#!/usr/bin/python3
"""Serve the status of the router on its internal address, its external address or both, as web.listen sets.

Run by vpn-router-web.service. Users are managed with vpnrouter_users, the module that
vpn-router-user uses too.

Pages:
  /        the status for people: plain text for curl and wget, a styled page
           (Tailwind CSS from a CDN) for a browser
  /status  the status as JSON
  /config  the configuration without its secrets, and what the router resolved and
           runs, with the installed Caddy and where it comes from, as JSON
  /users   the users in the router's directory, whether or not a P2S system is enabled: list,
           add, change, set the password, disable, enable, remove, the OpenVPN client
           profile, and TOTP enrolment (see users()); service accounts are not among them
  /service-accounts
           the service accounts: list, add, change the e-mail address, set the password,
           disable, enable, unlock and remove; the internal ones are only listed (see
           service_accounts())
  /groups  the groups of the router's directory: list, add, rename or describe, remove, and
           add and take out members (see groups())
  /account the account of the signed-in user: its details, its password and its TOTP
           enrolment (see account())
  /site-to-site
           the site-to-site connections of the configuration: list, add, change and remove,
           applied by vpn-router-setup (see site_to_site())
  /backup  the backup settings, the last run and the local archives: show, change and run
           now (see backup())
  /ca      the PKI: its settings, the root and issuing CAs, the certificates issued; change the
           settings, issue and revoke certificates, and take the certificate of an issuing CA
           and a root CRL signed offline (see ca())
  /pki/<name>.crt, /pki/<name>.crl
           the DER certificate and CRL of the root (root) and of each issuing CA, which the
           certificates name in their AIA and CRL distribution points; no authentication
  /auth   sign-in with a user's password and TOTP code, refresh and sign-out (see auth())
  /metrics/history
           the metrics the metrics service keeps, for a view: hour, day, month or year (see
           metrics_history())
  /postgresql
           the databases of each PostgreSQL cluster on the router with their sizes, as JSON (see
           postgresql_databases()); /config has the clusters' settings

/config, /metrics/history, /postgresql, /users, /service-accounts, /groups, /site-to-site, /backup, /ca and /account need an HS256 JWT in an Authorization: Bearer header signed
with vpnrouter_auth.WEB_KEY (see vpnrouter_auth.verify). A token of /auth names a user in sub;
/account serves that user, and the other paths need a member of vpnrouter_users.ADMIN_GROUP. A
token of vpn-router-token has the admin claim and names no user; it may call every path but
/account, and only such a token may change ADMIN_GROUP: create, rename to it, change, remove it,
add or take out its members, and remove one of its members. These paths and /auth are not
served (404) while the key does not exist. /auth is limited to AUTH_LIMIT calls per client
address in AUTH_WINDOW seconds; the address of a call from one of web.trusted_proxies, by
default the address the call came in on, is the last entry of its X-Forwarded-For header.

/ and /status show only the status, as much as web.status_content says (see shown): basic, the
default, the overall status, the time and the client's address (its address as for the rate limit
below); standard also the package version, the installed version of vpn-router-manager
(manager_version, null when it is not installed) and the number of active and other services; full
whether each service runs, whether Docker is installed, and the state of each site-to-site connection, road-warrior
(IPsec P2S), OpenVPN and WireGuard. No configuration data or key is shown, and no address but the
client's.

The service first initializes, without listening: it makes the signing key and the refresh
tokens' database (vpnrouter_auth), retrying every INIT_RETRY_SECONDS until both are ready and
logging each failure. Then it listens. Its unit starts it only once wait-for-libpq has found libpq
in the linker cache, where psycopg looks it up.

The service needs nothing else to start and does not end on its own. Every DISCOVERY_SECONDS it
works out from /etc/vpn-router/vpn-router.json the addresses of the interfaces web.listen names,
internal, external or both, as general.mode directs, with web.port and web.enabled
(vpnrouter_net.web_listen), and runs a server on each (vpnrouter_serve.serve): it starts them,
moves them when an address or the port changes, and stops them while the service is disabled or
no address is known. Every request reads what it needs when it is made: the signing
key, the configuration, and the features of the router and the facts shown by /config from
/run/vpn-router/web.json, which vpn-router-setup writes. Before setup has written that file
the router has no features, and /config shows no configuration or interfaces.
"""

import collections
import configparser
import json
import os
import shutil
import signal
import sys
import threading
import time
import urllib.parse
from html import escape
from http.server import BaseHTTPRequestHandler

sys.path.insert(0, os.path.dirname(os.path.realpath(__file__)))

import ldap

import vpnrouter
import vpnrouter_auth
import vpnrouter_backup
import vpnrouter_metrics
import vpnrouter_net
import vpnrouter_pki
import vpnrouter_serve
import vpnrouter_users
from vpnrouter_status import established, established_each, openvpn_clients, run, swanctl, wireguard_peers

STATE_FILE = '/run/vpn-router/web.json'
CONFIG_FILE = '/etc/vpn-router/vpn-router.json'

#: Seconds between two attempts of the initialization.
INIT_RETRY_SECONDS = 15

#: The port when web.port is not set.
DEFAULT_PORT = 7081

#: Seconds between two discoveries of where the service should listen.
DISCOVERY_SECONDS = 30
CACHE_SECONDS = 2

#: The calls of /auth allowed per client address in AUTH_WINDOW seconds.
AUTH_LIMIT = 10
AUTH_WINDOW = 60

TAILWIND = 'https://cdn.jsdelivr.net/npm/@tailwindcss/browser@4'

#: Seconds after which the status page in a browser reloads itself.
REFRESH_SECONDS = 60

#: The PostgreSQL settings /config shows for each cluster.
POSTGRESQL_SETTINGS = ('server_version', 'listen_addresses', 'port', 'max_connections', 'shared_buffers',
                       'effective_cache_size', 'work_mem', 'password_encryption', 'ssl', 'timezone')

#: The largest request body accepted, in bytes; a CSR or a certificate chain in PEM is a few kilobytes.
BODY_LIMIT = 65536

#: The settings of a site_to_site connection that /site-to-site adds and changes.
CONNECTION_SETTINGS = ('addrs', 'id', 'cidrs', 'local_cidrs', 'local_id_mode', 'auth', 'psk', 'remote_ca')

#: The HTTP status for each status of a vpnrouter_users.Failure; any other is 500.
USER_STATUS = {2: 400, 3: 404, 4: 409, 5: 401}

#: The HTTP status for each status of a vpnrouter_pki.Failure; any other is 500.
PKI_STATUS = {2: 400, 3: 404, 4: 409}

#: A file /pki/ serves: the certificate or the CRL of a CA, and its content type.
PUBLISHED = {'.crt': 'application/pkix-cert', '.crl': 'application/pkix-crl'}

_cache = {'at': 0.0, 'data': None}
_lock = threading.Lock()

#: The times of the recent /auth calls of each client address.
_auth_calls = collections.defaultdict(collections.deque)
_auth_lock = threading.Lock()


def read_json(path):
    """The object in a JSON file, or {} when the file is missing or holds no object."""
    try:
        with open(path, encoding='utf-8') as handle:
            data = json.load(handle)
    except (OSError, ValueError):
        return {}
    return data if isinstance(data, dict) else {}


def section(configuration, name):
    """A section of the configuration, or {} when it is missing or not an object."""
    value = configuration.get(name)
    return value if isinstance(value, dict) else {}


def current():
    """What a request needs, read now: the features and facts setup resolved, and the signing key.

    Before setup has run the router has no features, and without a key the protected paths and
    /auth are not served.
    """
    return dict(read_json(STATE_FILE), key=vpnrouter_auth.key())


def unit_state(unit):
    result = run('systemctl', 'is-active', unit)
    return result.stdout.strip() if result and result.stdout.strip() else 'unknown'


def package_version(package='vpn-router'):
    """The installed version of the package, or None when it is not installed."""
    result = run('dpkg-query', '-W', '-f=${Version}', package)
    return (result.stdout.strip() or None) if result and result.returncode == 0 else None


def docker_status():
    """Whether Docker is installed, and the state of its service and of the Docker rules when it is."""
    result = run('systemctl', 'list-unit-files', '--no-legend', 'docker.service')
    if result is None or result.returncode != 0 or not result.stdout.strip():
        return {'installed': False}
    return {
        'installed': True,
        'service': unit_state('docker.service'),
        'rules': unit_state('vpn-router-docker.service'),
    }


def postgresql_clusters():
    """The state of each PostgreSQL cluster unit (postgresql@<version>-<name>), or {'postgresql': 'no cluster'} without one.

    postgresql.service, which only runs /bin/true, is not reported.
    """
    lines = lines_of('systemctl', 'list-units', 'postgresql@*.service', '--all', '--plain', '--no-legend') or []
    names = [line.split()[0].removesuffix('.service') for line in lines if line.strip()]
    return {name: unit_state(f'{name}.service') for name in names} or {'postgresql': 'no cluster'}


def collect(state):
    """The status document. state says which features the router has."""
    units = {'vpn-router-setup': unit_state('vpn-router-setup.service'), 'slapd': unit_state('slapd.service'),
             **postgresql_clusters()}
    manager_version = package_version('vpn-router-manager')
    if manager_version:
        units['vpn-router-manager'] = unit_state('vpn-router-manager.service')
    if state.get('site_to_site') or state.get('p2s'):
        units['strongswan'] = unit_state('strongswan.service')
    if state.get('wireguard'):
        units['wg-quick@wg0'] = unit_state('wg-quick@wg0.service')
    if state.get('openvpn'):
        units['openvpn-server@vpn-router'] = unit_state('openvpn-server@vpn-router.service')

    status = {
        'status': 'ok' if all(value == 'active' for value in units.values()) else 'degraded',
        'version': package_version(),
        'manager_version': manager_version,
        'time': time.strftime('%Y-%m-%dT%H:%M:%S%z'),
        'units': units,
        'docker': docker_status(),
    }
    names = state.get('site_to_site')
    if isinstance(names, list) and names:
        status['site_to_site'] = {'connections': {name: None if count is None else count > 0
                                                  for name, count in established_each(names).items()}}
    if state.get('p2s'):
        status['p2s'] = {'clients': established('road-warrior')}
    if state.get('wireguard'):
        status['wireguard'] = {'peers': wireguard_peers()}
    if state.get('openvpn'):
        status['openvpn'] = {'clients': openvpn_clients()}
    return status


def shown(status, content, client):
    """The status document as web.status_content shows it to the client at its address.

    Every content has status, time and client_ip, the client's address, and content, which one it is: basic nothing
    more; standard adds version, manager_version and services, the number of active units and of units in every
    other state; full adds the whole status document of collect. Content that is not one of
    vpnrouter.STATUS_CONTENTS, or not set, is basic.
    """
    if content not in vpnrouter.STATUS_CONTENTS:
        content = 'basic'
    if content == 'full':
        return {**status, 'content': content, 'client_ip': client}
    document = {'status': status['status'], 'content': content, 'time': status['time'], 'client_ip': client}
    if content == 'standard':
        active = sum(1 for value in status['units'].values() if value == 'active')
        document.update(version=status['version'], manager_version=status['manager_version'],
                        services={'active': active, 'failed': len(status['units']) - active})
    return document


def lines_of(*args):
    """The output lines of a command, or None when it fails."""
    result = run(*args)
    return result.stdout.splitlines() if result and result.returncode == 0 else None


def routes():
    """The IPv4 routes as ip -j prints them, or None when ip fails."""
    result = run('ip', '-j', '-4', 'route', 'show')
    if result is None or result.returncode != 0:
        return None
    try:
        return json.loads(result.stdout)
    except ValueError:
        return None


def wireguard_details():
    """The interface and the peers of wg0, with endpoints and allowed IPs; no private or preshared key."""
    result = run('wg', 'show', 'wg0', 'dump')
    if result is None or result.returncode != 0:
        return None
    rows = [line.split('\t') for line in result.stdout.splitlines()]
    now = int(time.time())
    return {
        'public_key': rows[0][1] if rows and len(rows[0]) > 2 else None,
        'listen_port': int(rows[0][2]) if rows and len(rows[0]) > 2 else None,
        'peers': [{
            'public_key': row[0],
            'endpoint': None if row[2] == '(none)' else row[2],
            'allowed_ips': row[3].split(','),
            'handshake_seconds_ago': now - int(row[4]) if int(row[4]) else None,
            'received_bytes': int(row[5]),
            'sent_bytes': int(row[6]),
        } for row in rows[1:] if len(row) >= 7],
    }


def postgresql_query(cluster, sql):
    """The JSON value an SQL statement answers on a cluster (version/name), run by psql as postgres, or None when it fails."""
    result = run('runuser', '-u', 'postgres', '--', 'psql', '--cluster', cluster, '-X', '-q', '-t', '-A',
                 '-v', 'ON_ERROR_STOP=1', '-d', 'postgres', '-c', sql)
    if result is None or result.returncode != 0:
        return None
    try:
        return json.loads(result.stdout)
    except ValueError:
        return None


def postgresql_clusters_of():
    """The PostgreSQL clusters of pg_lsclusters, each with version, name, port, status and data_directory, or None when it fails."""
    lines = lines_of('pg_lsclusters', '--no-header')
    if lines is None:
        return None
    clusters = []
    for line in lines:
        fields = line.split()
        if len(fields) >= 6:
            clusters.append({'version': fields[0], 'name': fields[1], 'port': int(fields[2]) if fields[2].isdigit() else None,
                             'status': fields[3], 'data_directory': fields[5]})
    return clusters


def postgresql_configuration():
    """The PostgreSQL clusters on the router with the settings of POSTGRESQL_SETTINGS of each one that is online (None
    for one that is not), or None when pg_lsclusters fails."""
    clusters = postgresql_clusters_of()
    if clusters is None:
        return None
    names = ', '.join(f"'{name}'" for name in POSTGRESQL_SETTINGS)
    for cluster in clusters:
        cluster['settings'] = postgresql_query(
            f"{cluster['version']}/{cluster['name']}",
            f'SELECT json_object_agg(name, current_setting(name) ORDER BY name) FROM pg_settings WHERE name IN ({names})',
        ) if cluster['status'].startswith('online') else None
    return {'clusters': clusters}


def postgresql_databases():
    """What /postgresql shows: the PostgreSQL clusters on the router, each with its databases (name, owner, encoding and
    size in bytes) and their total size, None for a cluster that is not online; clusters is None when pg_lsclusters fails."""
    clusters = postgresql_clusters_of()
    if clusters is None:
        return {'clusters': None}
    for cluster in clusters:
        databases = postgresql_query(
            f"{cluster['version']}/{cluster['name']}",
            "SELECT coalesce(json_agg(json_build_object('name', datname, 'owner', pg_get_userbyid(datdba), "
            "'encoding', pg_encoding_to_char(encoding), 'size', pg_database_size(oid)) ORDER BY datname), '[]') "
            'FROM pg_database',
        ) if cluster['status'].startswith('online') else None
        cluster['databases'] = databases
        cluster['size'] = sum(database['size'] for database in databases) if isinstance(databases, list) else None
    return {'clusters': clusters}


def details(state):
    """What /config shows: the configuration without its secrets, and what the router resolved and runs; caddy is the
    installed Caddy, {version, source}, null when it is not installed."""
    configuration = state.get('configuration', {})
    caddy = package_version('caddy')
    return {
        'configuration': configuration,
        'network': dict(state.get('network', {}), routes=routes()),
        'ipsec': {
            'connections': swanctl('--list-conns'),
            'sas': swanctl('--list-sas'),
        },
        'wireguard': wireguard_details(),
        'docker': {
            'exposed_ports': configuration.get('docker', {}).get('exposed_ports', []),
            'rules': lines_of('iptables', '-S', 'VPN-ROUTER-DOCKER'),
        },
        'postgresql': postgresql_configuration(),
        # Caddy is upstream's once its repository is configured (vpn-router-caddy).
        'caddy': {'version': caddy, 'source': 'upstream' if vpnrouter.CADDY_APT_SOURCE.is_file() else 'ubuntu'}
                 if caddy else None,
    }


def text_of(status):
    """The status document of shown for people, as plain text: a header, a blank line, then name: value lines."""
    lines = ['VPN Router', f'Status: {status["status"]}']
    if 'version' in status:
        lines.append(f'Version: {status["version"] or "unknown"}')
    lines += ['', f'Client IP: {status["client_ip"]}']
    if 'manager_version' in status:
        lines.append(f'Router Manager: {status["manager_version"] or "not installed"}')
    if 'services' in status:
        lines.append(f'Services: {status["services"]["active"]} active, {status["services"]["failed"]} failed')
    lines += [f'{name}: {value}' for name, value in status.get('units', {}).items()]
    if 'docker' in status:
        docker = status['docker']
        lines.append('Docker: not installed' if not docker['installed']
                     else f'Docker: installed, service {docker["service"]}, rules {docker["rules"]}')
    for name, value in status.get('site_to_site', {}).get('connections', {}).items():
        lines.append(f'Site to site {name}: {"unknown" if value is None else "established" if value else "not established"}')
    if 'p2s' in status:
        clients = status['p2s']['clients']
        lines.append(f'Road-warrior (IPsec P2S): {"unknown" if clients is None else f"{clients} connected"}')
    if 'openvpn' in status:
        clients = status['openvpn']['clients']
        lines.append(f'OpenVPN: {"unknown" if clients is None else f"{clients} connected"}')
    if 'wireguard' in status:
        peers = status['wireguard']['peers']
        if peers is None:
            lines.append('WireGuard: down')
        else:
            lines.append(f'WireGuard: {len(peers)} peers')
            for number, peer in enumerate(peers, 1):
                age = peer['handshake_seconds_ago']
                lines.append(f'  peer {number}: {"no handshake yet" if age is None else f"handshake {age} s ago"}, '
                             f'received {peer["received_bytes"]} B, sent {peer["sent_bytes"]} B')
    return '\n'.join(lines) + '\n'


def html_of(status):
    """The status document of shown for a browser, as a page styled with Tailwind CSS."""
    colour = 'bg-emerald-600 dark:bg-emerald-700' if status['status'] == 'ok' else 'bg-amber-600 dark:bg-amber-700'
    version = f', version {status["version"] or "unknown"}' if 'version' in status else ''
    # Each "name: value" line after the header of the text is a row; indented lines, such as WireGuard peers, are indented here too.
    rows = []
    for line in text_of(status).split('\n\n', 1)[1].splitlines():
        if not line:
            continue
        name, _, value = line.partition(': ')
        indent = ' pl-8' if line.startswith(' ') else ''
        rows.append(f'<tr class="border-t border-slate-200 first:border-t-0 dark:border-slate-700">'
                    f'<th class="py-2 pr-4{indent} text-left font-medium text-slate-600 dark:text-slate-300">{escape(name.strip())}</th>'
                    f'<td class="py-2">{escape(value)}</td></tr>')
    body = ''.join(rows)
    return f"""<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="color-scheme" content="light dark">
    <meta http-equiv="refresh" content="{REFRESH_SECONDS}">
    <title>VPN Router</title>
    <script src="{TAILWIND}"></script>
  </head>
  <body class="min-h-screen bg-slate-100 text-slate-900 dark:bg-slate-900 dark:text-slate-100">
    <div class="mx-auto max-w-2xl px-4 py-10">
      <div class="overflow-hidden rounded-2xl border border-slate-200 bg-white shadow-lg dark:border-slate-700 dark:bg-slate-800">
        <div class="{colour} px-6 py-4 text-white">
          <h1 class="text-xl font-semibold">VPN Router</h1>
          <p class="mt-1 text-sm">Status: {escape(status['status'] + version)}</p>
        </div>
        <div class="px-6 py-4">
          <table class="w-full text-sm"><tbody>{body}</tbody></table>
        </div>
        <p class="px-6 pb-6 text-xs text-slate-500 dark:text-slate-400">{escape(status['time'])} - <a class="underline" href="/status">JSON</a></p>
      </div>
    </div>
  </body>
</html>
"""


def users(state, method, path, body):
    """Answer a /users request with vpnrouter_users: the HTTP status and the JSON document.

      GET    /users                   the users
      POST   /users                   add a user: {"name", "password", "first_name", "last_name", "email"};
                                      without the names a Manager-only account
      PUT    /users/<name>            change any of {"first_name", "last_name", "email"}
      PUT    /users/<name>/password   set the password: {"password": ...}
      POST   /users/<name>/disable    lock the user out of OpenVPN
      POST   /users/<name>/enable     let the user in again
      POST   /users/<name>/unlock     end a lockout after failed logins
      DELETE /users/<name>            remove the user and revoke the certificate
      GET    /users/<name>/profile    the OpenVPN client profile
      POST   /users/<name>/otp        a new TOTP secret and its otpauth URI; nothing is stored
      PUT    /users/<name>/otp        store a TOTP secret: {"secret", "code"}, code a code of the secret
      DELETE /users/<name>/otp        remove the TOTP token

    Service accounts are served by /service-accounts: they are not listed, and a request naming one is 404.
    """
    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
        return 400, {'error': 'the body must be a JSON object'}
    body = body or {}
    parts = path.strip('/').split('/')
    route = (method, len(parts), parts[2] if len(parts) == 3 else None)
    name = parts[1] if len(parts) > 1 else None
    actions = {
        ('GET', 1, None): lambda connection: {
            'users': [user for user in vpnrouter_users.list_users(connection)['users'] if not user['service']]},
        ('POST', 1, None): lambda connection: vpnrouter_users.add(connection, body.get('name'), body.get('password'), body),
        ('PUT', 2, None): lambda connection: vpnrouter_users.update(connection, name, body),
        ('PUT', 3, 'password'): lambda connection: vpnrouter_users.passwd(connection, name, body.get('password')),
        ('POST', 3, 'disable'): lambda connection: vpnrouter_users.disable(connection, name),
        ('POST', 3, 'enable'): lambda connection: vpnrouter_users.enable(connection, name),
        ('POST', 3, 'unlock'): lambda connection: vpnrouter_users.unlock(connection, name),
        ('DELETE', 2, None): lambda connection: vpnrouter_users.remove(connection, name),
        ('GET', 3, 'profile'): lambda connection: vpnrouter_users.profile(connection, name),
        ('POST', 3, 'otp'): lambda connection: vpnrouter_users.otp_new(connection, name),
        ('PUT', 3, 'otp'): lambda connection: vpnrouter_users.otp_enrol(connection, name, body.get('secret'), body.get('code')),
        ('DELETE', 3, 'otp'): lambda connection: vpnrouter_users.otp_remove(connection, name),
    }
    # The vpnrouter_users operation of each route that may revoke refresh tokens.
    operations = {('PUT', 3, 'password'): 'passwd', ('POST', 3, 'disable'): 'disable', ('POST', 3, 'unlock'): 'unlock',
                  ('DELETE', 2, None): 'remove'}
    if route not in actions:
        return 404, {'error': f'no route {method} {path}'}
    try:
        with vpnrouter_users.session() as connection:
            if name is not None and vpnrouter_users.service(vpnrouter_users.entry(connection, name)):
                raise vpnrouter_users.Failure(f'{name} is a service account; see /service-accounts', 3)
            document = actions[route](connection)
        if operations.get(route) in vpnrouter_auth.REVOKING:
            vpnrouter_auth.revoke(vpnrouter.load_config(), name)
    except vpnrouter_users.Failure as failure:
        return USER_STATUS.get(failure.status, 500), {'error': str(failure)}
    except (ldap.LDAPError, OSError) as exc:
        return 500, {'error': f'the user directory failed: {exc}'}
    except vpnrouter_auth.DatabaseError as exc:
        return 500, {'error': str(exc)}
    except SystemExit as exc:
        # vpnrouter ends with SystemExit, carrying the reason, on a configuration it cannot read.
        return 500, {'error': str(exc.code)}
    return (201 if route == ('POST', 1, None) else 200), document


def service_accounts(method, path, body):
    """Answer a /service-accounts request with vpnrouter_users: the HTTP status and the JSON document.

      GET    /service-accounts                   the service accounts: {"service_accounts": [...]}
      POST   /service-accounts                   add one: {"name", "password", "display_name"?, "description"?, "email"?}
      PUT    /service-accounts/<name>            change any of {"display_name", "description", "email"}; "" removes one
      PUT    /service-accounts/<name>/password   set the password: {"password": ...}
      POST   /service-accounts/<name>/disable    lock it out
      POST   /service-accounts/<name>/enable     let it in again
      POST   /service-accounts/<name>/unlock     end a lockout after failed logins
      DELETE /service-accounts/<name>            remove it

    A name that is not a service account is 404. The internal service accounts (vpnrouter_users.internal_accounts),
    which the router manages, are only listed: every other request on one is refused with 403.
    """
    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
        return 400, {'error': 'the body must be a JSON object'}
    body = body or {}
    parts = path.strip('/').split('/')
    route = (method, len(parts), parts[2] if len(parts) == 3 else None)
    name = parts[1] if len(parts) > 1 else None
    settings = {key: body.get(key) for key in ('email', 'display_name', 'description')}
    actions = {
        ('GET', 1, None): lambda connection: {
            'service_accounts': [user for user in vpnrouter_users.list_users(connection)['users'] if user['service']]},
        ('POST', 1, None): lambda connection: vpnrouter_users.add(connection, body.get('name'), body.get('password'), settings,
                                                                  service=True),
        ('PUT', 2, None): lambda connection: vpnrouter_users.update_service(connection, name, settings),
        ('PUT', 3, 'password'): lambda connection: vpnrouter_users.passwd(connection, name, body.get('password')),
        ('POST', 3, 'disable'): lambda connection: vpnrouter_users.disable(connection, name),
        ('POST', 3, 'enable'): lambda connection: vpnrouter_users.enable(connection, name),
        ('POST', 3, 'unlock'): lambda connection: vpnrouter_users.unlock(connection, name),
        ('DELETE', 2, None): lambda connection: vpnrouter_users.remove(connection, name),
    }
    if route not in actions:
        return 404, {'error': f'no route {method} {path}'}
    if name is not None and name in vpnrouter_users.internal_accounts():
        return 403, {'error': f'{name} is an internal service account, which the router manages'}
    try:
        with vpnrouter_users.session() as connection:
            if name is not None and not vpnrouter_users.service(vpnrouter_users.entry(connection, name)):
                raise vpnrouter_users.Failure(f'{name} is not a service account', 3)
            document = actions[route](connection)
    except vpnrouter_users.Failure as failure:
        return USER_STATUS.get(failure.status, 500), {'error': str(failure)}
    except (ldap.LDAPError, OSError) as exc:
        return 500, {'error': f'the user directory failed: {exc}'}
    return (201 if route == ('POST', 1, None) else 200), document


def groups(state, method, path, body):
    """Answer a /groups request with vpnrouter_users: the HTTP status and the JSON document.

      GET    /groups                          the groups with their members
      POST   /groups                          add a group: {"name", "members": [...], "description"?}
      PUT    /groups/<name>                   rename it or change the description: {"name"?, "description"?}
      DELETE /groups/<name>                   remove the group; its members are kept
      POST   /groups/<name>/members           add a member: {"user": ...}
      DELETE /groups/<name>/members/<user>    take a member out; the last member cannot leave

    An internal service account (vpnrouter_users.internal_accounts) is not put in or taken out of a group: such a
    request is refused with 403.
    """
    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
        return 400, {'error': 'the body must be a JSON object'}
    body = body or {}
    parts = path.strip('/').split('/')
    name = parts[1] if len(parts) > 1 else None
    route = (method, len(parts), parts[2] if len(parts) > 2 else None)
    members = body.get('members') if route == ('POST', 1, None) else [body.get('user')] if route == ('POST', 3, 'members') \
        else [parts[3]] if route == ('DELETE', 4, 'members') else []
    internal = sorted(set(vpnrouter_users.internal_accounts()).intersection(
        member for member in (members if isinstance(members, list) else []) if isinstance(member, str)))
    if internal:
        return 403, {'error': f'{", ".join(internal)}: internal service accounts, which the router manages, are not group members'}
    actions = {
        ('GET', 1, None): lambda connection: vpnrouter_users.list_groups(connection),
        ('POST', 1, None): lambda connection: vpnrouter_users.group_add(
            connection, body.get('name'), body.get('description'), body.get('members')),
        ('PUT', 2, None): lambda connection: vpnrouter_users.group_update(
            connection, name, body.get('name'), body.get('description')),
        ('DELETE', 2, None): lambda connection: vpnrouter_users.group_remove(connection, name),
        ('POST', 3, 'members'): lambda connection: vpnrouter_users.group_member_add(connection, name, body.get('user')),
        ('DELETE', 4, 'members'): lambda connection: vpnrouter_users.group_member_remove(connection, name, parts[3]),
    }
    if route not in actions:
        return 404, {'error': f'no route {method} {path}'}
    try:
        with vpnrouter_users.session() as connection:
            document = actions[route](connection)
    except vpnrouter_users.Failure as failure:
        return USER_STATUS.get(failure.status, 500), {'error': str(failure)}
    except (ldap.LDAPError, OSError) as exc:
        return 500, {'error': f'the user directory failed: {exc}'}
    return (201 if route == ('POST', 1, None) else 200), document


def connection_of(name, connection, count):
    """A site_to_site connection as /site-to-site shows it: its settings but psk, psk_set and established.

    count is the number of its established IKE SAs, None when it is not known.
    """
    return {'name': name, **{option: value for option, value in connection.items() if option != 'psk'},
            'psk_set': bool(connection['psk']), 'established': None if count is None else count > 0}


def site_to_site(method, path, body):
    """Answer a /site-to-site request: the HTTP status and the JSON document.

      GET    /site-to-site          the connections, {"connections": [...]}: each with its settings but psk, with
                                    psk_set, whether psk holds a key, and established, whether its tunnel is up,
                                    null when swanctl cannot be asked
      POST   /site-to-site          add a connection: {"name", "addrs", "id", "cidrs", "local_cidrs", "local_id_mode",
                                    "auth", "psk", "remote_ca"}; psk is required with auth psk, the default, and an
                                    existing name is 409
      PUT    /site-to-site/<name>   change any of the settings of POST but name; an empty or absent psk keeps the
                                    current key, and a psk given replaces psk_file
      DELETE /site-to-site/<name>   remove the connection

    A change is made holding vpnrouter.config_lock, checked as vpn-router-setup checks the configuration (400 with
    the reason), written with vpnrouter.save_config, and applied by restarting vpn-router-setup without waiting for it.
    """
    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
        return 400, {'error': 'the body must be a JSON object'}
    body = body or {}
    parts = path.strip('/').split('/')
    name = parts[1] if len(parts) == 2 else None
    if (method, len(parts)) not in (('GET', 1), ('POST', 1), ('PUT', 2), ('DELETE', 2)):
        return 404, {'error': f'no route {method} {path}'}
    try:
        if method == 'GET':
            connections = vpnrouter.load_config()['site_to_site']
            counts = established_each(connections)
            return 200, {'connections': [connection_of(key, value, counts[key]) for key, value in connections.items()]}
        settings = {option: body[option] for option in CONNECTION_SETTINGS if option in body}
        with vpnrouter.config_lock():
            data = vpnrouter.read_settings()
            connections = data.setdefault('site_to_site', {})
            if method == 'POST':
                name = body.get('name')
                if not isinstance(name, str) or not name:
                    return 400, {'error': 'name is required'}
                if name in connections:
                    return 409, {'error': f'connection {name} exists'}
                if settings.get('auth', 'psk') == 'psk' and (not isinstance(settings.get('psk'), str) or not settings['psk']):
                    return 400, {'error': 'psk is required with auth psk'}
                connections[name] = settings
            elif name not in connections:
                return 404, {'error': f'no connection {name}'}
            elif method == 'PUT':
                connection = dict(connections[name]) if isinstance(connections[name], dict) else {}
                if settings.get('psk'):
                    connection.pop('psk_file', None)
                else:
                    settings.pop('psk', None)
                connections[name] = {**connection, **settings}
            else:
                del connections[name]
            cfg = vpnrouter.with_defaults(data)
            vpnrouter.validate(cfg)
            vpnrouter.save_config(data)
    except vpnrouter.ConfigError as exc:
        return 400, {'error': str(exc)}
    except OSError as exc:
        return 500, {'error': f'the configuration cannot be written: {exc}'}
    except SystemExit as exc:
        return 500, {'error': str(exc.code)}
    run('systemctl', 'restart', '--no-block', 'vpn-router-setup.service')
    if method == 'DELETE':
        return 200, {'name': name, 'removed': True}
    return (201 if method == 'POST' else 200), connection_of(name, cfg['site_to_site'][name], None)


def backup_settings(settings):
    """The backup section as /backup shows it: its settings but pbs_password, with pbs_password_set."""
    return {**{option: value for option, value in settings.items() if option != 'pbs_password'},
            'pbs_password_set': bool(settings['pbs_password'])}


def rclone_remotes():
    """The names of the remotes of vpnrouter_backup.RCLONE_CONFIG; [] when it cannot be read, as when it is encrypted."""
    parser = configparser.ConfigParser(interpolation=None)
    try:
        parser.read(vpnrouter_backup.RCLONE_CONFIG, encoding='utf-8')
    except (OSError, configparser.Error):
        return []
    return parser.sections()


def backup(method, path, body):
    """Answer a /backup request: the HTTP status and the JSON document.

      GET  /backup      {"settings", "state", "archives", "next", "client", "rclone"}: the backup section without
                        pbs_password, with pbs_password_set; the last run (vpnrouter_backup.state), null before the
                        first; the local archives of this host, newest first, [{name, time, size}], [] with the pbs
                        target; the next run of the timer as systemd shows it, null while backups are disabled;
                        whether proxmox-backup-client is installed; and {"installed", "config", "remotes"} of rclone
      PUT  /backup      change any of the settings of the backup section; an empty or absent pbs_password keeps the
                        current secret
      POST /backup/run  start a backup now, without waiting for it; 409 while one runs

    A change is made as /site-to-site makes one, and applied by restarting vpn-router-setup without waiting for it.
    """
    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
        return 400, {'error': 'the body must be a JSON object'}
    body = body or {}
    if (method, path) == ('POST', '/backup/run'):
        if vpnrouter_backup.running():
            return 409, {'error': 'a backup is running'}
        result = run('systemctl', 'start', '--no-block', vpnrouter_backup.UNIT)
        if result is None or result.returncode != 0:
            return 500, {'error': f'the backup cannot be started: {result.stderr.strip() if result else "no systemctl"}'}
        return 202, {'started': True}
    if (method, path) not in (('GET', '/backup'), ('PUT', '/backup')):
        return 404, {'error': f'no route {method} {path}'}
    try:
        if method == 'GET':
            settings = vpnrouter.load_config()['backup']
            timer = run('systemctl', 'show', '-p', 'NextElapseUSecRealtime', '--value', vpnrouter_backup.TIMER)
            next_run = timer.stdout.strip() if timer and timer.returncode == 0 else ''
            return 200, {
                'settings': backup_settings(settings),
                'state': vpnrouter_backup.state() or None,
                'archives': vpnrouter_backup.archives(settings['path']) if settings['target'] == 'local' else [],
                'next': next_run if settings['enabled'] and next_run not in ('', 'n/a') else None,
                'client': vpnrouter_backup.PBS_CLIENT.exists(),
                'rclone': {'installed': shutil.which('rclone') is not None,
                           'config': vpnrouter_backup.RCLONE_CONFIG.is_file(), 'remotes': rclone_remotes()},
            }
        settings = {option: body[option] for option in vpnrouter.SCHEMA['backup'] if option in body}
        if not settings.get('pbs_password'):
            settings.pop('pbs_password', None)
        with vpnrouter.config_lock():
            data = vpnrouter.read_settings()
            current = data.get('backup')
            data['backup'] = {**(current if isinstance(current, dict) else {}), **settings}
            cfg = vpnrouter.with_defaults(data)
            vpnrouter.validate(cfg)
            vpnrouter.save_config(data)
    except vpnrouter.ConfigError as exc:
        return 400, {'error': str(exc)}
    except OSError as exc:
        return 500, {'error': f'the configuration cannot be written: {exc}'}
    except SystemExit as exc:
        return 500, {'error': str(exc.code)}
    run('systemctl', 'restart', '--no-block', 'vpn-router-setup.service')
    return 200, {'settings': backup_settings(cfg['backup'])}


def ca(method, path, body):
    """Answer a /ca request with vpnrouter_pki: the HTTP status and the JSON document.

      GET  /ca                                  {"settings", "templates", "status", "certificates"}: the pki section,
                                                the templates with the built-in ones, the root, the issuing CAs, the
                                                retired CAs and the warnings (vpnrouter_pki.status), and the
                                                certificates issued, newest first
      PUT  /ca                                  change any of the settings of the pki section
      POST /ca/certificates                     issue a certificate: {"ca", "template", "csr"} answers {"serial",
                                                "certificate", "chain"}; {"ca", "template", "subject", "sans",
                                                "password"} answers {"serial", "pfx"}, a PKCS#12 file in base64
      POST /ca/certificates/<serial>/revoke     revoke a certificate: {"reason"?}
      GET  /ca/bundle/<name>                    the PEM certificates a client trusts the CA with: {"name", "pem"}; for
                                                root the root alone, for an issuing CA the issuing CA and the root
      GET  /ca/issuing/<name>/csr               the CSR of an issuing CA that waits for the offline root, with the
                                                openssl extensions to sign it with: {"name", "csr", "extensions"}
      PUT  /ca/issuing/<name>/certificate       take its certificate signed by the root: {"certificate"}
      PUT  /ca/root/crl                         take a root CRL signed offline: {"crl"}

    A change of the settings is made as /site-to-site makes one; it, a revoked router certificate and an imported
    issuing CA certificate are applied by restarting vpn-router-setup without waiting for it.
    """
    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
        return 400, {'error': 'the body must be a JSON object'}
    body = body or {}
    parts = path.strip('/').split('/')
    route = (method, *parts[1:])
    try:
        cfg = vpnrouter.load_config()
        if len(route) == 3 and route[:2] == ('GET', 'bundle'):
            return 200, vpnrouter_pki.bundle(route[2])
        if route == ('GET',):
            return 200, {'settings': cfg['pki'], 'templates': vpnrouter.pki_templates(cfg),
                         'status': vpnrouter_pki.status(cfg), 'certificates': vpnrouter_pki.certificates()}
        if route == ('PUT',):
            settings = {option: body[option] for option in vpnrouter.SCHEMA['pki'] if option in body}
            with vpnrouter.config_lock():
                data = vpnrouter.read_settings()
                current = data.get('pki')
                data['pki'] = {**(current if isinstance(current, dict) else {}), **settings}
                cfg = vpnrouter.with_defaults(data)
                vpnrouter.validate(cfg)
                vpnrouter.save_config(data)
            run('systemctl', 'restart', '--no-block', 'vpn-router-setup.service')
            return 200, {'settings': cfg['pki'], 'templates': vpnrouter.pki_templates(cfg)}
        with vpnrouter_pki.locked():
            if route == ('POST', 'certificates'):
                return 201, vpnrouter_pki.issue(cfg, body.get('ca'), body.get('template'), csr=body.get('csr'),
                                                subject=body.get('subject'), sans=body.get('sans'),
                                                password=body.get('password'))
            if len(route) == 4 and route[:2] == ('POST', 'certificates') and route[3] == 'revoke':
                document = vpnrouter_pki.revoke(cfg, route[2], body.get('reason'))
            elif len(route) == 4 and route[:2] == ('GET', 'issuing') and route[3] == 'csr':
                return 200, vpnrouter_pki.csr(cfg, route[2])
            elif len(route) == 4 and route[:2] == ('PUT', 'issuing') and route[3] == 'certificate':
                document = vpnrouter_pki.import_ca(cfg, route[2], body.get('certificate'))
            elif route == ('PUT', 'root', 'crl'):
                return 200, vpnrouter_pki.import_root_crl(body.get('crl'))
            else:
                return 404, {'error': f'no route {method} {path}'}
    except vpnrouter.ConfigError as exc:
        return 400, {'error': str(exc)}
    except vpnrouter_pki.Failure as failure:
        return PKI_STATUS.get(failure.status, 500), {'error': str(failure)}
    except ldap.LDAPError as exc:
        return 500, {'error': f'the directory, which holds the PKI, failed: {exc}'}
    except OSError as exc:
        return 500, {'error': f'the PKI cannot be changed: {exc}'}
    except SystemExit as exc:
        return 500, {'error': str(exc.code)}
    if route[1] == 'issuing' or document.get('reissue'):
        run('systemctl', 'restart', '--no-block', 'vpn-router-setup.service')
    return 200, document


def account(name, method, path, body):
    """Answer an /account request of the user named by the token with vpnrouter_users: the HTTP status and the JSON document.

      GET  /account            the user, with admin, whether the user is a member of ADMIN_GROUP
      PUT  /account/password   set the password: {"current_password", "current_code"?, "password"}
      POST /account/otp        a new TOTP secret and its otpauth URI; nothing is stored
      PUT  /account/otp        store a TOTP secret: {"current_password", "current_code"?, "secret", "code"},
                               code a code of the secret

    A change needs the current password and, for an enrolled user, a current code; a wrong one is 403 and counts as
    a failed login. A password change revokes the user's refresh tokens.
    """
    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
        return 400, {'error': 'the body must be a JSON object'}
    body = body or {}
    route = (method, path.rstrip('/'))
    if route not in (('GET', '/account'), ('PUT', '/account/password'), ('POST', '/account/otp'), ('PUT', '/account/otp')):
        return 404, {'error': f'no route {method} {path}'}
    try:
        if route == ('PUT', '/account/password'):
            vpnrouter_users.check_password(body.get('password'))
        if method == 'PUT':
            vpnrouter_users.login(name, body.get('current_password'), body.get('current_code'))
        with vpnrouter_users.session() as connection:
            if route == ('GET', '/account'):
                document = {**vpnrouter_users.summary(vpnrouter_users.entry(connection, name)),
                            'admin': vpnrouter_users.is_admin(connection, name)}
            elif route == ('PUT', '/account/password'):
                document = vpnrouter_users.passwd(connection, name, body['password'])
            elif route == ('POST', '/account/otp'):
                document = vpnrouter_users.otp_new(connection, name)
            else:
                document = vpnrouter_users.otp_enrol(connection, name, body.get('secret'), body.get('code'))
        if route == ('PUT', '/account/password'):
            vpnrouter_auth.revoke(vpnrouter.load_config(), name)
    except vpnrouter_users.Failure as failure:
        if failure.status == 5:
            return 403, {'error': 'the current password or code is wrong'}
        return USER_STATUS.get(failure.status, 500), {'error': str(failure)}
    except (ldap.LDAPError, OSError) as exc:
        return 500, {'error': f'the user directory failed: {exc}'}
    except vpnrouter_auth.DatabaseError as exc:
        return 500, {'error': str(exc)}
    except SystemExit as exc:
        return 500, {'error': str(exc.code)}
    return 200, document


def metrics_history(view):
    """Answer GET /metrics/history?range=<view> with vpnrouter_metrics.history: the HTTP status and the JSON document.

    view is hour, the default, day, month or year (vpnrouter_metrics.RANGES).
    """
    if view not in vpnrouter_metrics.RANGES:
        return 400, {'error': f'range must be one of {", ".join(vpnrouter_metrics.RANGES)}'}
    try:
        with vpnrouter_metrics.database(vpnrouter.load_config()) as connection:
            return 200, vpnrouter_metrics.history(connection, view)
    except vpnrouter_metrics.DatabaseError as exc:
        return 500, {'error': str(exc)}
    except SystemExit as exc:
        return 500, {'error': str(exc.code)}


def changes_admins(connection, method, parts, body):
    """Whether a /users, /service-accounts or /groups request creates, renames to, changes or removes ADMIN_GROUP, or
    removes a member of it."""
    admins = vpnrouter_users.ADMIN_GROUP
    if parts[0] == 'groups':
        if method == 'POST' and len(parts) == 1:
            return body.get('name') == admins
        if method != 'GET' and len(parts) > 1 and parts[1] == admins:
            return True
        return method == 'PUT' and len(parts) == 2 and body.get('name') == admins
    if parts[0] in ('users', 'service-accounts') and method == 'DELETE' and len(parts) == 2:
        return admins in vpnrouter_users.groups_of(connection, parts[1])
    return False


def refusal(claims, method, path, body):
    """Why the holder of the claims may not make the request to a protected path, or '' when it may."""
    name = claims.get('sub')
    if path == '/account' or path.startswith('/account/'):
        return '' if isinstance(name, str) else 'the token names no user'
    if claims.get('admin') is True:
        return ''
    if not isinstance(name, str):
        return 'the token names no user'
    admins = vpnrouter_users.ADMIN_GROUP
    with vpnrouter_users.session() as connection:
        if not vpnrouter_users.is_admin(connection, name):
            return f'user {name} is not a member of {admins}'
        if changes_admins(connection, method, path.strip('/').split('/'), body if isinstance(body, dict) else {}):
            return f'only a token of vpn-router-token may change the group {admins} or remove its members'
    return ''


def auth(path, body):
    """Answer a POST to /auth with vpnrouter_users and vpnrouter_auth: the HTTP status and the JSON document.

      POST /auth           sign in: {"name", "password", "code"?}; the tokens
      POST /auth/refresh   {"refresh_token"}; new tokens, the refresh token used up
      POST /auth/logout    {"refresh_token"}; the refresh token revoked
    """
    if not isinstance(body, dict):
        return 400, {'error': 'the body must be a JSON object'}
    try:
        cfg = vpnrouter.load_config()
        if path == '/auth':
            vpnrouter_users.login(body.get('name'), body.get('password'), body.get('code'))
            with vpnrouter_users.session() as connection:
                if vpnrouter_users.service(vpnrouter_users.entry(connection, body['name'])):
                    raise vpnrouter_users.Failure('the name, the password or the code is wrong', 5)
            return 200, vpnrouter_auth.issue(cfg, body['name'])
        name = vpnrouter_auth.take(cfg, body.get('refresh_token'))
        if path == '/auth/logout':
            return 200, {'revoked': name is not None}
        if name is None:
            return 401, {'error': 'the refresh token is not valid'}
        with vpnrouter_users.session() as connection:
            user = vpnrouter_users.summary(vpnrouter_users.entry(connection, name))
        if not user['enabled'] or user['locked']:
            return 401, {'error': f'user {name} is disabled or locked'}
        return 200, vpnrouter_auth.issue(cfg, name)
    except vpnrouter_users.Failure as failure:
        return (401 if failure.status == 3 else USER_STATUS.get(failure.status, 500)), {'error': str(failure)}
    except (ldap.LDAPError, OSError) as exc:
        return 500, {'error': f'the user directory failed: {exc}'}
    except vpnrouter_auth.DatabaseError as exc:
        return 500, {'error': str(exc)}
    except SystemExit as exc:
        return 500, {'error': str(exc.code)}


def auth_wait(address):
    """Seconds until the client address may call /auth again, 0 when it may now; a call that may is counted."""
    now = time.monotonic()
    with _auth_lock:
        for idle in [key for key, times in _auth_calls.items() if times[-1] <= now - AUTH_WINDOW]:
            del _auth_calls[idle]
        calls = _auth_calls[address]
        while calls and calls[0] <= now - AUTH_WINDOW:
            calls.popleft()
        if len(calls) >= AUTH_LIMIT:
            return int(calls[0] + AUTH_WINDOW - now) + 1
        calls.append(now)
        return 0


class Handler(BaseHTTPRequestHandler):
    protocol_version = 'HTTP/1.1'

    def status(self):
        with _lock:
            if _cache['data'] is None or time.monotonic() - _cache['at'] > CACHE_SECONDS:
                _cache['data'] = collect(current())
                _cache['at'] = time.monotonic()
            return _cache['data']

    def claims(self, secret):
        """The claims of the request's token signed with the secret, or None without an acceptable one."""
        header = self.headers.get('Authorization', '')
        return vpnrouter_auth.verify(header[7:].strip(), secret) if header.startswith('Bearer ') else None

    def client(self):
        """The client address: the last X-Forwarded-For entry when the peer is a trusted proxy, else the peer."""
        peer = self.client_address[0]
        trusted = section(read_json(CONFIG_FILE), 'web').get('trusted_proxies') or [self.server.server_address[0]]
        forwarded = self.headers.get('X-Forwarded-For', '')
        if isinstance(trusted, list) and peer in trusted and forwarded.strip():
            return forwarded.split(',')[-1].strip()
        return peer

    def refusal(self, claims, path, payload):
        """The HTTP status and the message that refuse a request to a protected path, or None when it may be made."""
        try:
            reason = refusal(claims, self.command, path, payload)
        except (ldap.LDAPError, OSError) as exc:
            return 500, f'the user directory failed: {exc}'
        return (403, reason) if reason else None

    def answer(self, send_body):
        path = self.path.split('?', 1)[0]
        extra = []
        self.principal = None
        # A body that is not read must not be taken for the next request.
        if self.command not in ('GET', 'HEAD'):
            self.close_connection = True
        directory = next((name for name in ('users', 'service-accounts', 'groups', 'account', 'site-to-site', 'backup',
                                            'ca')
                          if path == f'/{name}' or path.startswith(f'/{name}/')), None)
        protected = path in ('/config', '/metrics/history', '/postgresql') or directory is not None
        signing = path in ('/auth', '/auth/refresh', '/auth/logout')
        state = current() if protected or signing else {}
        claims = self.claims(state['key']) if protected and state['key'] else None
        payload = self.request_body() if (protected or signing) and self.command not in ('GET', 'HEAD') else None
        if claims is not None:
            self.principal = 'admin' if claims.get('admin') is True else claims.get('sub')
        if (protected or signing) and not state['key']:
            body, kind, code = b'Not found\n', 'text/plain; charset=utf-8', 404
        elif signing and self.command != 'POST':
            body, kind, code = b'Method not allowed\n', 'text/plain; charset=utf-8', 405
        elif signing:
            wait = auth_wait(self.client()) if path != '/auth/logout' else 0
            if wait:
                code, document = 429, {'error': f'too many sign-in calls; retry in {wait} seconds'}
                extra.append(('Retry-After', str(wait)))
            else:
                code, document = auth(path, payload)
            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
        elif protected and claims is None:
            body, kind, code = b'Unauthorized\n', 'text/plain; charset=utf-8', 401
            extra.append(('WWW-Authenticate', 'Bearer'))
        elif protected and (refused := self.refusal(claims, path, payload)):
            code, kind = refused[0], 'application/json'
            body = json.dumps({'error': refused[1]}, indent=2).encode() + b'\n'
        elif path == '/config' and self.command in ('GET', 'HEAD'):
            body, kind, code = json.dumps(details(state), indent=2).encode() + b'\n', 'application/json', 200
        elif path == '/postgresql' and self.command in ('GET', 'HEAD'):
            body, kind, code = json.dumps(postgresql_databases(), indent=2).encode() + b'\n', 'application/json', 200
        elif path == '/metrics/history' and self.command in ('GET', 'HEAD'):
            query = urllib.parse.parse_qs(urllib.parse.urlsplit(self.path).query)
            code, document = metrics_history(query.get('range', ['hour'])[0])
            body, kind = json.dumps(document).encode() + b'\n', 'application/json'
        elif directory == 'account':
            code, document = account(claims['sub'], self.command, path, payload)
            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
        elif directory == 'site-to-site':
            code, document = site_to_site(self.command, path, payload)
            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
        elif directory == 'backup':
            code, document = backup(self.command, path, payload)
            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
        elif directory == 'ca':
            code, document = ca(self.command, path, payload)
            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
        elif directory == 'service-accounts':
            code, document = service_accounts(self.command, path, payload)
            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
        elif directory is not None:
            code, document = (users if directory == 'users' else groups)(state, self.command, path, payload)
            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
        elif self.command not in ('GET', 'HEAD'):
            body, kind, code = b'Method not allowed\n', 'text/plain; charset=utf-8', 405
        elif path.startswith('/pki/') and vpnrouter.PKI_NAME.match(path[5:-4]) and path[-4:] in PUBLISHED and \
                (vpnrouter_pki.PUBLISH_DIR / path[5:]).is_file():
            body, kind, code = (vpnrouter_pki.PUBLISH_DIR / path[5:]).read_bytes(), PUBLISHED[path[-4:]], 200
        elif path in ('/status', '/'):
            document = shown(self.status(), section(read_json(CONFIG_FILE), 'web').get('status_content'), self.client())
            agent = self.headers.get('User-Agent', '').lower()
            if path == '/status':
                body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
            elif 'curl' in agent or 'wget' in agent:
                body, kind = text_of(document).encode(), 'text/plain; charset=utf-8'
            else:
                body, kind = html_of(document).encode(), 'text/html; charset=utf-8'
            code = 200
        else:
            body, kind, code = b'Not found\n', 'text/plain; charset=utf-8', 404
        self.send_response(code)
        self.send_header('Content-Type', kind)
        self.send_header('Content-Length', str(len(body)))
        self.send_header('Cache-Control', 'no-store')
        for name, value in extra:
            self.send_header(name, value)
        self.end_headers()
        if send_body:
            self.wfile.write(body)

    def request_body(self):
        """The request body as JSON, None when there is none, or the string 'invalid'."""
        length = self.headers.get('Content-Length')
        if not length:
            return None
        try:
            size = int(length)
            if not 0 <= size <= BODY_LIMIT:
                return 'invalid'
            return json.loads(self.rfile.read(size) or b'null')
        except ValueError:
            return 'invalid'

    def do_GET(self):
        self.answer(True)

    def do_HEAD(self):
        self.answer(False)

    def do_POST(self):
        self.answer(True)

    def do_PUT(self):
        self.answer(True)

    def do_DELETE(self):
        self.answer(True)

    def log_message(self, format, *args):
        principal = getattr(self, 'principal', None) or '-'
        sys.stderr.write('%s - %s [%s] %s\n' % (self.client_address[0], principal, self.log_date_time_string(), format % args))


def log(message):
    print(f'vpn-router-web: {message}', file=sys.stderr, flush=True)


def initialize():
    """Make the signing key and the refresh tokens' database, retrying every INIT_RETRY_SECONDS until both are ready."""
    reported = None
    while True:
        phase = 'reading the configuration'
        try:
            cfg = vpnrouter.load_config()
            phase = 'making the signing key'
            vpnrouter_auth.ensure_key()
            phase = 'creating the token database'
            vpnrouter_auth.provision(cfg)
            phase = 'connecting to the token database'
            with vpnrouter_auth.database(cfg):
                pass
        except (OSError, SystemExit, vpnrouter_auth.DatabaseError) as exc:
            error = f'{phase} failed: {exc.code if isinstance(exc, SystemExit) else exc}'
            if error != reported:
                log(f'{error}; retrying every {INIT_RETRY_SECONDS} seconds')
                reported = error
            time.sleep(INIT_RETRY_SECONDS)
            continue
        log('ready')
        return


def main():
    signal.signal(signal.SIGTERM, lambda *_: sys.exit(0))
    initialize()
    try:
        vpnrouter_serve.serve(lambda: vpnrouter_net.web_listen(read_json(CONFIG_FILE), DEFAULT_PORT), Handler, log,
                              DISCOVERY_SECONDS)
    except KeyboardInterrupt:
        pass
    return 0


if __name__ == '__main__':
    sys.exit(main())