methods.py

import os
import json
import logging
from request import Request
from response import Response
from utils import (
    validate_path, read_file_safe, get_file_mimetype, 
    is_supported_file_type, validate_host_header,
    create_upload_filename, ensure_upload_directory
)
from exceptions import ForbiddenException

class Methods:
    """
    HTTP Methods implementation for GET, POST, and other methods
    """
    
    @staticmethod
    def GET(request: Request) -> Response:
        """
        Handle GET requests for HTML files and binary downloads
        """
        logger = logging.getLogger('GET_Handler')
        response = Response(request.version)
        
        try:
            # Validate Host header first
            if not Methods._validate_host(request, response):
                return response
            
            # Handle root path - serve index.html
            path = request.path
            if path == '/' or path == '':
                path = '/index.html'
            
            # Validate and get safe file path
            try:
                safe_path = validate_path(path)
            except ForbiddenException as e:
                logger.warning(f'Path validation failed for {path}: {e.message}')
                response.status = 403
                response.message = 'Forbidden'
                response.set_body('403 Forbidden: Access denied')
                return response
            
            # Check if file exists
            if not os.path.exists(safe_path):
                logger.info(f'File not found: {path}')
                response.status = 404
                response.message = 'Not Found'
                response.set_body('404 Not Found')
                return response
            
            # Check if file type is supported
            filename = os.path.basename(safe_path)
            if not is_supported_file_type(filename):
                logger.warning(f'Unsupported file type requested: {filename}')
                response.status = 415
                response.message = 'Unsupported Media Type'
                response.set_body('415 Unsupported Media Type')
                return response
            
            # Get MIME type
            mime_type = get_file_mimetype(filename)
            
            # Handle HTML files (serve for viewing)
            if mime_type.startswith('text/html'):
                success, content, error = read_file_safe(path, 'r')
                if not success:
                    logger.error(f'Error reading HTML file {path}: {error}')
                    response.status = 500
                    response.message = 'Internal Server Error'
                    response.set_body('500 Internal Server Error')
                    return response
                
                response.set_html_body(content)
                logger.info(f'Served HTML file: {filename} ({len(content)} bytes)')
                
            # Handle binary files (download)
            else:
                success, content, error = read_file_safe(path, 'rb')
                if not success:
                    logger.error(f'Error reading binary file {path}: {error}')
                    response.status = 500
                    response.message = 'Internal Server Error'
                    response.set_body('500 Internal Server Error')
                    return response
                
                response.set_file_download(filename, content)
                logger.info(f'Serving binary file: {filename} ({len(content)} bytes)')
            
            return response
            
        except Exception as e:
            logger.error(f'Unexpected error in GET handler: {e}')
            response.status = 500
            response.message = 'Internal Server Error'
            response.set_body('500 Internal Server Error')
            return response

    @staticmethod
    def POST(request: Request) -> Response:
        """
        Handle POST requests for JSON data upload
        """
        logger = logging.getLogger('POST_Handler')
        response = Response(request.version)
        
        try:
            # Validate Host header first
            if not Methods._validate_host(request, response):
                return response
            
            # Check Content-Type
            content_type = request.get_content_type()
            if not content_type.startswith('application/json'):
                logger.warning(f'Unsupported Content-Type for POST: {content_type}')
                response.status = 415
                response.message = 'Unsupported Media Type'
                response.set_body('415 Unsupported Media Type: Only application/json accepted')
                return response
            
            # Parse JSON body
            try:
                json_data = request.get_json_body()
            except ValueError as e:
                logger.warning(f'Invalid JSON in POST request: {e}')
                response.status = 400
                response.message = 'Bad Request'
                response.set_body('400 Bad Request: Invalid JSON')
                return response
            
            # Create uploads directory if it doesn't exist
            upload_dir = ensure_upload_directory()
            
            # Generate unique filename
            filename = create_upload_filename()
            file_path = os.path.join(upload_dir, filename)
            
            # Write JSON data to file
            try:
                with open(file_path, 'w') as f:
                    json.dump(json_data, f, indent=2)
                
                logger.info(f'JSON data saved to: {filename}')
                
                # Create success response
                response.status = 201
                response.message = 'Created'
                
                response_data = {
                    "status": "success",
                    "message": "File created successfully",
                    "filepath": f"/uploads/{filename}"
                }
                
                response.set_json_body(response_data)
                
            except Exception as e:
                logger.error(f'Error writing uploaded file: {e}')
                response.status = 500
                response.message = 'Internal Server Error'
                response.set_body('500 Internal Server Error: Could not save file')
            
            return response
            
        except Exception as e:
            logger.error(f'Unexpected error in POST handler: {e}')
            response.status = 500
            response.message = 'Internal Server Error'
            response.set_body('500 Internal Server Error')
            return response

    @staticmethod
    def OTHER(request: Request) -> Response:
        """
        Handle unsupported HTTP methods
        """
        logger = logging.getLogger('OTHER_Handler')
        logger.warning(f'Unsupported method: {request.method}')
        
        response = Response(request.version, 405, 'Method Not Allowed')
        response.add_header('Allow', 'GET, POST')
        response.set_body('405 Method Not Allowed: Only GET and POST methods are supported')
        return response

    @staticmethod
    def _validate_host(request: Request, response: Response) -> bool:
        """
        Validate Host header for security
        Returns False if validation fails (response is already set)
        """
        logger = logging.getLogger('HostValidator')
        
        # Check if Host header exists
        if not request.has_header('host'):
            logger.warning('Request missing Host header')
            response.status = 400
            response.message = 'Bad Request'
            response.set_body('400 Bad Request: Host header required')
            return False
        
        # For now, we'll accept any host header that looks reasonable
        # In a production server, you'd validate against known good hosts
        host = request.get_header('host')
        
        # Basic validation - check for obviously malicious hosts
        if any(char in host for char in ['<', '>', '"', "'"]):
            logger.warning(f'Suspicious Host header: {host}')
            response.status = 403
            response.message = 'Forbidden'
            response.set_body('403 Forbidden: Invalid Host header')
            return False
        
        logger.debug(f'Host validation: {host} ✓')
        return True