;;; sieve-manage.el --- Implementation of the managesieve protocol in elisp  -*- lexical-binding:t -*-

;; Copyright (C) 2001-2023 Free Software Foundation, Inc.

;; Author: Simon Josefsson <simon@josefsson.org>
;;         Albert Krewinkel <tarleb@moltkeplatz.de>

;; This file is part of GNU Emacs.

;; GNU Emacs is free software: you can redistribute it and/or modify
;; it under the terms of the GNU General Public License as published by
;; the Free Software Foundation, either version 3 of the License, or
;; (at your option) any later version.

;; GNU Emacs is distributed in the hope that it will be useful,
;; but WITHOUT ANY WARRANTY; without even the implied warranty of
;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;; GNU General Public License for more details.

;; You should have received a copy of the GNU General Public License
;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.

;;; Commentary:

;; This library provides an elisp API for the managesieve network
;; protocol.
;;
;; It uses the SASL library for authentication, which means it
;; supports DIGEST-MD5, CRAM-MD5, SCRAM-MD5, NTLM, PLAIN and LOGIN
;; methods.  STARTTLS is not well tested, but should be easy to get to
;; work if someone wants.
;;
;; The API should be fairly obvious for anyone familiar with the
;; managesieve protocol, interface functions include:
;;
;; `sieve-manage-open'
;; open connection to managesieve server, returning a buffer to be
;; used by all other API functions.
;;
;; `sieve-manage-opened'
;; check if a server is open or not
;;
;; `sieve-manage-close'
;; close a server connection.
;;
;; `sieve-manage-listscripts'
;; `sieve-manage-deletescript'
;; `sieve-manage-getscript'
;; performs managesieve protocol actions
;;
;; and that's it.  Example of a managesieve session in *scratch*:
;;
;; (with-current-buffer (sieve-manage-open "mail.example.com")
;;   (sieve-manage-authenticate)
;;   (sieve-manage-listscripts))
;;
;; => ((active . "main") "vacation")
;;
;; References:
;;
;; RFC5804,
;; "A Protocol for Remotely Managing Sieve Scripts",
;; by Tim Martin.
;;
;; Release history:
;;
;; 2001-10-31 Committed to Oort Gnus.
;; 2002-07-27 Added DELETESCRIPT.  Suggested by Ned Ludd.
;; 2002-08-03 Use SASL library.
;; 2013-06-05 Enabled STARTTLS support, fixed bit rot.

;;; Code:

(if (locate-library "password-cache")
    (require 'password-cache)
  (require 'password))

(eval-when-compile (require 'cl-lib))
(require 'sasl)
(autoload 'sasl-find-mechanism "sasl")
(autoload 'auth-source-search "auth-source")
(autoload 'auth-info-password "auth-source")

;; User customizable variables:

(defgroup sieve-manage nil
  "Low-level Managesieve protocol issues."
  :group 'mail
  :prefix "sieve-")

(defcustom sieve-manage-log "*sieve-manage-log*"
  "Name of buffer for managesieve session trace."
  :type 'string)

(defcustom sieve-manage-server-eol "\r\n"
  "The EOL string sent from the server."
  :type 'string)

(defcustom sieve-manage-client-eol "\r\n"
  "The EOL string we send to the server."
  :type 'string)

(defcustom sieve-manage-authenticators '(digest-md5
					 cram-md5
					 scram-md5
					 ntlm
					 plain
					 login)
  "Priority of authenticators to consider when authenticating to server."
  ;; FIXME Improve this.  It's not `set'.
  ;; It's like (repeat (choice (const ...))), where each choice can
  ;; only appear once.
  :type '(repeat symbol))

(defcustom sieve-manage-authenticator-alist
  '((cram-md5   sieve-manage-cram-md5-p       sieve-manage-cram-md5-auth)
    (digest-md5 sieve-manage-digest-md5-p     sieve-manage-digest-md5-auth)
    (scram-md5  sieve-manage-scram-md5-p      sieve-manage-scram-md5-auth)
    (ntlm       sieve-manage-ntlm-p           sieve-manage-ntlm-auth)
    (plain      sieve-manage-plain-p          sieve-manage-plain-auth)
    (login      sieve-manage-login-p          sieve-manage-login-auth))
  "Definition of authenticators.

\(NAME CHECK AUTHENTICATE)

NAME names the authenticator.  CHECK is a function returning non-nil if
the server support the authenticator and AUTHENTICATE is a function
for doing the actual authentication."
  :type '(repeat (list (symbol :tag "Name") (function :tag "Check function")
		       (function :tag "Authentication function"))))

(defcustom sieve-manage-default-port "sieve"
  "Default port number or service name for managesieve protocol."
  :type '(choice natnum string)
  :version "24.4")

(defcustom sieve-manage-default-stream 'network
  "Default stream type to use for `sieve-manage'."
  :version "24.1"
  :type 'symbol)

(defcustom sieve-manage-ignore-starttls nil
  "Ignore STARTTLS even if STARTTLS capability is provided."
  :version "26.1"
  :type 'boolean)

(defconst sieve-manage-supported-commands
  '(CAPABILITY   ;; send automatically when connecting
    STARTTLS     ;; supported implicilty by sasl/networking
    AUTHENTICATE
    LISTSCRIPTS
    SETACTIVE
    GETSCRIPT
    DELETESCRIPT
    HAVESPACE
    PUTSCRIPT
    LOGOUT)
  "Commands supported by the \\='sieve-manage\\=' client.

The following commands from rfc5804 are not implemented:
- NOOP
- RENAMESCRIPT
- CHECKSCRIPT
- UNAUTHENTICATE")

;; Internal variables:
(defconst sieve-manage--coding-system 'utf-8-unix
  "Use \\='utf-8-unix coding system for (network) communication.

Defines the coding system used for the internal (process, log)
buffers and the network stream created to communicate with the
managesieve server.  Using \\='utf-8-unix encoding corresponds to
the use of UTF-8 in rfc5804 (managesieve).  The explicit use of
\\='-unix\\=' avoids EOL conversions (and thus keeps CRLF (\"\\r\\n\")
sequences intact).")

(defconst sieve-manage-local-variables '(sieve-manage-server
					 sieve-manage-port
					 sieve-manage-auth
					 sieve-manage-stream
					 sieve-manage-process
					 sieve-manage-client-eol
					 sieve-manage-server-eol
					 sieve-manage-capability))
(defvar sieve-manage-stream nil)
(defvar sieve-manage-auth nil)
(defvar sieve-manage-server nil)
(defvar sieve-manage-port nil)
(defvar sieve-manage-state 'closed
  "Managesieve state.
Valid states are `closed', `initial', `nonauth', and `auth'.")
(defvar sieve-manage-process nil)
(defvar sieve-manage-capability nil)

(define-error 'sieve-manage-error
              "Unknown sieve-manage error")
(define-error 'sieve-manage-encode-error
              "sieve-manage encoding error" 'sieve-manage-error)
(define-error 'sieve-manage-server-error
              "Managesieve server signaled an error" 'sieve-manage-error)
(define-error 'sieve-manage-client-error
              "sieve-manage client error" 'sieve-manage-error)
(define-error 'sieve-manage-unsupported-cmd
              "Command not supported by sieve-manage client."
              'sieve-manage-client-error)

;; Internal utility functions
(defun sieve-manage--set-buffer-maybe-append-text (buffer-name
                                                   &rest args)
  "Append ARGS to buffer named BUFFER-NAME and return buffer.

To be used with process and log buffers.  When the buffer doesn't
exist, it gets created and configure as follows:
- set coding system to the value of `sieve-manage--coding-system',
- set buffer to single-byte mode,
- set `after-change-functions' to nil to avoid those
  functions messing with buffer content,
- disable undo (to save a bit of memory and improve
  performance).

ARGS can be a nil, a string or a list of strings.  If no
ARGS are provided, the content of buffer will not be
modified."
  (let* ((existing-buffer (get-buffer buffer-name))
         (buffer (or existing-buffer
                     (get-buffer-create buffer-name))))
    (with-current-buffer buffer
      (unless existing-buffer
        (set-buffer-file-coding-system sieve-manage--coding-system)
        (set-buffer-multibyte nil)
        (setq-local after-change-functions nil)
        (buffer-disable-undo))
      (when args
        (goto-char (point-max))
        (apply #'insert args)))
    buffer))

(defun sieve-manage--append-to-log (&rest args)
  "Append ARGS to `sieve-manage-log' buffer.

If `sieve-manage-log' is nil, logging is disabled.  See also
`sieve-manage--set-buffer-maybe-append-text'."
  (when sieve-manage-log
    (apply #'sieve-manage--set-buffer-maybe-append-text
           sieve-manage-log
           args)))

(defun sieve-manage--message (format-string &rest args)
  "Wrapper around `message' which also logs to sieve manage log.
See `message' for the use of FORMAT-STRING and ARGS.
See `sieve-manage--append-to-log'."
  (let ((ret (apply #'message
                    (concat "sieve-manage: " format-string)
                    args)))
    (sieve-manage--append-to-log ret "\n")
    ret))

(defun sieve-manage--error (err format-string &rest args)
  "Signal an error of type ERR.
ERR should be an error type derived from
\\='sieve-manage-error\\='.  See `format' for the use of
FORMAT-STRING and ARGS.

Errors are also logged to sieve manage log (see
`sieve-manage--append-to-log')."
  (let ((msg (apply #'format
                    (concat "Error: " format-string)
                    args)))
    (sieve-manage--append-to-log msg "\n")
    (signal err (list msg))))

(defun sieve-manage--convert-multibyte (str)
  "Convert multibyte STR to unibyte octet string.
The conversion is done using `sieve-manage--coding-system'."
  (encode-coding-string str sieve-manage--coding-system t))

(defun sieve-manage--mk-quoted (octet-str)
  "Convert OCTET-STR to rfc5804 \\='quoted\\=' string."
  (or (stringp octet-str)
      (sieve-manage--error 'sieve-manage-encode-error
                           "Argument must be a string"))
  (format "\"%s\"" octet-str))

(defun sieve-manage--mk-literal-c2s (octet-str)
  "Convert OCTET-STR to rfc5804 \\='literal-c2s\\=' string."
  (or (stringp octet-str)
      (sieve-manage--error 'sieve-manage-encode-error
                           "Argument must be a string"))
  (format "{%d+}%s%s"
          (length octet-str)
          sieve-manage-client-eol
          octet-str))

(defun sieve-manage--mk-literal-s2c (octet-str)
  "Convert OCTET-STR to rfc5804 \\='literal-s2c\\=' string."
  (or (stringp octet-str)
      (sieve-manage--error 'sieve-manage-encode-error
                           "Argument must be a string"))
  (format "{%d}%s%s"
            (length octet-str)
            sieve-manage-client-eol
            octet-str))

(defun sieve-manage-encode (item)
  "Convert ITEM to a rfc5804 protocol string.

An ITEM can be a:
1. symbol (will be interpreted as sieve command name),
2. number (positive integer or 0),
3. string (will be converted to unibyte using \\='utf-8-unix
   coding system and encoded as \\='quoted\\=' rfc5804 string),
4. buffer (buffer content will be converted to unibyte using
   `buffer-file-coding-system and encoded as \\='literal-c2s\\=' rfc5804
   string),
5. cons cell (TYPE . DATA) where the following combinations of TYPE
   and DATA are supported:
   - (number . <int>) where <int> is an integer in the range of
     [0..4294967296]
   - (cmd-name . <name>) where <name> is either a unibyte string or one of
     the symbols from `sieve-manage-supported-commands'
   - (<str-type> . <octet-str>) where <str-type> is one of \\='quoted,
     \\='literal-c2s, \\='literal-s2c and <octet-str> is a unibyte string
   - (<str-type> . <str>) where <str-type> is one of \\='mb-quoted,
     \\='mb-literal-c2s, \\='mb-literal-s2c and <str> is a (multibyte) UTF-8
     string which will be converted to unibyte using coding system
     \\='utf-8-unix."
  (cond
   ((symbolp item)
    (sieve-manage-encode (cons 'cmd-name item)))
   ((and (integerp item) (>= item 0))
    (sieve-manage-encode (cons 'number item)))
   ((stringp item)
    ;; TODO:
    ;; - check if character set of item requires use of 'literal-c2s
    ;; - check if length of item requires use of 'literal-c2s
    (sieve-manage-encode (cons 'quoted
                               (sieve-manage--convert-multibyte item))))
   ((bufferp item)
    (sieve-manage-encode
     (cons 'literal-c2s (with-current-buffer item
                          (encode-coding-region
                           (point-min) (point-max)
                           (buffer-local-value 'buffer-file-coding-system
                                               item)
                           t)))))
   ((consp item)
    (let ((type (car item))
          (data (cdr item)))
      (pcase type
        ('number (format "%d" data))
        ('cmd-name
         (when (and (symbolp data)
                    (not (memq data sieve-manage-supported-commands)))
           (sieve-manage--error 'sieve-manage-unsupported-cmd
                                "Command '%s' is not supported" data))
         (format "%s" data))
        ('quoted (sieve-manage--mk-quoted data))
        ('literal-c2s (sieve-manage--mk-literal-c2s data))
        ('literal-s2c (sieve-manage--mk-literal-s2c data))
        ('mb-quoted (sieve-manage--mk-quoted
                     (sieve-manage--convert-multibyte data)))
        ('mb-literal-c2s (sieve-manage--mk-literal-c2s
                          (sieve-manage--convert-multibyte data)))
        ('mb-literal-s2c (sieve-manage--mk-literal-s2c
                          (sieve-manage--convert-multibyte data)))
        (_ (sieve-manage--error 'sieve-manage-encode-error
                                "Unknown encoding type: '%s'"
                                type)))))
   (t (sieve-manage--error 'sieve-manage-encode-error
                           "Don't know how to encode '%s'" item))))

(defun sieve-manage--detect-buffer-coding-system (&optional buffer)
  "Return the coding system to be use for (sieve script) BUFFER.

Since rfc5804 requires sieve scripts to use (a subset of) UTF-8, the
returned coding system is of type \\='utf-8 with either \\='-unix\\=',
\\='-dos\\=' or \\='-mac\\=' eol-type."
  (with-current-buffer (or buffer (current-buffer))
    (let ((coding-system (detect-coding-region
                          (point-min) (point-max) t)))
          (alist-get (coding-system-eol-type coding-system)
                '((0 . utf-8-unix)
                  (1 . utf-8-dos)
                  (2 . utf-8-mac))
                'utf-8-unix))))

(defun sieve-manage-decode (octets &optional buffer)
  "Convert managesieve protocol OCTETS to UTF-8 string.

If BUFFER is non-nil detect \\='eol-type\\=' of OCTETS, use corresponding
\\='utf-8-<eol-type> coding system to decode octets, set
`buffer-file-coding-system` of BUFFER, insert the decoded UTF-8 string
into BUFFER and return BUFFER.

Otherwise, decode OCTETS using `sieve-manage--coding-system' (\\='utf-8-unix)
and return the resulting UTF-8 string."
  (when octets
    (if buffer
        (with-current-buffer buffer
          (insert octets)
          (let ((coding-system
                 (sieve-manage--detect-buffer-coding-system)))
            (set-buffer-file-coding-system coding-system)
            (decode-coding-region (point-min) (point-max)
                                  coding-system))
          buffer)
      (decode-coding-string
       octets sieve-manage--coding-system t))))

(defun sieve-manage-make-process-buffer ()
  (let ((buffer (sieve-manage--set-buffer-maybe-append-text
                 (format " *sieve %s:%s*"
                         sieve-manage-server
                         sieve-manage-port))))
    (with-current-buffer buffer
      (mapc #'make-local-variable sieve-manage-local-variables))
    buffer))

(defun sieve-manage-erase (&optional p buffer)
  (with-current-buffer (or buffer (current-buffer))
    (let* ((start (point-min))
           (end (or p (point-max)))
           (logdata (buffer-substring-no-properties start end)))
      (sieve-manage--append-to-log logdata)
      (delete-region start end)
      logdata)))

(defun sieve-manage-open-server (server port &optional stream buffer)
  "Open network connection to SERVER on PORT.
Return the buffer associated with the connection."
  (with-current-buffer buffer
    (sieve-manage-erase)
    (setq sieve-manage-state 'initial)
    (pcase-let ((`(,proc . ,props)
                 (open-network-stream
                  "SIEVE" buffer server port
                  :type stream
                  :coding 'binary
                  :capability-command (concat "CAPABILITY"
                                              sieve-manage-client-eol)
                  :end-of-command (concat "^\\(OK\\|NO\\|BYE\\).*"
                                          sieve-manage-server-eol)
                  :success (concat "^OK.*" sieve-manage-server-eol)
                  :return-list t
                  :starttls-function
                  (lambda (capabilities)
	            (when (and (not sieve-manage-ignore-starttls)
		               (string-match "\\bSTARTTLS\\b" capabilities))
                      (concat "STARTTLS" sieve-manage-client-eol))))))
      (setq sieve-manage-process proc)
      (setq sieve-manage-capability
            (sieve-manage-parse-capability (plist-get props :capabilities)))
      ;; Ignore new capabilities issues after successful STARTTLS
      (when (or sieve-manage-ignore-starttls
		(and (memq stream '(nil network starttls))
		     (eq (plist-get props :type) 'tls)))
        (sieve-manage-drop-next-answer))
      (current-buffer))))

;; Authenticators
(defun sieve-sasl-auth (buffer mech)
  "Login to server using the SASL MECH method."
  (sieve-manage--message "Authenticating using %s..." mech)
  (with-current-buffer buffer
    (let* ((auth-info (auth-source-search :host sieve-manage-server
                                          :port "sieve"
                                          :max 1
                                          :create t))
           (user-name (or (plist-get (nth 0 auth-info) :user) ""))
           (user-password (or (auth-info-password (nth 0 auth-info)) ""))
           (client (sasl-make-client (sasl-find-mechanism (list mech))
                                     user-name "sieve" sieve-manage-server))
           (sasl-read-passphrase
            ;; We *need* to copy the password, because sasl will modify it
            ;; somehow.
            (lambda (_prompt) (copy-sequence user-password)))
           (step (sasl-next-step client nil))
           (_tag (sieve-manage-send-command
                  'AUTHENTICATE
                  (cons 'quoted mech)
                  (and (sasl-step-data step)
                       (cons 'quoted (base64-encode-string
                                      (sasl-step-data step)
                                      'no-line-break)))))
           data rsp)
      (catch 'done
        (while t
          (setq rsp nil)
          (goto-char (point-min))
          (while (null (or (progn
                             (setq rsp (sieve-manage-is-string))
                             (if (not (and rsp (looking-at
                                                sieve-manage-server-eol)))
                                 (setq rsp nil)
                               (goto-char (match-end 0))
                               rsp))
                           (setq rsp (sieve-manage-is-oknobye))))
            (accept-process-output sieve-manage-process 1)
            (goto-char (point-min)))
          (sieve-manage-erase)
          (when (sieve-manage-ok-p rsp)
            (when (and (cadr rsp)
                       (string-match "^SASL \"\\([^\"]+\\)\"" (cadr rsp)))
              (sasl-step-set-data
               step (base64-decode-string (match-string 1 (cadr rsp)))))
            (if (and (setq step (sasl-next-step client step))
                     (setq data (sasl-step-data step)))
                ;; We got data for server but it's finished
                (sieve-manage--error 'sieve-manage-server-error
                 "Server not ready for SASL data: %s" data)
              ;; The authentication process is finished.
              (sieve-manage--message "Logged in as %s using %s"
                                     user-name mech)
              (throw 'done t)))
          (unless (stringp rsp)
            (sieve-manage--error 'sieve-manage-server-error
             "Server aborted SASL authentication: %s" (caddr rsp)))
          (sasl-step-set-data step (base64-decode-string rsp))
          (setq step (sasl-next-step client step))
          (sieve-manage-send
           (cons 'quoted
                 (if (sasl-step-data step)
                     (base64-encode-string (sasl-step-data step)
                                           'no-line-break)
                   ""))))))))

(defun sieve-manage-cram-md5-p (buffer)
  (sieve-manage-capability "SASL" "CRAM-MD5" buffer))

(defun sieve-manage-cram-md5-auth (buffer)
  "Login to managesieve server using the CRAM-MD5 SASL method."
  (sieve-sasl-auth buffer "CRAM-MD5"))

(defun sieve-manage-digest-md5-p (buffer)
  (sieve-manage-capability "SASL" "DIGEST-MD5" buffer))

(defun sieve-manage-digest-md5-auth (buffer)
  "Login to managesieve server using the DIGEST-MD5 SASL method."
  (sieve-sasl-auth buffer "DIGEST-MD5"))

(defun sieve-manage-scram-md5-p (buffer)
  (sieve-manage-capability "SASL" "SCRAM-MD5" buffer))

(defun sieve-manage-scram-md5-auth (buffer)
  "Login to managesieve server using the SCRAM-MD5 SASL method."
  (sieve-sasl-auth buffer "SCRAM-MD5"))

(defun sieve-manage-ntlm-p (buffer)
  (sieve-manage-capability "SASL" "NTLM" buffer))

(defun sieve-manage-ntlm-auth (buffer)
  "Login to managesieve server using the NTLM SASL method."
  (sieve-sasl-auth buffer "NTLM"))

(defun sieve-manage-plain-p (buffer)
  (sieve-manage-capability "SASL" "PLAIN" buffer))

(defun sieve-manage-plain-auth (buffer)
  "Login to managesieve server using the PLAIN SASL method."
  (sieve-sasl-auth buffer "PLAIN"))

(defun sieve-manage-login-p (buffer)
  (sieve-manage-capability "SASL" "LOGIN" buffer))

(defun sieve-manage-login-auth (buffer)
  "Login to managesieve server using the LOGIN SASL method."
  (sieve-sasl-auth buffer "LOGIN"))

;; Managesieve API

(defun sieve-manage-open (server &optional port stream auth buffer)
  "Open a network connection to a managesieve SERVER (string).
Optional argument PORT is port number (integer) on remote server.
Optional argument STREAM is any of `sieve-manage-stream' (a symbol).
Optional argument AUTH indicates authenticator to use, see
`sieve-manage-authenticators' for available authenticators.
If nil, chooses the best stream the server is capable of.
Optional argument BUFFER is buffer (buffer, or string naming buffer)
to work in."
  (setq sieve-manage-port (or port sieve-manage-default-port))
  (with-current-buffer (or buffer (sieve-manage-make-process-buffer))
    (setq sieve-manage-server (or server
                                  sieve-manage-server)
          sieve-manage-stream (or stream
                                  sieve-manage-stream
                                  sieve-manage-default-stream)
          sieve-manage-auth   (or auth
                                  sieve-manage-auth))
    (sieve-manage--message "Connecting to %s..." sieve-manage-server)
    (sieve-manage-open-server sieve-manage-server
                              sieve-manage-port
                              sieve-manage-stream
                              (current-buffer))
    (when (sieve-manage-opened (current-buffer))
      ;; Choose authenticator
      (when (and (null sieve-manage-auth)
                 (not (eq sieve-manage-state 'auth)))
        (cl-dolist (auth sieve-manage-authenticators)
          (when (funcall (nth 1 (assq auth sieve-manage-authenticator-alist))
                       buffer)
            (setq sieve-manage-auth auth)
            (cl-return)))
        (unless sieve-manage-auth
          (sieve-manage--error 'sieve-manage-client-error
           "Couldn't figure out authenticator for server")))
      (sieve-manage-erase)
      (current-buffer))))

(defun sieve-manage-authenticate (&optional buffer)
  "Authenticate on server in BUFFER.
Return `sieve-manage-state' value."
  (with-current-buffer (or buffer (current-buffer))
    (if (eq sieve-manage-state 'nonauth)
        (when (funcall (nth 2 (assq sieve-manage-auth
                                    sieve-manage-authenticator-alist))
                       (current-buffer))
          (setq sieve-manage-state 'auth))
      sieve-manage-state)))

(defun sieve-manage-opened (&optional buffer)
  "Return non-nil if connection to managesieve server in BUFFER is open.
If BUFFER is nil then the current buffer is used."
  (and (setq buffer (get-buffer (or buffer (current-buffer))))
       (buffer-live-p buffer)
       (with-current-buffer buffer
	 (and sieve-manage-process
	      (memq (process-status sieve-manage-process) '(open run))))))

(defun sieve-manage--check-script-name (cmd name)
  "Check for script NAME for CMD.
Signals an error for unsupported names."
  (when (and (not (eq 'SETACTIVE cmd))
             (string-empty-p name))
    (sieve-manage--error 'sieve-manage-client-error
                         "%s script name cannot be empty" cmd))
  t)

(defun sieve-manage-close (&optional buffer)
  "Close connection to managesieve server in BUFFER.
If BUFFER is nil, the current buffer is used."
  (with-current-buffer (or buffer (current-buffer))
    (when (sieve-manage-opened)
      (sieve-manage-send-command 'LOGOUT)
      (sit-for 1))
    (when (and sieve-manage-process
	       (memq (process-status sieve-manage-process) '(open run)))
      (delete-process sieve-manage-process))
    (setq sieve-manage-process nil)
    (sieve-manage-erase)
    t))

(defun sieve-manage-capability (&optional name value buffer)
  "Check if capability NAME of server BUFFER match VALUE.
If it does, return the server value of NAME.  If not return nil.
If VALUE is nil, do not check VALUE and return server value.
If NAME is nil, return the full server list of capabilities."
  (with-current-buffer (or buffer (current-buffer))
    (if (null name)
	sieve-manage-capability
      (let ((server-value (cadr (assoc name sieve-manage-capability))))
        (when (or (null value)
                  (and server-value
                       (string-match value server-value)))
          server-value)))))

(defun sieve-manage-listscripts (&optional buffer)
  "Send LISTSCRIPTS command to download list of available scripts.
BUFFER is the \\='sieve-manage\\=' process buffer (default: \\='(current-buffer)\\=')."
  (with-current-buffer (or buffer (current-buffer))
    (sieve-manage-send-command 'LISTSCRIPTS)
    (sieve-manage-parse-listscripts)))

(defun sieve-manage-havespace (name size &optional buffer)
  "Send HAVESPACE command for script NAME and SIZE.
BUFFER is the \\='sieve-manage\\=' process buffer (default: \\='(current-buffer)\\=')."
  (let ((cmd 'HAVESPACE))
    (sieve-manage--check-script-name cmd name)
    (with-current-buffer (or buffer (current-buffer))
      (sieve-manage-send-command cmd name size)
      (sieve-manage-parse-oknobye))))

(defun sieve-manage-putscript (name script-buffer &optional buffer)
  "Send PUTSCRIPT command to upload script named NAME.
Uses the content of SCRIPT-BUFFER as the actual script to upload.
`buffer-file-coding-system' of SCRIPT-BUFFER is used to convert
the script to unibyte before the uploaded.  It shall be set to either
\\='utf-8-unix, \\='utf-8-dos or \\='utf-8-mac.
BUFFER is the \\='sieve-manage\\=' process buffer (default: \\='(current-buffer)\\=')."
  (let ((cmd 'PUTSCRIPT))
    (sieve-manage--check-script-name cmd name)
    (with-current-buffer (or buffer (current-buffer))
      (sieve-manage-send-command cmd name script-buffer)
      (sieve-manage-parse-oknobye))))

(defun sieve-manage-deletescript (name &optional buffer)
  "Send DELETESCRIPT command to delete script named NAME.
BUFFER is the \\='sieve-manage\\=' process buffer (default: \\='(current-buffer)\\=')."
  (let ((cmd 'DELETESCRIPT))
    (sieve-manage--check-script-name cmd name)
    (with-current-buffer (or buffer (current-buffer))
      (sieve-manage-send-command cmd name)
      (sieve-manage-parse-oknobye))))

(defun sieve-manage-getscript (name script-buffer &optional buffer)
  "Send GETSCRIPT command to download script named NAME.
Inserts the downloaded script into SCRIPT-BUFFER.  The \\='eol-type\\=' of
the downloaded script will be detected automatically and gets
used to decode the script data before inserting it into
SCRIPT-BUFFER.  Also sets `buffer-file-coding-system' of
SCRIPT-BUFFER to the \\='utf-8\\=' variant with the detected \\='eol-type\\='.
BUFFER is the \\='sieve-manage\\=' process buffer (default: \\='(current-buffer)\\=')."
  (let ((cmd 'GETSCRIPT))
    (sieve-manage--check-script-name cmd name)
    (with-current-buffer (or buffer (current-buffer))
      (sieve-manage-send-command cmd name)
      (sieve-manage-decode (sieve-manage-parse-string)
                           script-buffer)
      (sieve-manage-parse-crlf)
      (sieve-manage-parse-oknobye))))

(defun sieve-manage-setactive (name &optional buffer)
  "Send SETACTIVE command to activate script named NAME.
Use an empty NAME to deactivate/disable any active script.
BUFFER is the \\='sieve-manage\\=' process buffer (default: \\='(current-buffer)\\=')."
  (let ((cmd 'SETACTIVE))
    (sieve-manage--check-script-name cmd name)
    (with-current-buffer (or buffer (current-buffer))
      (sieve-manage-send-command cmd name)
      (sieve-manage-parse-oknobye))))

;; Protocol parsing routines
(defun sieve-manage-regexp-oknobye ()
  "Return regexp for managesieve \\='response-oknobye\\'."
  (concat
   "^\\(OK\\|NO\\|BYE\\)\\( (\\([^)]+\\))\\)?\\( \\(.*\\)\\)?"
   sieve-manage-server-eol))

(defun sieve-manage-wait-for-answer ()
  (let ((pattern (sieve-manage-regexp-oknobye))
        pos)
    (while (not pos)
      (setq pos (search-forward-regexp pattern nil t))
      (goto-char (point-min))
      (sleep-for 0 50))
    pos))

(defun sieve-manage-drop-next-answer ()
  (sieve-manage-wait-for-answer)
  (sieve-manage-erase))

(defun sieve-manage-ok-p (rsp)
  (string= (downcase (or (car-safe rsp) "")) "ok"))

(defun sieve-manage-no-p (rsp)
  (string= (downcase (or (car-safe rsp) "")) "no"))

(defun sieve-manage-is-oknobye ()
  (when (looking-at (sieve-manage-regexp-oknobye))
    (let ((status (match-string 1))
	  (resp-code (match-string 3))
	  (response (match-string 5)))
      (when response
	(goto-char (match-beginning 5))
	(setq response (sieve-manage-is-string)))
      (list status resp-code response))))

(defun sieve-manage-parse-oknobye ()
  (let (rsp)
    (while (null rsp)
      (accept-process-output (get-buffer-process (current-buffer)) 1)
      (goto-char (point-min))
      (setq rsp (sieve-manage-is-oknobye)))
    (sieve-manage-erase)
    rsp))

(defun sieve-manage-parse-capability (str)
  "Parse managesieve capability string `STR'.
Return alist of capabilities, suitable for assignment
to local variable `sieve-manage-capability'."
  (let ((capas (delq nil
                     (mapcar #'split-string-and-unquote
                             (split-string str "\n")))))
    (when (string= "OK" (caar (last capas)))
      (setq sieve-manage-state 'nonauth))
    capas))

(defun sieve-manage-is-string ()
  (cond ((looking-at "\"\\([^\"]+\\)\"")
	 (prog1
	     (match-string 1)
	   (goto-char (match-end 0))))
	((looking-at (concat "{\\([0-9]+\\+?\\)}" sieve-manage-server-eol))
	 (let ((pos (match-end 0))
	       (len (string-to-number (match-string 1))))
	   (if (< (point-max) (+ pos len))
	       nil
	     (goto-char (+ pos len))
	     (buffer-substring pos (+ pos len)))))))

(defun sieve-manage-parse-string ()
  (let (rsp)
    (while (null rsp)
      (accept-process-output (get-buffer-process (current-buffer)) 1)
      (goto-char (point-min))
      (unless (setq rsp (sieve-manage-is-string))
        (when (sieve-manage-no-p (sieve-manage-is-oknobye))
          ;; no further details required since `sieve-manage-erase'
          ;; already adds the server response to the log
          (sieve-manage--error 'sieve-manage-server-error
                               "%s" (sieve-manage-erase)))))
    (sieve-manage-erase (point))
    rsp))

(defun sieve-manage-parse-crlf ()
  (when (looking-at sieve-manage-server-eol)
    (sieve-manage-erase (match-end 0))))

(defun sieve-manage-parse-listscripts ()
  (let (tmp rsp data)
    (while (null rsp)
      (while (null (or (setq rsp (sieve-manage-is-oknobye))
                       (setq tmp (sieve-manage-decode
                                  (sieve-manage-is-string)))))
	(accept-process-output (get-buffer-process (current-buffer)) 1)
	(goto-char (point-min)))
      (when tmp
	(while (not (looking-at (concat "\\( ACTIVE\\)?"
					sieve-manage-server-eol)))
	  (accept-process-output (get-buffer-process (current-buffer)) 1)
	  (goto-char (point-min)))
	(if (match-string 1)
	    (push (cons 'active tmp) data)
	  (push tmp data))
	(goto-char (match-end 0))
	(setq tmp nil)))
    (sieve-manage-erase)
    (if (sieve-manage-ok-p rsp)
	data
      rsp)))

(defun sieve-manage-send-command (cmd-name &rest items)
  "Assemble rfc5804 command from CMD-NAME and ITEMS and send it.
See `sieve-manage-send' for further details."
  (when (string-empty-p cmd-name)
    (sieve-manage--error 'sieve-manage-encode-error
     "Command name cannot be empty"))
  (when (multibyte-string-p cmd-name)
    (sieve-manage--error 'sieve-manage-encode-error
     "Command name '%s' cannot must be a unibyte string" cmd-name))
  (apply #'sieve-manage-send (cons 'cmd-name cmd-name) items))

(defun sieve-manage-send (&rest items)
  "Encode and concatenate ITEMS, send the result to the sieve server.
ITEMs will be:

1. skipped/ignored if nil
2. converted to unibyte (optional, depends on item type)
3. encoded according to rfc5804
4. concatenated (using SPaces as separators)

The result will then be sent to the managesieve server.

See `sieve-manage-encode' for details regarding supported ITEMS and their
handling."
  (let ((cmdstr (concat
                 (string-join
                  (remove nil (mapcar #'sieve-manage-encode
                                      items))
                  " ")
                 sieve-manage-client-eol)))
    (sieve-manage--append-to-log cmdstr)
    (process-send-string sieve-manage-process cmdstr)))

(provide 'sieve-manage)

;;; sieve-manage.el ends here