VORTEX-REC-LEAK/Controllers/Api/MessagesController.cs

using DeluxeBackend.Models;
using DeluxeBackend.Services;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using System.ComponentModel.DataAnnotations;
using System.Numerics;
using System.Security.Claims;
using static DeluxeBackend.Enums;

namespace DeluxeBackend.Controllers.Api
{
    [Route("api/messages")]
    [ApiController]
    public class MessagesController : ControllerBase
    {
        private readonly ILiteDbService db;
        private readonly IJwtService jwt;
        private readonly INotificationService ws;
        private readonly IMessageService messageService;

        public List<MessageType> allowedMsgs =
        [
            MessageType.TextMessage,
            MessageType.GameInvite,
            MessageType.GameInviteDeclined,
            MessageType.GameJoinFailed,
            MessageType.FriendStatusOnline,
            MessageType.RequestGameInvite,
            MessageType.RequestGameInviteDeclined,
            MessageType.PartyUpRequest
        ];

        public MessagesController(ILiteDbService _db, IJwtService _jwt, INotificationService _ws, IMessageService _messageService)
        {
            db = _db;
            jwt = _jwt;
            ws = _ws;
            messageService = _messageService;
        }



        [HttpGet("v2/get")]
        [Authorize]
        public async Task<IActionResult> get()
        {
            string? playerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value ?? User.FindFirst("sub")?.Value;

            if (string.IsNullOrEmpty(playerId))
            {
                return Unauthorized();
            }

            Account player = db.Accounts.FindById((long)Convert.ToDouble(playerId));
            if (player == null)
            {
                return Unauthorized();
            }

            var msgs = db.Messages
                .Query()
                .Include(x => x.Player)
                .Include(x => x.FromPlayer)
                .Where(x => x.Player.Id == player.Id)
                .OrderByDescending(x => x.Id)
                .ToList()
                .Select(r => r.ToDictionary())
                .ToList();

            return Ok(msgs);
        }

        [HttpPost("v2/delete")]
        [Authorize]
        public async Task<IActionResult> delete([FromForm(Name = "Id"), Required] long msgId)
        {
            string? rawPlayerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value
                ?? User.FindFirst("sub")?.Value;

            if (string.IsNullOrEmpty(rawPlayerId))
                return Unauthorized();

            if (!long.TryParse(rawPlayerId, out long playerId))
                return Unauthorized();

            Account? player = db.Accounts.FindById(playerId);
            if (player == null)
                return Unauthorized();


            Message? message = db.Messages.Include(x => x.Player).FindById(msgId);
            if (message == null)
            {
                return NotFound();
            }
            if (message.Player.Id != player.Id)
            {
                return StatusCode(403);
            }

            db.Messages.Delete(msgId);

            return Ok();
        }

        public class V3DeleteRequestDto
        {
            public required List<long> MessageIds {  get; set; }
        }

        [HttpPost("v3/delete")]
        [Authorize]
        public async Task<IActionResult> V3Delete([FromBody] V3DeleteRequestDto request)
        {
            string? rawPlayerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value
        ?? User.FindFirst("sub")?.Value;

            if (string.IsNullOrEmpty(rawPlayerId))
                return Unauthorized();

            if (!long.TryParse(rawPlayerId, out long playerId))
                return Unauthorized();

            Account? player = db.Accounts.FindById(playerId);
            if (player == null)
                return Unauthorized();

            if (request.MessageIds == null || request.MessageIds.Count == 0)
                return BadRequest("No message IDs provided.");

            foreach (ulong messageId in request.MessageIds)
            {
                Message? message = db.Messages
                    .Include(x => x.Player)
                    .FindById((long)messageId);

                if (message == null)
                    continue;

                if (message.Player.Id != player.Id)
                    continue;

                db.Messages.Delete(messageId);
            }

            return Ok();
        }



        [HttpPost("v2/send")]
        [Authorize]
        public async Task<IActionResult> send([FromForm(Name = "ToPlayerId"), Required] long toPlayerId, [FromForm(Name = "Type"), Required] MessageType type, [FromForm(Name = "Data")] string data = "", [FromForm(Name = "RoomId")] long? roomId = null)
        {
            string? rawPlayerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value
                ?? User.FindFirst("sub")?.Value;

            if (string.IsNullOrEmpty(rawPlayerId))
                return Unauthorized();

            if (!long.TryParse(rawPlayerId, out long playerId))
                return Unauthorized();

            Account? player = db.Accounts.FindById(playerId);
            if (player == null)
                return Unauthorized();
            Account? player2 = db.Accounts.FindById(toPlayerId);
            if (player2 == null)
                return NotFound();


            if (!allowedMsgs.Contains(type) && false)
            {
                return BadRequest();
            }

            await messageService.SendMessage(player, player2, type, data);



            return Ok();
        }

    }
}