/*
 *  Copyright 2011 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.site;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.URI;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Enumeration;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.Vector;
import java.util.regex.Pattern;

import javax.servlet.http.HttpServletRequest;

import org.apache.cocoon.environment.ObjectModelHelper;
import org.apache.cocoon.environment.Request;
import org.apache.cocoon.environment.Session;
import org.apache.cocoon.environment.http.HttpEnvironment;
import org.apache.cocoon.servlet.multipart.Part;
import org.apache.commons.io.IOUtils;
import org.apache.commons.lang.StringUtils;
import org.apache.http.Consts;
import org.apache.http.HttpEntity;
import org.apache.http.NameValuePair;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.HttpEntityEnclosingRequestBase;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpHead;
import org.apache.http.client.methods.HttpOptions;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.client.methods.HttpPut;
import org.apache.http.client.methods.HttpRequestBase;
import org.apache.http.client.methods.HttpUriRequest;
import org.apache.http.entity.ContentType;
import org.apache.http.entity.InputStreamEntity;
import org.apache.http.entity.mime.HttpMultipartMode;
import org.apache.http.entity.mime.MultipartEntityBuilder;
import org.apache.http.entity.mime.content.InputStreamBody;
import org.apache.http.entity.mime.content.StringBody;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.message.BasicNameValuePair;

import org.ametys.core.authentication.CredentialProvider;
import org.ametys.core.user.UserIdentity;
import org.ametys.core.util.URLEncoder;
import org.ametys.plugins.site.Site;
import org.ametys.plugins.site.SiteUrl;
import org.ametys.plugins.site.proxy.BackOfficeRequestProxy;
import org.ametys.plugins.site.proxy.BackOfficeRequestProxyExtensionPoint;
import org.ametys.runtime.config.Config;

/**
 * Helper class that builds the request the front-office makes to the back-office to query a page or a resource.
 */
public final class BackOfficeRequestHelper
{
    private static final Pattern __AUTHORIZED_HEADERS = Pattern.compile("^(?:Accept|Accept-Language|Accept-Charset|Referer|Origin|User-Agent|If-None-Match)$", Pattern.CASE_INSENSITIVE);
    
    private static final Set<String> __FILTERED_REQUEST_PARAMETERS = new HashSet<>(Arrays.asList("cocoon-view"));
    
    private BackOfficeRequestHelper()
    {
        // Helper class.
    }
    
    /**
     * Build a HttpClient object parametrized
     * @return The httpclient object
     */
    public static CloseableHttpClient getHttpClient()
    {
        CloseableHttpClient httpClient = HttpClientBuilder.create()
            .disableRedirectHandling()
            .useSystemProperties()
            .build();
        
        return httpClient;
    }
    
    
    /**
     * Build a HttpClient request object that will be sent to the back-office to query the page.
     * @param objectModel the current object model.
     * @param page the wanted page path.
     * @param requestProxyExtensionPoint The extension point for adding request headers in BO request
     * @return the HttpClient request, to be sent to the back-office.
     * @throws IOException if an error occurs building the request.
     */
    public static HttpUriRequest getRequest(Map objectModel, String page, BackOfficeRequestProxyExtensionPoint requestProxyExtensionPoint) throws IOException
    {
        Request request = ObjectModelHelper.getRequest(objectModel);
        
        String cmsURL = Config.getInstance().getValueAsString("org.ametys.site.bo");
        
        String method = request.getMethod();
        SiteUrl url = (SiteUrl)  request.getAttribute("url");
        
        String baseServerPath = url.getBaseServerPath(request);
        
        HttpUriRequest boRequest = null;
        String baseUrl = cmsURL + "/generate/" + page;
        
        switch (method)
        {
            case "GET":
            case "HEAD":
            case "OPTIONS":
            case "UNLOCK":
                String boUrl = baseUrl + "?" + _getContextQueryPart(url, baseServerPath) 
                                       + "&_initialRequest=" + URLEncoder.encodeParameter("/" + request.getAttribute("path") + (StringUtils.isEmpty(request.getQueryString()) ? "" : "?" + request.getQueryString())) + _getParameters(request) 
                                       + "&" + _getEditionQueryPart(request);
                
                if ("GET".equals(method))
                {
                    boRequest = new HttpGet(boUrl);
                }
                else if ("HEAD".equals(method))
                {
                    boRequest = new HttpHead(boUrl);
                }
                else if ("OPTIONS".equals(method))
                {
                    boRequest = new HttpOptions(boUrl);
                }
                else if ("UNLOCK".equals(method))
                {
                    boRequest = new HttpUnLock(boUrl);
                }
                
                break;
            case "PUT":
            case "LOCK":
            case "PROPFIND":
            case "MKCOL":
                String uri = baseUrl + "?" + _getContextQueryPart(url, baseServerPath) + "&" + _getEditionQueryPart(request);
                
                HttpEntityEnclosingRequestBase newRequest = null;
                
                if ("PUT".equals(method))
                {
                    newRequest = new HttpPut(uri);
                }
                else if ("LOCK".equals(method))
                {
                    newRequest = new HttpLock(uri);
                }
                else if ("PROPFIND".equals(method))
                {
                    newRequest = new HttpPropfind(uri);
                }
                else if ("MKCOL".equals(method))
                {
                    newRequest = new HttpMkcol(uri);
                }

                assert newRequest != null;
                
                String contentType = request.getContentType();
                if (contentType != null)
                {
                    newRequest.setHeader("Content-Type", contentType);
                }
                
                HttpServletRequest req = (HttpServletRequest) objectModel.get(HttpEnvironment.HTTP_REQUEST_OBJECT);
                InputStream body = req.getInputStream();
                byte[] bytes = IOUtils.toByteArray(body);
                
                HttpEntity entity = new InputStreamEntity(new ByteArrayInputStream(bytes), bytes.length);
                newRequest.setEntity(entity);
                
                boRequest = newRequest;
                break;
            case "POST":
                HttpServletRequest postReq = (HttpServletRequest) objectModel.get(HttpEnvironment.HTTP_REQUEST_OBJECT);
                InputStream postBody = postReq.getInputStream();
                byte[] postBytes = IOUtils.toByteArray(postBody);
                
                boolean hasBody = postBytes.length > 0;
                
                String postUri = baseUrl;
                
                if (hasBody)
                {
                    // in case of a body in the original request, we have to copy this body, and put the two parameters _contextPath and _baseServerPath as query string
                    postUri += "?" + _getContextQueryPart(url, baseServerPath) + "&" + _getEditionQueryPart(request);
                }
                else
                {
                    postUri += "?" + _getEditionQueryPart(request);
                }
                
                HttpPost postRequest = new HttpPost(postUri);
                
                HttpEntity postEntity = null;
                
                String postContentType = request.getContentType();
                if ((postContentType != null) && (postContentType.toLowerCase().indexOf("multipart/form-data") > -1))
                {
                    // multipart request
                    MultipartEntityBuilder multipartBuilder = _getMultipartEntityBuilder(request);
                    
                    multipartBuilder.addPart("_contextPath", new StringBody(url.getServerPath(), ContentType.create("text/plain", Consts.UTF_8)));
                    multipartBuilder.addPart("_baseServerPath", new StringBody(baseServerPath, ContentType.create("text/plain", Consts.UTF_8)));
                    
                    postEntity = multipartBuilder.build();
                }
                else if (hasBody)
                {
                    postRequest.setHeader("Content-Type", postContentType);
                    postEntity = new InputStreamEntity(new ByteArrayInputStream(postBytes), postBytes.length);
                }
                else
                {
                    // url encoded body
                    List<NameValuePair> params = new ArrayList<>();
                    
                    params.add(new BasicNameValuePair("_contextPath", url.getServerPath()));
                    params.add(new BasicNameValuePair("_baseServerPath", baseServerPath));
                    
                    Enumeration<String> names = request.getParameterNames();
                    while (names.hasMoreElements())
                    {
                        String paramName = names.nextElement();
                        if (!__FILTERED_REQUEST_PARAMETERS.contains(paramName))
                        {
                            for (String value : request.getParameterValues(paramName))
                            {
                                params.add(new BasicNameValuePair(paramName, value));
                            }
                        }
                    }
                    
                    postEntity = new UrlEncodedFormEntity(params, "UTF-8");
                }
                
                postRequest.setEntity(postEntity);
                
                boRequest = postRequest;
                
                break;
            default:
                throw new IllegalArgumentException("Unrecognized method " + method);
        }
        
        _addRequestHeaders(request, boRequest, requestProxyExtensionPoint);
        _copyCookieHeaders(request, boRequest);
        
        return boRequest;
    }
    
    private static String _getEditionQueryPart(Request request)
    {
        String editionMode = (String) request.getAttribute(GetSiteAction.EDITION_URI);
        return "true".equals(editionMode) ? "_" + GetSiteAction.EDITION_URI + "=true" : "";
    }
    
    private static String _getContextQueryPart(SiteUrl url, String baseServerPath)
    {
        return "_contextPath=" + url.getServerPath() + "&_baseServerPath=" + baseServerPath;
    }
    
    /**
     * Get the front-office request's parameters as an HttpClient MultipartEntity,
     * to be added to a POST back-office request.
     * @param request the front-office request.
     * @return the parameters encoded in a multipart entity.
     * @throws IOException if an error occurs extracting the parameters or building the entity.
     */
    private static MultipartEntityBuilder _getMultipartEntityBuilder(Request request) throws IOException
    {
        MultipartEntityBuilder builder = MultipartEntityBuilder.create();
        builder.setMode(HttpMultipartMode.RFC6532);
        
        Enumeration<String> names = request.getParameterNames();
        
        while (names.hasMoreElements())
        {
            String paramName = names.nextElement();
            
            if (!__FILTERED_REQUEST_PARAMETERS.contains(paramName))
            {
                Object value = request.get(paramName);
                _addMultipartEntityToBuilder(builder, paramName, value);
            }
        }
        
        return builder;
    }

    private static void _addMultipartEntityToBuilder(MultipartEntityBuilder builder, String paramName, Object value) throws IOException
    {
        if (value instanceof Part)
        {
            Part part = (Part) value;
            builder.addPart(paramName, new InputStreamBody(part.getInputStream(), ContentType.create(part.getMimeType()), part.getFileName()));
        }
        else if (value instanceof Vector)
        {
            for (Object v : (Vector) value)
            {
                _addMultipartEntityToBuilder(builder, paramName, v);
            }
        }
        else
        {
            builder.addPart(paramName, new StringBody(value.toString(), ContentType.create("text/plain", Consts.UTF_8)));
        }
    }
    
    /**
     * Get the front-office request's parameters as a String, to be added to
     * a GET back-office request.
     * @param request the front-office request.
     * @return the parameters as a String.
     */
    private static String _getParameters(Request request)
    {
        StringBuilder params = new StringBuilder();
        
        Enumeration<String> names = request.getParameterNames();
        while (names.hasMoreElements())
        {
            String paramName = names.nextElement();
            if (!__FILTERED_REQUEST_PARAMETERS.contains(paramName))
            {
                for (String value : request.getParameterValues(paramName))
                {
                    params.append("&");
                    params.append(paramName);
                    params.append("=");
                    params.append(URLEncoder.encodeParameter(value));
                }
            }
        }
        
        return params.toString();
    }
    
    /**
     * Add headers indicating this is a request from the front-office to the back-office,
     * specifying the user if applicable.
     * @param request the front-office request.
     * @param boRequest the request object to be sent to the back-office.
     * @param requestProxyExtensionPoint The extension point for adding request headers in BO request
     */
    private static void _addRequestHeaders(Request request, HttpUriRequest boRequest, BackOfficeRequestProxyExtensionPoint requestProxyExtensionPoint)
    {
        // Get the user, if in session.
        UserIdentity user = FrontAuthenticateAction.getUserIdentityFromSession(request);
        
        // Add Ametys headers.
        boRequest.addHeader("X-Ametys-FO", "true");
        if (user != null)
        {
            boRequest.addHeader("X-Ametys-FO-Login", user.getLogin());
            boRequest.addHeader("X-Ametys-FO-Population", user.getPopulationId());
            
            Site site = (Site) request.getAttribute("site");
            Session session = request.getSession(false);
            if (site != null && session != null)
            {
                CredentialProvider credentialProvider = (CredentialProvider) session.getAttribute("Runtime:CredentialProvider-" + site.getName());
                boRequest.addHeader("X-Ametys-FO-Credential-Provider", credentialProvider.getId());
            }
            
        }
        
        for (String requestId : requestProxyExtensionPoint.getExtensionsIds())
        {
            BackOfficeRequestProxy boRequestComponent = requestProxyExtensionPoint.getExtension(requestId);
            boRequestComponent.prepareBackOfficeRequest(request, boRequest);
        }
        
        // Add apache unique-id
        String uuid = (String) request.getAttribute("Monitoring-UUID");
        if (uuid != null)
        {
            boRequest.addHeader("X-Ametys-FO-UUID", uuid);
        }
        
        // Forwarding headers
        Enumeration<String> headers = request.getHeaderNames();
        while (headers.hasMoreElements())
        {
            String headerName = headers.nextElement();
            if (__AUTHORIZED_HEADERS.matcher(headerName).matches())
            {
                // forward
                Enumeration<String> headerValues = request.getHeaders(headerName);
                while (headerValues.hasMoreElements())
                {
                    String headerValue = headerValues.nextElement();
                    boRequest.addHeader(headerName, headerValue);
                }
            }
        }
        
        // Add X-Forwarded-For
        String xff = request.getHeader("X-Forwarded-For");
        String remoteIP = request.getRemoteAddr();
        
        String newXFF = (xff == null ? "" : xff + ", ") + remoteIP;
        boRequest.setHeader("X-Forwarded-For", newXFF);
    }
    
    /**
     * Copy cookie headers that were sent by the client into the request
     * that will be sent to the back-office.
     * @param request the front-office request.
     * @param boRequest the request object to be sent to the back-office.
     */
    private static void _copyCookieHeaders(Request request, HttpUriRequest boRequest)
    {
        Enumeration<String> cookieHeaders = request.getHeaders("Cookie");
        while (cookieHeaders.hasMoreElements())
        {
            String cookieHeader = cookieHeaders.nextElement();
            
            String[] cookiesValue = cookieHeader.split("; ");
            for (String cookieValue : cookiesValue)
            {
                if (cookieValue.startsWith("JSESSIONID="))
                {
                    // discard (the BO should not try to attach a session with this id)
                }
                else if (cookieValue.startsWith(GeneratePageAction.__BACKOFFICE_JSESSION_ID + "="))
                {
                    String modifiedCookieValue = cookieValue.replace(GeneratePageAction.__BACKOFFICE_JSESSION_ID + "=", "JSESSIONID=");
                    boRequest.addHeader("Cookie", modifiedCookieValue);
                }
                else
                {
                    boRequest.addHeader("Cookie", cookieValue);
                }
            }
        }
    }
    
    static class HttpLock extends HttpEntityEnclosingRequestBase 
    {
        HttpLock(final String uri) 
        {
            super();
            setURI(URI.create(uri));
        }

        @Override
        public String getMethod() 
        {
            return "LOCK";
        }
    }
    
    static class HttpUnLock extends HttpRequestBase 
    {
        HttpUnLock(final String uri) 
        {
            super();
            setURI(URI.create(uri));
        }

        @Override
        public String getMethod() 
        {
            return "UNLOCK";
        }
    }
    
    static class HttpPropfind extends HttpEntityEnclosingRequestBase 
    {
        HttpPropfind(final String uri) 
        {
            super();
            setURI(URI.create(uri));
        }

        @Override
        public String getMethod() 
        {
            return "PROPFIND";
        }
    }
    
    static class HttpMkcol extends HttpEntityEnclosingRequestBase
    {
        HttpMkcol(final String uri)
        {
            super();
            setURI(URI.create(uri));
        }

        @Override
        public String getMethod()
        {
            return "MKCOL";
        }
    }
}