'use strict'

const { timingSafeEqual } = require('crypto')
const { constants, readFileSync } = require('fs')

const {
  Server,
  sftp: { OPEN_MODE, STATUS_CODE }
} = require('bare-ssh2')

const allowedUser = Buffer.from('foo')
const allowedPassword = Buffer.from('bar')

function checkValue(input, allowed) {
  const autoReject = input.length !== allowed.length
  if (autoReject) {
    // Prevent leaking length information by always making a comparison with the
    // same input when lengths don't match what we expect ...
    allowed = input
  }
  const isMatch = timingSafeEqual(input, allowed)
  return !autoReject && isMatch
}

new Server(
  {
    hostKeys: [readFileSync('host.key')]
  },
  (client) => {
    console.log('Client connected!')

    client
      .on('authentication', (ctx) => {
        let allowed = true
        if (!checkValue(Buffer.from(ctx.username), allowedUser)) allowed = false

        switch (ctx.method) {
          case 'password':
            if (!checkValue(Buffer.from(ctx.password), allowedPassword)) return ctx.reject()
            break
          default:
            return ctx.reject()
        }

        if (allowed) ctx.accept()
        else ctx.reject()
      })
      .on('ready', () => {
        console.log('Client authenticated!')

        client.on('session', (accept, reject) => {
          const session = accept()
          session.on('sftp', (accept, reject) => {
            console.log('Client SFTP session')

            const openFiles = new Map()
            let handleCount = 0
            const sftp = accept()
            sftp
              .on('OPEN', (reqid, filename, flags, attrs) => {
                // Only allow opening /tmp/foo.txt for writing
                if (filename !== '/tmp/foo.txt' || !(flags & OPEN_MODE.READ))
                  return sftp.status(reqid, STATUS_CODE.FAILURE)

                // Create a fake handle to return to the client, this could easily
                // be a real file descriptor number for example if actually opening
                // the file on the disk
                const handle = Buffer.alloc(4)
                openFiles.set(handleCount, { read: false })
                handle.writeUInt32BE(handleCount++, 0, true)

                console.log('Opening file for read')
                sftp.handle(reqid, handle)
              })
              .on('READ', (reqid, handle, offset, length) => {
                let fnum
                if (handle.length !== 4 || !openFiles.has((fnum = handle.readUInt32BE(0, true)))) {
                  return sftp.status(reqid, STATUS_CODE.FAILURE)
                }

                // Fake the read
                const state = openFiles.get(fnum)
                if (state.read) {
                  sftp.status(reqid, STATUS_CODE.EOF)
                } else {
                  state.read = true

                  console.log('Read from file at offset %d, length %d', offset, length)
                  sftp.data(reqid, 'bar')
                }
              })
              .on('CLOSE', (reqid, handle) => {
                let fnum
                if (handle.length !== 4 || !openFiles.has((fnum = handle.readUInt32BE(0)))) {
                  return sftp.status(reqid, STATUS_CODE.FAILURE)
                }

                openFiles.delete(fnum)

                console.log('Closing file')
                sftp.status(reqid, STATUS_CODE.OK)
              })
              .on('REALPATH', function (reqid, path) {
                const name = [
                  {
                    filename: '/tmp/foo.txt',
                    longname: '-rwxrwxrwx 1 foo foo 3 Dec 8 2009 foo.txt',
                    attrs: {}
                  }
                ]
                sftp.name(reqid, name)
              })
              .on('STAT', onSTAT)
              .on('LSTAT', onSTAT)

            function onSTAT(reqid, path) {
              if (path !== '/tmp/foo.txt') return sftp.status(reqid, STATUS_CODE.FAILURE)

              let mode = constants.S_IFREG // Regular file
              mode |= constants.S_IRWXU // Read, write, execute for user
              mode |= constants.S_IRWXG // Read, write, execute for group
              mode |= constants.S_IRWXO // Read, write, execute for other
              sftp.attrs(reqid, {
                mode: mode,
                uid: 0,
                gid: 0,
                size: 3,
                atime: Date.now(),
                mtime: Date.now()
              })
            }
          })
        })
      })
      .on('close', () => {
        console.log('Client disconnected')
      })
  }
).listen(0, '127.0.0.1', function () {
  console.log(`Listening on port ${this.address().port}`)
})