//! Determine which URLs are allowed for loading.

use std::fmt;

use std::ops::Deref;

use url::Url;

use crate::error::AllowedUrlError;

/// Decides which URLs are allowed to be loaded.

///

/// Currently only contains the base URL.

///

/// The plan is to add:

/// base_only:    Only allow to load content from the same base URL. By default

//                this restriction is enabled and requires to provide base_url.

/// include_xml:  Allows to use xi:include with XML. Enabled by default.

/// include_text: Allows to use xi:include with text. Enabled by default.

/// local_only:   Only allow to load content from the local filesystem.

///               Enabled by default.

pub struct UrlResolver {

    /// Base URL; all relative references will be resolved with respect to this.

}

impl UrlResolver {

    /// Creates a `UrlResolver` with defaults, and sets the `base_url`.

    /// Decides which URLs are allowed to be loaded based on the presence of a base URL.

    ///

    /// This function implements the policy described in "Security and locations of

    /// referenced files" in the [crate

    /// documentation](index.html#security-and-locations-of-referenced-files).

            .parse(href)

        // Allow loads of data: from any location

        }

        // Queries are not allowed.

        }

        // Fragment identifiers are not allowed.  They should have been stripped

        // upstream, by NodeId.

        }

        // All other sources require a base url

        }

        // Deny loads from differing URI schemes

        }

        // resource: is allowed to load anything from other resources

        }

        // Non-file: isn't allowed to load anything

        }

        // The rest of this function assumes file: URLs; guard against

        // incorrect refactoring.

        // If we have a base_uri of "file:///foo/bar.svg", and resolve an href of ".",

        // Url.parse() will give us "file:///foo/".  We don't want that, so check

        // if the last path segment is empty - it will not be empty for a normal file.

                .last()

                .expect("URL path segments always contain at last 1 element")

                .is_empty()

            {

            }

        } else {

            unreachable!("the file: URL cannot have an empty path");

        }

        // We have two file: URIs.  Now canonicalize them (remove .. and symlinks, etc.)

        // and see if the directories match

            .to_file_path()

            .to_file_path()

        }

            .canonicalize()

            .canonicalize()

            // Finally, convert the canonicalized path back to a URL.

        } else {

        }

}

/// Wrapper for URLs which are allowed to be loaded

///

/// SVG files can reference other files (PNG/JPEG images, other SVGs,

/// CSS files, etc.).  This object is constructed by checking whether

/// a specified `href` (a possibly-relative filename, for example)

/// should be allowed to be loaded, given the base URL of the SVG

/// being loaded.

impl Deref for AllowedUrl {

    type Target = Url;

        &self.0

}

impl fmt::Display for AllowedUrl {

}

#[cfg(test)]

mod tests {

    use super::*;

    use std::path::PathBuf;

    #[test]

            Err(AllowedUrlError::UrlParseError(

                url::ParseError::RelativeUrlWithoutBase

            ))

        ));

    #[test]

        ));

            Err(AllowedUrlError::DifferentUriSchemes)

        ));

        } else {

        }

    #[test]

            Err(AllowedUrlError::BaseIsRoot)

        ));

    #[test]

            Err(AllowedUrlError::DisallowedScheme)

        ));

    #[test]

                .resolve_href("data:image/jpeg;base64,xxyyzz")

                .unwrap()

                .as_ref(),

            "data:image/jpeg;base64,xxyyzz",

        );

            .canonicalize()

            .expect("files from test fixtures are supposed to canonicalize");

    #[test]

    #[test]

            "tests/fixtures/loading/bar.svg",

        )));

    #[test]

            "tests/fixtures/loading/bar.svg",

        )));

    // Ignore on Windows since we test for /etc/passwd

    #[cfg(unix)]

    #[test]

            "tests/fixtures/loading/bar.svg",

        )));

            Err(AllowedUrlError::NotSiblingOrChildOfBaseFile)

        ));

    #[test]

            Err(AllowedUrlError::NoQueriesAllowed)

        ));

    #[test]

            .resolve_href(".@../../../../../../../../../../etc/passwd")

            .is_err());

            .resolve_href(".$../../../../../../../../../../etc/passwd")

            .is_err());

            .resolve_href(".%../../../../../../../../../../etc/passwd")

            .is_err());

            .resolve_href(".*../../../../../../../../../../etc/passwd")

            .is_err());

            .resolve_href("~/../../../../../../../../../../etc/passwd")

            .is_err());

    #[test]

            Err(AllowedUrlError::NotSiblingOrChildOfBaseFile)

        ));

            Err(AllowedUrlError::NoFragmentIdentifierAllowed)

        ));

    #[test]

        // UrlResolver::resolve_href() explicitly disallows fragment identifiers.

        // This is because they should have been stripped before calling that function,

        // by NodeId or the Iri machinery.

        let url_resolver =

            Err(AllowedUrlError::NoFragmentIdentifierAllowed)

        ));

    #[cfg(windows)]

    #[test]

    fn invalid_url_from_test_suite() {

        // This is required for Url to panic.

        let resolver =

            UrlResolver::new(Some(Url::parse("file:///c:/foo.svg").expect("initial url")));

        // With this, it doesn't panic:

        //   let resolver = UrlResolver::new(None);

        // The following panics, when using a base URL

        //   match resolver.resolve_href("file://invalid.css") {

        // so, use a less problematic case, hopefully

        match resolver.resolve_href("file://") {

            Ok(_) => println!("yay!"),

            Err(e) => println!("err: {}", e),

        }

    }

}