<?php declare(strict_types=1);

const NS_SOA_VALUES = [
	'ttl' => 10800,
	'email' => CONF['ns']['public_soa_email'],
	'refresh' => 10800,
	'retry' => 3600,
	'expire' => 3628800,
	'negative' => 10800,
];

const NS_MIN_TTL = 300;
const NS_DEFAULT_TTL = 10800;
const NS_MAX_TTL = 1728000;

const NS_ALLOWED_TYPES = ['AAAA', 'A', 'TXT', 'SRV', 'MX', 'SSHFP', 'TLSA', 'NS', 'DS', 'CSYNC', 'CAA', 'CNAME', 'DNAME', 'SVCB', 'HTTPS', 'LOC'];

const NS_TEXTAREA_MAX_CHARACTERS = 10000;

const NS_SYNC_TTL = 10800;

function nsParseCommonRequirements(): array {
	nsCheckZonePossession($_POST['zone']);

	if (($_POST['subdomain'] === '') OR ($_POST['subdomain'] === '@'))
		$values['domain'] = $_POST['zone'];
	else
		$values['domain'] = formatAbsoluteDomain(formatEndWithDot($_POST['subdomain']) . $_POST['zone']);

	$values['ttl'] = intval($_POST['ttl-value'] * $_POST['ttl-multiplier']);

	if ($values['ttl'] < NS_MIN_TTL)
		output(403, sprintf(_('TTLs shorter than %s seconds are forbidden.'), NS_MIN_TTL));
	if ($values['ttl'] > NS_MAX_TTL)
		output(403, sprintf(_('TTLs longer than %s seconds are forbidden.'), NS_MAX_TTL));

	return $values;
}

function nsListUserZones(): array {
	if (isset($_SESSION['id']))
		return query('select', 'zones', ['username' => $_SESSION['id']], ['zone']);
	return [];
}

function nsCheckZonePossession(string $zone): void {
	checkAbsoluteDomainFormat($zone);

	if (!in_array($zone, nsListUserZones(), true))
		output(403, 'You don\'t own this zone on the name server.');
}

function nsDeleteZone(string $zone, string $user_id): void {
	// Remove from Knot configuration
	knotcConfExec([['conf-unset', 'zone[' . $zone . ']']]);

	// Remove Knot zone file
	if (unlink(CONF['ns']['knot_zones_path'] . '/' . $zone . 'zone') !== true)
		output(500, 'Failed to remove Knot zone file.');

	// Remove Knot related data
	exescape([
		CONF['dns']['knotc_path'],
		'--blocking',
		'--timeout',
		'3',
		'--force',
		'--',
		'zone-purge',
		$zone,
		'+orphan',
	], result_code: $code);
	if ($code !== 0)
		output(500, 'Failed to purge zone data.');

	query('delete', 'ns-syncs', ['destination' => $zone]);

	// Remove from database
	query('delete', 'zones', [
		'zone' => $zone,
		'username' => $user_id,
	]);
}

function nsSync(string $source, string $destination): void {
	$zone_raw = file_get_contents(CONF['ns']['knot_zones_path'] . '/' . $destination . 'zone');
	if ($zone_raw === false)
		output(403, 'Unable to read zone file.');

	foreach (['AAAA', 'A', 'CAA'] as $type) {
		// Get source/distant records
		$results = kdig(name: $source, type: $type);

		if ($results['AD'] !== 1)
			throw new NoDnssecException($source . ' not DNSSEC-signed.');

		$source_records = array_column($results['answerRRs'] ?? [], 'rdata' . $type);

		// Get destination/local records
		$dest_records = array_column(parseZoneFile($zone_raw, [$type], $destination, false), 3);

		// Add source records that are not yet in destination
		foreach (array_diff($source_records, $dest_records) as $value_to_add)
			knotcZoneExec($destination, [
				$destination,
				NS_SYNC_TTL,
				$type,
				$value_to_add,
			], 'add');
		// Delete destination records that are not part of source anymore
		foreach (array_diff($dest_records, $source_records) as $value_to_delete)
			knotcZoneExec($destination, [
				$destination,
				$type,
				$value_to_delete,
			], 'delete');
	}
}