
	 *     @OA\Response(response="404", description="Domain not found."),
	 *     security={
	 *         {"Authorization":{"read":"write"}}
	 *     }
	 * )
	 * @OA\Get(
	 *     path="/domains/{name}",
	 *     summary="Returns a single domain.",
	 *     description="Returns information of a single domain specified by its domain name.",
	 *     tags={"Domains"},
	 *     @OA\Response(response="200", description="OK"),
	 *     @OA\Response(response = "401", description = "API key is missing or invalid."),
	 *     @OA\Response(response="404", description="Domain not found."),
	 *     security={
	 *         {"Authorization":{"read":"write"}}
	 *     }
	 * )
	 * @OA\Put(
	 *     path="/domains/{name}",
	 *     summary="Updates a domain.",
	 *     description="Updates a domain. Only supplied fields will be updated, existing won't be affected.",
	 *     tags={"Domains"},
	 *     @OA\Response(response="200", description="OK"),
	 *     @OA\Response(response = "401", description = "API key is missing or invalid."),
	 *     @OA\Response(response="404", description="Domain not found."),
	 *     security={
	 *         {"Authorization":{"read":"write"}}
	 *     }
	 * )
	 * @OA\Delete (
	 *     path="/domains/{name}",
	 *     summary="Deletes a domain.",
	 *     description="Deletes a domain.",
	 *     tags={"Domains"},
	 *     @OA\Response(response="200", description="OK"),
	 *     @OA\Response(response = "401", description = "API key is missing or invalid."),
	 *     @OA\Response(response="404", description="Domain not found."),
	 *     security={
	 *         {"Authorization":{"read":"write"}}
	 *     }
	 * )
	 *
	 * @return void
	 */
	public function processRequest()
	{
		$command = $this->uri[2];
		
		if (empty($command) || !(($command == 'domains') || ($command == 'ping') || ($command == 'apidoc'))) {
			$this->header = '404 Not Found';
			$this->status = "404 Not Found";
			$this->message = "Endpoint not found.";
		} else {
			if ($command == 'apidoc') {
				$openapi = Generator::scan(sources: [__DIR__ . 'RequestController.php']);
				$this->status = 'openapi';
				$this->result[] = $openapi->toJson();
			} else {
				if ($this->checkPassword()) {
					
					if ($this->uri[2] == "ping") {
						$this->header = '200 OK';
						$this->status = 'pong';
					} else {
						try {
							match ($this->requestMethod) {
								'GET' => $this->handleDomainGetRequest(),
								'POST' => $this->handleDomainPostRequest(),
								'PUT' => $this->handleDomainPutRequest(),
								'DELETE' => $this->handleDomainDeleteRequest()
							};
						} catch (UnhandledMatchError) {
							$this->header = '400 Bad Request';
							$this->status = '400 Bad Request';
							$this->message = "unknown request method: $this->requestMethod";
						}
					}
				}
			}
			
			if (!empty($this->header)) {
				header(header: $_SERVER['SERVER_PROTOCOL'] . ' ' . $this->header);
			}
			if (!empty($this->result)) {
				if (!empty($this->status) && $this->status == 'openapi') {
					header(header: 'Content-Type: application/json');
					echo $this->result[0];
				} else {
					echo json_encode(value: $this->result);
				}
			} else {
				if (!empty($this->status) && $this->status == 'pong') {
					echo json_encode(value: [
						'response' => $this->status
					]);
				} else {
					echo json_encode(value: [
						'status'  => $this->status ?? "Error: No status",
						'message' => $this->message ?? "Error: No message."
					]);
				}
			}
		}
	}
	
	
	/**
	 * @return bool
	 */
	public function checkPassword(): bool
	{
		$headers = array_change_key_case(array: getallheaders(), case: CASE_UPPER);
		$apiKey = $headers['X-API-KEY'] ?? '';
		
		if (empty($apiKey)) {
			$this->header = "401 Unauthorized";
			$this->status = "401 Unauthorized";
			$this->message = "API key is missing.";
			return false;
		} else {
			[$prefix,] = explode(separator: '.', string: $apiKey);
			if ($apiResult = $this->apikeyRepository->findByPrefix(prefix: $prefix)) {
				$storedHash = $apiResult->getApiToken();
				if (!password_verify(password: $apiKey, hash: $storedHash)) {
					$this->header = "401 Unauthorized";
					$this->status = "401 Unauthorized";
					$this->message = "API key mismatch.";
					return false;
				}
			} else {
				$this->header = "401 Unauthorized";
				$this->status = "401 Unauthorized";
				$this->message = "Invalid API key.";
				return false;
			}
		}
		return true;
	}
	
	/**
	 * @return void
	 */
	public function handleDomainGetRequest(): void
	{
		if (empty($this->uri[3])) {
			$domains = $this->domainRepository->findAll();
			$resultDomain = [];
			foreach ($domains as $singleDomain) {
				$domain = [
					'id'       => $singleDomain->getId(),
					'name'     => $singleDomain->getName(),
					'panel_id' => $singleDomain->getPanelId(),
					'a'        => $singleDomain->getA(),
					'aaaa'     => $singleDomain->getAaaa()
				];
				$resultDomain[] = $domain;
			}
			$this->result = $resultDomain;
		} else {
			if ($result = $this->domainRepository->findByName(name: $this->uri[3])) {
				$domain = [
					'id'       => $result->getId(),
					'name'     => $result->getName(),
					'panel_id' => $result->getPanelId(),
					'a'        => $result->getA(),
					'aaaa'     => $result->getAaaa()
				];
				$this->result = $domain;
			} else {
				$this->header = "404 Not Found ";
				$this->status = "404 Not Found ";
				$this->message = "The specified domain was not found.";
			}
		}
	}
	
	
	/**
	 * @return void
	 */
	public
	function handleDomainPostRequest(): void
	{
		$name = $_POST['name'] ?? '';
		$panelID = intval(value: $_POST['panel_id'] ?? 0);
		$a = $_POST['a'] ?? '';
		$aaaa = $_POST['aaaa'] ?? '';
		if (empty($name)) {
			$this->header = "400 Bad Request";
			$this->status = "400 Bad Request";
			$this->message = "A name is required";
		} else {
			if (empty($a) && empty($aaaa) && empty($panelID)) {
				$this->header = "400 Bad Request";
				$this->status = "400 Bad Request";
				$this->message = "At least one IP address or panel ID is required.";
			} else {
				if ($this->domainRepository->findByName(name: $name)) {
					$this->header = "400 Bad request";
					$this->status = "400 Bad request";
					$this->message = "Domain: $name already exists.";
				} else {
					$result = $this->domainRepository->insert(name: $name, panelID: $panelID, a: $a, aaaa: $aaaa);
					$this->status = "201 Created";
					$this->message = $result;
				}
			}
		}
	}
	
	
	/**
	 * @return void
	 */
	public
	function handleDomainPutRequest(): void
	{
		$putData = fopen(filename: 'php://input', mode: 'r');
		$data = fread(stream: $putData, length: 512);
		$params = explode(separator: '&', string: $data);
		
		foreach ($params as $param) {
			[$key, $value] = explode(separator: '=', string: $param);
			$put[$key] = $value;
		}
		$id = $put['id'] ?? 0;
		$name = $put['name'] ?? "";
		$panelID = $put['panel_id'] ?? "";
		$a = $put['a'] ?? "";
		$aaaa = $put['aaaa'] ?? "";
		
		if ($id == 0) {
			$this->status = "400 Bad Request";
			$this->message = "An ID is required";
		} else {
			if (!$this->domainRepository->findByID(id: $id)) {
				$this->status = "404 Not Found";
				$this->message = "Domain with ID : $id doesn't exist.";
			} else {
				// TODO not required, as we rely on the ID
				if (empty($name)) {
					$this->status = "400 Bad Request";
					$this->message = "A name is required";
				} else {
					if (empty($a) && empty($aaaa)) {
						$this->status = "400 Bad Request";
						$this->message = "At least one IP address is required.";
					} else {
						$this->domainRepository->update(id: $id, name: $panelID, panelID: $name, a: $a, aaaa: $aaaa);
						$this->header = "201 Updated";
						$this->status = "201 Updated";
						$this->message = "201 Updated";
					}
				}
			}
		}
	}
	
	
	/**
	 * @return void
	 */
	public
	function handleDomainDeleteRequest(): void
	{
		$deleteData = fopen(filename: 'php://input', mode: 'r');
		$data = fread(stream: $deleteData, length: 512);
		$params = explode(separator: '&', string: $data);
		
		foreach ($params as $param) {
			[$key, $value] = explode(separator: '=', string: $param);
			$delete[$key] = $value;
		}
		
		$id = $delete['id'] ?? 0;
		
		if ($id == 0) {
			$this->header = "400 Bad Request";
			$this->status = "400 Bad Request";
			$this->message = "You need to supply an ID.";
		} else {
			if (!$this->domainRepository->findByID(id: $id)) {
				$this->header = "400 Bad Request";
				$this->status = "400 Bad Request";
				$this->message = "There is no domain with ID $id.";
			} else {
				$this->domainRepository->delete(id: $id);
				$this->header = "204 No content.";
				$this->status = "204 No content.";
				$this->message = "The domain $id has been deleted.";
			}
		}
	}
	
}