/*
 *  Copyright 2017 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.core.authentication.token;

import java.io.ByteArrayInputStream;
import java.io.UnsupportedEncodingException;
import java.sql.Blob;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Timestamp;
import java.sql.Types;
import java.util.ArrayList;
import java.util.Base64;
import java.util.Date;
import java.util.List;
import java.util.Map;

import org.ametys.core.datasource.ConnectionHelper;
import org.ametys.core.ui.Callable;
import org.ametys.core.user.CurrentUserProvider;
import org.ametys.core.user.UserIdentity;
import org.ametys.runtime.config.Config;
import org.ametys.runtime.plugin.component.AbstractLogEnabled;
import org.apache.avalon.framework.activity.Initializable;
import org.apache.avalon.framework.component.Component;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.avalon.framework.service.Serviceable;
import org.apache.commons.codec.digest.DigestUtils;
import org.apache.commons.lang.RandomStringUtils;
import org.apache.commons.lang3.StringUtils;

/**
 * The component to handle temporary authentication token.<br>
 * Token can only be used once and are available for a short time only.
 */
public class AuthenticationTokenManager extends AbstractLogEnabled implements Component, Serviceable, Initializable
{
    /** The avalon role */
    public static final String ROLE = AuthenticationTokenManager.class.getName();

    /** The separator in token */
    public static final String TOKEN_SEPARATOR = "#";

    /** The user token type */
    public static final String USER_TOKEN_TYPE = "User";

    private ServiceManager _manager;

    private CurrentUserProvider _currentUserProvider;

    private String _datasourceId;

    public void service(ServiceManager manager) throws ServiceException
    {
        _manager = manager;
    }

    public void initialize() throws Exception
    {
        _datasourceId = Config.getInstance() != null ? Config.getInstance().getValueAsString("runtime.assignments.authenticationtokens") : "";
    }

    private CurrentUserProvider _getCurrentUserProvider() throws RuntimeException
    {
        if (_currentUserProvider == null)
        {
            try
            {
                _currentUserProvider = (CurrentUserProvider) _manager.lookup(CurrentUserProvider.ROLE);
            }
            catch (ServiceException e)
            {
                throw new RuntimeException(e);
            }
        }
        return _currentUserProvider;
    }

    /**
     * Get the existing tokens for the connected user
     * 
     * @param type The type of tokens to return. null to return all.
     * @return The tokens
     * @throws RuntimeException If there is no user connected or if there is a
     *             database error
     */
    public List<Token> getTokens(String type) throws RuntimeException
    {
        return getTokens(_getCurrentUserProvider().getUser(), type);
    }

    /**
     * Get the existing tokens for this user
     * 
     * @param type The type of tokens to return. null to return all.
     * @param user The user. Cannot be null
     * @return The tokens identifier and associated comment
     * @throws RuntimeException If the user is null or if there is a database
     *             error
     */
    public List<Token> getTokens(UserIdentity user, String type) throws RuntimeException
    {
        if (user == null)
        {
            throw new RuntimeException("Cannot generate a temporary authentication token for a null user");
        }

        List<Token> tokens = new ArrayList<>();

        Connection connection = null;
        try
        {
            connection = ConnectionHelper.getConnection(_datasourceId);

            // Delete old entries
            _deleteOldTokens(connection);

            try (PreparedStatement selectStatement = _getSelectUserTokenStatement(connection, user.getLogin(), user.getPopulationId(), type);
                    ResultSet resultSet = selectStatement.executeQuery())
            {
                // Find the database entry using this token
                while (resultSet.next())
                {
                    Blob commentBlob = resultSet.getBlob("comment");
                    String comment = new String(commentBlob.getBytes(1, (int) commentBlob.length()));
                    Token token = new Token(resultSet.getString("id"), resultSet.getString("type"), comment, resultSet.getTimestamp("creation_date"),
                            resultSet.getTimestamp("end_date"), resultSet.getTimestamp("last_update_date"));
                    tokens.add(token);
                }
            }
        }
        catch (Exception e)
        {
            getLogger().error("Communication error with the database", e);
        }
        finally
        {
            ConnectionHelper.cleanup(connection);
        }

        return tokens;
    }

    /**
     * Generates a new token for the current user
     * 
     * @param duration The time the token is valid in seconds. 0 means for ever
     *            and moreover the ticket will be reusable.
     * @param type The type of token. Mandatory but can be anything you want
     *            between 1 to 32 characters. Such as "Cookie".
     * @param comment An optional token comment to remember the reason of its
     *            creation
     * @return The token
     * @throws RuntimeException If the user is not authenticated, or if there is
     *             a database error
     */
    public String generateToken(long duration, String type, String comment) throws RuntimeException
    {
        return generateToken(_getCurrentUserProvider().getUser(), duration, type, comment);
    }

    /**
     * Generates a new token
     * 
     * @param user The user that will be authenticated with the token
     * @param duration The time the token is valid in seconds. 0 means for ever
     *            and moreover the ticket will be reusable
     * @param type The type of token. Mandatory but can be anything you want
     *            between 1 to 32 characters. Such as "Cookie".
     * @param comment An optional token comment to remember the reason of its
     *            creation
     * @return The token
     * @throws RuntimeException If the user is null or if there is a database
     *             error or if duration is negative
     */
    @SuppressWarnings("resource")
    public String generateToken(UserIdentity user, long duration, String type, String comment) throws RuntimeException
    {
        if (user == null)
        {
            throw new RuntimeException("Cannot generate a temporary authentication token for a null user");
        }
        else if (duration < 0)
        {
            throw new RuntimeException("Cannot generate a token for a negative duration [" + duration + "]");
        }

        String token = RandomStringUtils.randomAlphanumeric(duration == 0 ? 64 : 16);
        String salt = RandomStringUtils.randomAlphanumeric(48);
        Timestamp creationDateTime = new Timestamp(new Date().getTime());
        Timestamp endTime = duration > 0 ? new Timestamp(System.currentTimeMillis() + duration * 1000) : null;
        String hashedTokenAndSalt = DigestUtils.sha512Hex(token + salt);

        Connection connection = null;
        PreparedStatement statement = null;
        ResultSet rs = null;
        try
        {
            connection = ConnectionHelper.getConnection(_datasourceId);
            String dbType = ConnectionHelper.getDatabaseType(connection);

            if (ConnectionHelper.DATABASE_ORACLE.equals(dbType))
            {
                statement = connection.prepareStatement("SELECT seq_authenticationtoken.nextval FROM dual");
                rs = statement.executeQuery();

                String id = null;
                if (rs.next())
                {
                    id = rs.getString(1);
                }
                ConnectionHelper.cleanup(rs);
                ConnectionHelper.cleanup(statement);

                statement = connection.prepareStatement(
                        "INSERT INTO Authentication_Token (id, login, population_id, token, salt, creation_date, end_date, type, comment) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)");
                statement.setString(1, id);
                statement.setString(2, user.getLogin());
                statement.setString(3, user.getPopulationId());
                statement.setString(4, hashedTokenAndSalt);
                statement.setString(5, salt);
                statement.setTimestamp(6, creationDateTime);
                statement.setTimestamp(7, endTime);
                statement.setString(8, type);
                statement.setBlob(9, comment == null ? null : new ByteArrayInputStream(comment.getBytes("UTF-8")));
            }
            else
            {
                statement = connection.prepareStatement(
                        "INSERT INTO Authentication_Token (login, population_id, token, salt, creation_date, end_date, type, comment) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");

                statement.setString(1, user.getLogin());
                statement.setString(2, user.getPopulationId());
                statement.setString(3, hashedTokenAndSalt);
                statement.setString(4, salt);
                statement.setTimestamp(5, creationDateTime);
                statement.setTimestamp(6, endTime);
                statement.setString(7, type);
                if (comment == null)
                {
                    statement.setNull(8, Types.BLOB);
                }
                else
                {
                    statement.setBlob(8, new ByteArrayInputStream(comment.getBytes("UTF-8")));
                }
            }

            statement.executeUpdate();
        }
        catch (SQLException | UnsupportedEncodingException e)
        {
            throw new RuntimeException(e);
        }
        finally
        {
            ConnectionHelper.cleanup(rs);
            ConnectionHelper.cleanup(connection);
        }

        String fullToken = user.getPopulationId() + TOKEN_SEPARATOR + user.getLogin() + TOKEN_SEPARATOR + token;
        
        try
        {
            return Base64.getEncoder().withoutPadding().encodeToString(fullToken.getBytes("UTF-8"));
        }
        catch (UnsupportedEncodingException e)
        {
            // can't occur ...
            throw new RuntimeException(e);
        }
    }

    private UserIdentity _validateToken(String encodedToken, boolean forceRemove)
    {
        String token;
        try
        {
            token = new String(Base64.getDecoder().decode(encodedToken), "UTF-8");
        }
        catch (UnsupportedEncodingException e)
        {
            // can't occur ...
            throw new RuntimeException(e);
        }
        catch (Exception e)
        {
            // Exception occured during token decoding
            return null;
        }
        
        String[] split = StringUtils.split(token, TOKEN_SEPARATOR);
        if (split == null || split.length != 3)
        {
            return null;
        }

        String populationId = split[0];
        String login = split[1];
        String tokenPart = split[2];

        Connection connection = null;
        try
        {
            connection = ConnectionHelper.getConnection(_datasourceId);

            // Delete old entries
            _deleteOldTokens(connection);

            try (PreparedStatement selectStatement = _getSelectUserTokenStatement(connection, login, populationId, null); ResultSet resultSet = selectStatement.executeQuery())
            {
                // Find the database entry using this token
                while (resultSet.next())
                {
                    if (resultSet.getString("token").equals(DigestUtils.sha512Hex(tokenPart + resultSet.getString("salt"))))
                    {
                        // Delete it
                        if (forceRemove || resultSet.getDate("end_date") != null)
                        {
                            _deleteUserToken(connection, resultSet.getString("id"));
                        }
                        else
                        {
                            _updateUserToken(connection, resultSet.getString("id"));
                        }
                        return new UserIdentity(login, populationId);
                    }
                }
            }
        }
        catch (Exception e)
        {
            getLogger().error("Communication error with the database", e);
        }
        finally
        {
            ConnectionHelper.cleanup(connection);
        }

        return null;
    }

    /**
     * Check if a token is valid and return the s
     * 
     * @param token The token to validate
     * @return The user associated to the valid token, null otherwise
     */
    public UserIdentity validateToken(String token)
    {
        return _validateToken(token, false);
    }

    /**
     * Destroy the given token
     * 
     * @param token The token to remove
     */
    public void deleteTokenByValue(String token)
    {
        _validateToken(token, true);
    }

    /**
     * Destroy the given token
     * 
     * @param tokenId The token identifier to remove
     */
    public void deleteTokenById(String tokenId)
    {
        Connection connection = null;
        try
        {
            connection = ConnectionHelper.getConnection(_datasourceId);

            _deleteUserToken(connection, tokenId);
        }
        catch (SQLException e)
        {
            throw new RuntimeException("Could not delete the authentication token with identifier " + tokenId, e);
        }
        finally
        {
            ConnectionHelper.cleanup(connection);
        }
    }

    /**
     * Generates the sql statement that deletes the entries of the users token
     * database that are old
     * 
     * @param connection the database's session
     * @throws SQLException if a sql exception occurs
     */
    private void _deleteOldTokens(Connection connection) throws SQLException
    {
        try (PreparedStatement statement = connection.prepareStatement("DELETE FROM Authentication_Token WHERE end_date < ?"))
        {
            statement.setTimestamp(1, new Timestamp(System.currentTimeMillis()));
            statement.executeUpdate();
        }
    }

    /**
     * Generates the statement that selects the users having the specified login
     * in the Users_Token table
     * 
     * @param connection the database's session
     * @param login The login of the user
     * @param populationId The populationId of the user
     * @param type The type to filter or null to get all
     * @return the retrieve statement
     * @throws SQLException if a sql exception occurs
     */
    private PreparedStatement _getSelectUserTokenStatement(Connection connection, String login, String populationId, String type) throws SQLException
    {
        String sqlRequest = "SELECT id, token, salt, creation_date, end_date, last_update_date, type, comment FROM Authentication_Token WHERE login=? AND population_id=?"
                + (type != null ? " AND type=?" : "");

        PreparedStatement statement = connection.prepareStatement(sqlRequest);
        statement.setString(1, login);
        statement.setString(2, populationId);
        if (type != null)
        {
            statement.setString(3, type);
        }

        return statement;
    }

    /**
     * Deletes the database entry that has this token
     * 
     * @param connection the database's session
     * @param id the token id
     * @throws SQLException if an error occurred
     */
    private void _deleteUserToken(Connection connection, String id) throws SQLException
    {
        try (PreparedStatement statement = connection.prepareStatement("DELETE FROM Authentication_Token WHERE id = ?"))
        {
            statement.setString(1, id);
            statement.executeUpdate();
        }
    }

    /**
     * Update the last update date in the database
     * 
     * @param connection the database's session
     * @param id the token id
     * @throws SQLException if an error occurred
     */
    private void _updateUserToken(Connection connection, String id) throws SQLException
    {
        try (PreparedStatement statement = connection.prepareStatement("UPDATE Authentication_Token SET last_update_date = ? WHERE id = ?"))
        {
            Timestamp lastUpdateDate = new Timestamp(new Date().getTime());
            statement.setTimestamp(1, lastUpdateDate);
            statement.setString(2, id);
            statement.executeUpdate();
        }
    }

    /**
     * Generate a new authentication token
     * 
     * @param parameters a map of the following parameters for the
     *            authentication token : description
     * @return The generated token
     */
    @Callable
    public String generateAuthenticationToken(Map<String, Object> parameters)
    {
        String description = (String) parameters.get("description");
        String generateToken = generateToken(0, USER_TOKEN_TYPE, description);

        return generateToken;
    }

    /**
     * Delete one or multiples authentication token
     * 
     * @param ids a list of authentication token ids
     */
    @Callable
    public void deleteAuthenticationToken(List<String> ids)
    {
        for (String tokenId : ids)
        {
            deleteTokenById(tokenId);
        }
    }

    /**
     * An Ametys authentication token
     */
    public static class Token
    {
        /** The token identifier */
        protected String _id;

        /** The token type */
        protected String _type;

        /** The token associated comment */
        protected String _comment;

        /** The token creation date */
        protected Date _creationDate;

        /** The token end date */
        protected Date _endDate;

        /** The token last update date */
        protected Date _lastUpdateDate;

        /**
         * Creates a Token
         * 
         * @param id The identifier
         * @param type The type of token
         * @param comment The comment. Can be null.
         * @param creationDate The creation date. Can be null.
         * @param endDate The end date. Can be null.
         * @param lastUpdateDate The last update date. Can be null.
         */
        protected Token(String id, String type, String comment, Date creationDate, Date endDate, Date lastUpdateDate)
        {
            _id = id;
            _type = type;
            _comment = comment;
            _creationDate = creationDate;
            _endDate = endDate;
            _lastUpdateDate = lastUpdateDate;
        }

        /**
         * Get the token identifier
         * 
         * @return The identifier
         */
        public String getId()
        {
            return _id;
        }

        /**
         * Get the token type
         * 
         * @return The type
         */
        public String getType()
        {
            return _type;
        }

        /**
         * Get the associated creation comment
         * 
         * @return The comment or null
         */
        public String getComment()
        {
            return _comment;
        }

        /**
         * Get the creation date of the token
         * 
         * @return The creation date or null
         */
        public Date getCreationDate()
        {
            return _creationDate;
        }

        /**
         * Get the end date of the token validity
         * 
         * @return The end date or null
         */
        public Date getEndDate()
        {
            return _endDate;
        }

        /**
         * Get the last update date of the token
         * 
         * @return The last update date or null
         */
        public Date getLastUpdateDate()
        {
            return _endDate;
        }
    }
}