expenses.nim

import strutils, std/strformat, std/os, std/times, std/threadpool

#TODO Change all Banner

var startBanner = "Welcome to expenses!\n"

var loginBanner = "Login\n"

var registerBanner = "Register\n"

var userBanner = "UserPanel\n"

#A HashMap containig the credentials collected from the Users.txt
var username = ""

var inactive_time = 0.0



proc checkLastInputTime() =
  while true:
    sleep(100)

    let timeSinceInput = epochTime() - inactive_time
    if timeSinceInput > 60:
      echo "No user input in the last 2 minutes."
      quit(QuitSuccess)
      # Handle no user input logic here


proc setTime() =
    inactive_time = epochTime()


proc timeCheck() = 
    let time = epochTime() - inactive_time
    echo "Time: ", time
    if time > 10.0:
        quit(QuitSuccess)

#[
    This functionr returns an unsigned integer typed in by the user which is not bigger then "bound"
]#
proc getUserInputInteger(bound: uint8): uint =
    var userInput:uint = 0
    setTime()

    while true:
        try:
            userInput = parseUInt(stdin.readLine)
        except CatchableError:
            echo "Error please try again!"
            quit(QuitFailure)

        if userInput < bound:
            return userInput
        echo "Please enter a unsigned integer not bigger then ", bound

#TODO Maybe add bound like in getUserInputInteger(bound: uint8)
proc getUserInputString(): string =
    setTime()

    return stdin.readLine()

#Check if the username already exists. Returns true if exists else false
proc usernameExists(username: string): bool = 
    for _, path in walkDir("data"):

        #TODO Could be a problem with different os because of unix and windows path
        var splitPath = path.split('/')
        if username == splitPath[1]:
            return true
    return false

proc badChars(input: string): bool = 
    if input.contains("..") or input.contains("/") or input.contains("\\"):
        return true
    return false








#Logic for Logging into the Application
proc login() =
    setTime()
    echo loginBanner
    var counter = 3

    while counter >= 1:
        echo "Username > "
        username = getUserInputString()

        if not usernameExists(username):
            dec counter
            echo "Username does not exists, ", counter, " attempts left"
            continue
        
        echo "Password > "
        let password = getUserInputString()

        
        if password == readFile(fmt"data/{username}/passwd.txt"):
            echo "Welcome ", username
            return

        dec counter
        echo "Password was not correct, ", counter, " attempts left"

    quit(QuitFailure)

#Logic for Registering a new User
proc register() =
    echo registerBanner
    var password = ""
    while true:
        echo "Username > "
        username = getUserInputString()
        if badChars(username):
            echo "Enter another Username bad Character detected!"
            quit(QuitFailure)

        if usernameExists(username):
            echo "Username already exists take another one\n"
            quit(QuitFailure)

        if username.len() < 1:
            quit(QuitFailure)


        echo "Password > "
        password = getUserInputString()
        if usernameExists(username):
            echo "Username already exists take another one\n"
            quit(QuitFailure)

        break
        #Check if username contains .. or /

    createDir(fmt"data/{username}")
    writeFile(fmt"data/{username}/passwd.txt", password)
    createDir(fmt"data/{username}/Expenses")

    
    #Testing inline assembly
    asm """
      nop
      nop
      nop
    """

template label(name, body) =
  {.emit: astToStr(name) & ":".}
  body

template goto(name) =
  {.emit: "goto " & astToStr(name) & ";".}





proc userMenu() =

    while true:
        echo userBanner
        echo "0. Add Expense\n1. Show Expenses\n2. Show Expense details\n3. Delete Expense\n4. Show max amount spend\n5. Delete Account\n6. Share Expense\n7. Exit\n"

        let userChoice = getUserInputInteger(8)

        #TODO handle crash wrong candidate name
        case userChoice:
            of 0:

                #Stop path Traversal
                var fileName = ""
                while true:
                    echo "Enter the name of the expense > "
                    fileName = getUserInputString()
                    if badChars(fileName):
                        echo "Bad Char Detected!"
                        quit(QuitFailure)

                    break

                
                echo "Enter a little description of the expense > "
                let description = getUserInputString()

                label a:
                    echo "Enter the amount you spend as an Integer > "
                var amount = 0.0
                #let amount = parseInt(stdin.readLine)
                try:
                    amount = parseFloat(stdin.readLine)
                except CatchableError:
                    goto a
                    


                #let toWrite = description & '\n' & intToStr(amount)
                let toWrite = description & '\n' & amount.formatFloat(ffDecimal, 2)
                writeFile(fmt"data/{username}/Expenses/{fileName}", toWrite)

            of 1:
                echo "These are all your expenses"
                #TODO Refactor this return hashmap with every file/dir in the directory
                for _, path in walkDir(fmt"data/{username}/Expenses/"):
                    #TODO Could be a problem with different os because of unix and windows path
                    var splitPath = path.split('/')   
                    echo  splitPath[3]

            of 2:

                echo "Enter the name of the expense > "
                let expenseName = getUserInputString()

                

                for _, path in walkDir(fmt"data/{username}/Expenses"):
                    #TODO Could be a problem with different os because of unix and windows path
                    let splitPath = path.split('/')
                    
                    #First Vulnerability logical flaw
                    #User can traverse every directory he wants because or splitPath[3] != expenseName is bugged
                    asm """
                    nop
                    nop
                    nop
                    """
                    #echo (path)
                    # echo (splitPath[3])
                    # echo(expenseName)
                    if (splitPath[3] == expenseName or splitPath[3] != expenseName) and fileExists(fmt"data/{username}/Expenses/{expenseName}") and not expenseName.contains("passwd.txt"):
                        let fileContent = readFile(fmt"data/{username}/Expenses/{expenseName}")
                        asm """
                        nop
                        nop
                        nop
                        """
                        echo fileContent
                        break
            of 3:
                var expenseName = ""
                while true:
                    echo "Enter the Name of the expense you want to delete > "
                    expenseName = getUserInputString()
                    if badChars(expenseName):
                        echo "Bad Character Detected!"
                        quit(QuitFailure)

                    break
                
                let filePath = fmt"data/{username}/Expenses/{expenseName}"
                if fileExists(filePath):
                    removeFile(filePath)
                    echo "Expense Deleted"
                else:
                    echo "The expense you want to delete does not exist!"

            of 4:
                #var sum = 0
                var sum = 0.0

                for _, path in walkDir(fmt"data/{username}/Expenses"):
                    #TODO Could be a problem with different os because of unix and windows path
                    let lines = readLines(path, 2)
                    
                    #sum += parseInt(lines[1])
                    sum += parseFloat(lines[1])

                    echo lines[1]
                echo fmt"You spend: ${sum}"

            of 5:
                echo "Do you really want to delete your account? (y or n)"
                setTime()

                let choice = stdin.readLine()

                case choice:
                    of "y":
                        removeDir(fmt"data/{username}")
                        quit(QuitSuccess)
                    of "n":
                        continue
                    else:
                        continue           
            of 6:
                echo "With how many Users do you want to share the expense?"
                var choice = getUserInputInteger(10)
                let share = choice
                var counter = 1

                var users: seq[string]

                if choice == 0:
                    continue

                while choice > 0:
                    echo "Enter the name of the #", counter, " users"
                    let user = getUserInputString()

                    #Check if username exists if not continue to ask for registered user
                    if not usernameExists(user) or username == user or users.contains(user):
                        echo "User not found/User already entered/Own Username! Please enter another User that is already registered"
                        continue
                    else:
                        inc counter
                        dec choice
                        users.add(user)
                
                echo "Enter the name of the expense > "
                let fileName = getUserInputString()

                echo "Enter a little description of the expense > "
                let description = getUserInputString()

                label b:
                    echo "Enter the amount you spend as an Integer > "
                #var amount = parseInt(stdin.readLine)
                var amount = 0.0
                try:
                    amount = parseFloat(stdin.readLine)
                except CatchableError:
                    goto b


                #amount = int(amount / int(share + 1))
                amount = amount / float(share + 1)

                echo amount

                #let toWrite = description & '\n' & intToStr(amount)
                let toWrite = description & '\n' & amount.formatFloat(ffDecimal, 2)


                for x in users:
                    writeFile(fmt"data/{x}/Expenses/{fileName}_Shared", toWrite)
                
                writeFile(fmt"data/{username}/Expenses/{fileName}_Shared", toWrite)
            of 7:

                quit(QuitSuccess)
            else:
                discard "impossible"


proc ctrlc() {.noconv.} =
  echo "Ctrl+C fired!"
  quit(QuitSuccess)

proc main() = 

    #[
    #Read Users.txt into program and store into hashmap
    var strm = newFileStream("data/users/Users.txt", fmRead)
    var line = ""
    if not isNil(strm):
        while strm.readLine(line):
            var x = line.split(':')
            credentialsMap[x[0]] = (x[1], parseBool(x[2]))
            echo credentialsMap
        strm.close()
    ]#

    spawn checkLastInputTime()

    setControlCHook(ctrlc)

    setTime()

    echo startBanner
    echo "0.Login\n1.Register"
    let userChoice = getUserInputInteger(2)
    echo userChoice
    
    case userChoice:
        of 0:
            login()
        of 1:
           register()
        else:
            discard "impossible"

    userMenu()    

#Starting point
when isMainModule:
    main()