function handle()

in site/api/mbox.lua [87:214]
113 lines of code
10 McCabe index (conditional complexity)

function handle(r)
    cross.contentType(r, "application/mbox")
    local get = r:parseargs()
    if get.list and get.date then
        local lid = ("<%s>"):format(get.list:gsub("@", "."):gsub("[<>]", ""))
        local flid = get.list:gsub("[.@]", "_")
        local y, m = get.date:match("^(%d+)%-(%d+)$")
        if not (y and m) then
            cross.contentType(r, "text/plain")
            r:puts("Wrong date format given!\n")
            return cross.OK
        end
        m = tonumber(m)
        y = tonumber(y)
        local d = utils.lastDayOfMonth(y,m)
        if not d then
            cross.contentType(r, "text/plain")
            r:puts("Invalid date given!\n")
            return cross.OK
        end

        if r.headers_out then
            r.headers_out['Content-Disposition'] = ("attachment; filename=%s_%04d-%02d.mbox"):format(flid,y,m)
        end

        local DATERANGE = {
            range = {
                date = {
                    gte = ("%04d/%02d/%02d 00:00:00"):format(y,m,1),
                    lte = ("%04d/%02d/%02d 23:59:59"):format(y,m,d)
                }
            }
        }

        local LIST = {
            term = {
                list_raw = lid
            }
        }

        
        local squery = {
            query = {
                bool = {
                    must = {
                        DATERANGE,
                        LIST
                    }
                }
            },
            size = 0, 
            aggs = {
                privacy = {
                    terms = {
                        field = "private"
                    }
                }
            }
        }

        
        local docs = elastic.raw(squery)
        local total_docs = docs.hits.total

        local fetchPrivate = false 
        for _, privacy in pairs(docs.aggregations.privacy.buckets) do
            
            if privacy.key_as_string == "true" and privacy.doc_count > 0 then
                
                fetchPrivate = aaa.canAccessList(r, lid, user.get(r))
                break
            end
        end

        
        local MUST
        if fetchPrivate then
            MUST = {
                DATERANGE,
                LIST
            }
        else 
            MUST = {
                DATERANGE,
                LIST,
                {
                    term = {
                        private = false
                    }
                }
            }
        end

        
        local squery = {
            _source = {'mid'},
            query = {
                bool = {
                    must = MUST
                }
            },
            sort = {
                {
                    epoch = {
                        order = "asc"
                    }
                }
            },
            size = elastic.MAX_RESULT_WINDOW
        }

        if total_docs > elastic.MAX_RESULT_WINDOW then
            local docs, sid = elastic.scroll(squery)
            while docs and docs.hits and docs.hits.hits and #docs.hits.hits > 0 do 
                writeMbox(r, docs)
                docs, sid = elastic.scroll(sid)
            end
            elastic.clear_scroll(sid) 
        else
            local docs = elastic.raw(squery)
            writeMbox(r, docs)
        end
    else
        cross.contentType(r, "text/plain")
        r:puts("Both list and date are required!\n")
    end
    return cross.OK
end