/*
 *  Copyright 2017 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.plugins.zimbra;

import java.io.IOException;
import java.io.StringReader;
import java.io.UnsupportedEncodingException;
import java.net.SocketTimeoutException;
import java.net.UnknownHostException;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.time.Duration;
import java.time.Instant;
import java.time.ZonedDateTime;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Date;
import java.util.List;
import java.util.Map;
import java.util.TreeMap;
import java.util.stream.Collectors;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

import org.apache.avalon.framework.activity.Disposable;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.cocoon.ProcessingException;
import org.apache.cocoon.environment.Redirector;
import org.apache.commons.codec.binary.Hex;
import org.apache.commons.lang3.StringUtils;
import org.apache.excalibur.xml.dom.DOMParser;
import org.apache.excalibur.xml.xpath.PrefixResolver;
import org.apache.excalibur.xml.xpath.XPathProcessor;
import org.apache.http.Header;
import org.apache.http.HeaderElement;
import org.apache.http.HeaderElementIterator;
import org.apache.http.HttpResponse;
import org.apache.http.NameValuePair;
import org.apache.http.client.config.RequestConfig;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.client.protocol.HttpClientContext;
import org.apache.http.client.utils.URLEncodedUtils;
import org.apache.http.conn.ConnectionKeepAliveStrategy;
import org.apache.http.conn.ConnectionPoolTimeoutException;
import org.apache.http.cookie.Cookie;
import org.apache.http.entity.StringEntity;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
import org.apache.http.message.BasicHeaderElementIterator;
import org.apache.http.message.BasicNameValuePair;
import org.apache.http.protocol.HTTP;
import org.apache.http.protocol.HttpContext;
import org.apache.http.util.EntityUtils;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;

import org.ametys.core.cache.AbstractCacheManager;
import org.ametys.core.cache.Cache;
import org.ametys.core.user.User;
import org.ametys.core.user.UserIdentity;
import org.ametys.core.user.UserManager;
import org.ametys.core.util.JSONUtils;
import org.ametys.plugins.messagingconnector.AbstractMessagingConnector;
import org.ametys.plugins.messagingconnector.CalendarEvent;
import org.ametys.plugins.messagingconnector.EmailMessage;
import org.ametys.plugins.messagingconnector.MessagingConnectorException;
import org.ametys.runtime.config.Config;
import org.ametys.runtime.i18n.I18nizableText;

/**
 * The connector used by the messaging connector plugin when the zimbra mail
 * server is used. Implements the methods of the MessagingConnector interface in
 * order to get the informations from the mail server
 */
public class ZimbraConnector extends AbstractMessagingConnector implements Disposable
{
    /** token cache id */
    public static final String TOKEN_CACHE = ZimbraConnector.class.getName() + "$token";

    /** The number of seconds after what kept alive connections are dropt */
    protected static final int _DROP_KEPTALIVE_CONNECTION_AFTER = 5;
    
    private static final ZimbraPrefixResolver __PREFIX_RESOLVER = new ZimbraPrefixResolver();
    
    /** The user manager */
    protected UserManager _usersManager;

    /** The JSON Utils */
    protected JSONUtils _jsonUtils;

    /** Url to zimbra */
    protected String _zimbraUrl;

    /** Preauth secret key */
    protected String _domainPreauthSecretKey;

    /** Request to the remote app will be ppoled for perfs purposes */
    protected PoolingHttpClientConnectionManager _connectionManager;
    
    /** The keep-alive stragegy to optimize http clients */
    protected ConnectionKeepAliveStrategy _connectionKeepAliveStrategy;
    
    /** The shared configuration for request (for timeout purposes) */
    protected RequestConfig _connectionConfig;
    
    private XPathProcessor _xPathProcessor;
    private DOMParser _domParser;

    @Override
    public void service(ServiceManager smanager) throws ServiceException
    {
        super.service(smanager);
        _usersManager = (UserManager) smanager.lookup(UserManager.ROLE);
        _jsonUtils = (JSONUtils) smanager.lookup(JSONUtils.ROLE);
        _cacheManager = (AbstractCacheManager) smanager.lookup(AbstractCacheManager.ROLE);
        _xPathProcessor = (XPathProcessor) smanager.lookup(XPathProcessor.ROLE);
        _domParser = (DOMParser) smanager.lookup(DOMParser.ROLE);
    }

    @Override
    public void initialize()
    {
        super.initialize();
        _zimbraUrl = StringUtils.removeEnd(Config.getInstance().getValue("zimbra.config.zimbra.baseUrl"), "/");
        _domainPreauthSecretKey = Config.getInstance().getValue("zimbra.config.preauth.key");
        
        int maxSimultaneousConnections = (int) (long) Config.getInstance().getValue("zimbra.config.maxconnections");
        // Same value for 3 timeouts (socket, connection and response) so one connection can last 3 times this value
        int connectionTimeout = (int) Math.max(0, (long) Config.getInstance().getValue("zimbra.config.timeout"));  
        
        // A pooling connection manager to avoid flooding remote server by reusing existing connections AND by limiting their number
        _connectionManager = new PoolingHttpClientConnectionManager();
        _connectionManager.setMaxTotal(maxSimultaneousConnections > 0 ? maxSimultaneousConnections : Integer.MAX_VALUE);
        _connectionManager.setDefaultMaxPerRoute(maxSimultaneousConnections > 0 ? maxSimultaneousConnections : Integer.MAX_VALUE);
        
        // inspired from http://www.baeldung.com/httpclient-connection-management
        // to keep a connection alive for a few seconds if the remote server did not send back this information
        _connectionKeepAliveStrategy = new ConnectionKeepAliveStrategy() 
        {
            @Override
            public long getKeepAliveDuration(HttpResponse response, HttpContext context) 
            {
                HeaderElementIterator it = new BasicHeaderElementIterator(response.headerIterator(HTTP.CONN_KEEP_ALIVE));
                while (it.hasNext()) 
                {
                    HeaderElement he = it.nextElement();
                    String param = he.getName();
                    String value = he.getValue();
                    if (value != null && param.equalsIgnoreCase("timeout")) 
                    {
                        try
                        {
                            return Long.parseLong(value) * 1000;
                        }
                        catch (NumberFormatException ignore) 
                        {
                            // Ignore
                        }
                    }
                }
                return _DROP_KEPTALIVE_CONNECTION_AFTER * 1000;
            }
        };
        
        _connectionConfig = RequestConfig.custom()
                .setConnectTimeout(connectionTimeout * 1000)
                .setConnectionRequestTimeout(connectionTimeout * 1000) // Time to get an object from the pool
                .setSocketTimeout(connectionTimeout * 1000).build();

        long tokenDuration = Math.max(0, (long) Config.getInstance().getValue("zimbra.config.tokenDuration")); 
        
        _cacheManager.createMemoryCache(TOKEN_CACHE, 
                new I18nizableText("plugin.zimbra", "PLUGINS_ZIMBRA_CACHE_TOKEN_LABEL"),
                new I18nizableText("plugin.zimbra", "PLUGINS_ZIMBRA_CACHE_TOKEN_DESCRIPTION"),
                false,
                Duration.ofMinutes(tokenDuration));
    }
    
    public void dispose()
    {
        _connectionManager.close();
    }
    
    /**
     * Get a new pooled http client. Do not forget to close it.
     * @return The client
     */
    protected CloseableHttpClient _getHttpClient()
    {
        return HttpClients.custom()
                .setConnectionManager(_connectionManager)
                .setConnectionManagerShared(true) // avoid automatic pool closing
                .setKeepAliveStrategy(_connectionKeepAliveStrategy)
                .setDefaultRequestConfig(_connectionConfig)
                .build();
    }

    /**
     * Preauth user and redirect to the zimbra application
     * @param redirector The redirector
     * @param targetApp The zimbra application (ex: mail) 
     * @throws ProcessingException if failed to redirect
     * @throws IOException if failed to redirect
     */
    public void redirect(Redirector redirector, String targetApp) throws ProcessingException, IOException
    {
        UserIdentity identity = _currentUserProvider.getUser();
        User user = _usersManager.getUser(identity);
        
        if (user != null)
        {
            String qs = _computeQueryString(user, targetApp);
            if (qs != null)
            {
                redirector.redirect(false, _zimbraUrl + "/service/preauth?" + qs);
            }
        }
    }
    

    /**
     * Zimbra preauth request to log the current user into zimbra and retrieve the ZM_AUTH_TOKEN
     * @param userIdentity The user for which the preauth request will be done.
     * @return The Zimbra ZM_AUTH_TOKEN which can be used in future request made through the Zimbra REST API or <code>null</code> if user is null or has no email.
     * @throws MessagingConnectorException if failed to get zimbra token for user
     */
    protected String _doPreauthRequest(UserIdentity userIdentity)
    {
        User user = _usersManager.getUser(userIdentity);
        // Computing query string
        String qs = _computeQueryString(user, null);
        if (qs == null)
        {
            return null;
        }
        
        HttpGet get = new HttpGet(_zimbraUrl + "/service/preauth?" + qs);

        if (getLogger().isDebugEnabled())
        {
            getLogger().debug("ZimbraConnector: performing preauth request for user {}", user.getIdentity());
        }
        
        try (CloseableHttpClient httpClient = _getHttpClient())
        {
            HttpClientContext context = HttpClientContext.create();
            try (CloseableHttpResponse response = httpClient.execute(get, context))
            {
                List<Cookie> cookies = context.getCookieStore().getCookies();
    
                for (Cookie cookie : cookies)
                {
                    if (StringUtils.equals(cookie.getName(), "ZM_AUTH_TOKEN"))
                    {
                        return cookie.getValue();
                    }
                }
    
                throw new MessagingConnectorException("Zimbra authentification failed for user " + user.getEmail(), MessagingConnectorException.ExceptionType.CONFIGURATION_EXCEPTION);
            }
        }
        catch (UnknownHostException e)
        {
            throw new MessagingConnectorException("Unknown host for zimbra server. Giving up to proceed to the Zimbra preauth action for user " + user, MessagingConnectorException.ExceptionType.CONFIGURATION_EXCEPTION, e);
        }
        catch (ConnectionPoolTimeoutException | SocketTimeoutException e)
        {
            throw new MessagingConnectorException("There are already too many connections to zimbra server. Giving up to proceed to the Zimbra preauth action for user " + user, MessagingConnectorException.ExceptionType.TIMEOUT, e);
        }
        catch (IOException e)
        {
            throw new MessagingConnectorException("Unable to proceed to the Zimbra preauth action for user : " + user.getEmail(), MessagingConnectorException.ExceptionType.UNKNOWN, e);
        }
    }
    
    private String _computeQueryString(User user, String targetApp)
    {
        if (user == null)
        {
            return null;
        }

        String zimbraUser = user.getEmail();

        if (StringUtils.isEmpty(zimbraUser))
        {
            if (getLogger().isDebugEnabled())
            {
                getLogger().debug("Cannot retreive zimbra information with empty email for user " + user);
            }
            return null;
        }

        String timestamp = String.valueOf(System.currentTimeMillis());
        String computedPreauth = null;

        try
        {
            computedPreauth = _getComputedPreauth(zimbraUser, timestamp, _domainPreauthSecretKey);
        }
        catch (Exception e)
        {
            throw new MessagingConnectorException("Unable to compute the preauth key during the Zimbra preauth action for user : " + zimbraUser, MessagingConnectorException.ExceptionType.UNKNOWN, e);
        }

        // Preauth request parameters
        List<NameValuePair> params = new ArrayList<>();
        params.add(new BasicNameValuePair("account", zimbraUser));
        params.add(new BasicNameValuePair("timestamp", timestamp));
        params.add(new BasicNameValuePair("expires", "0"));
        params.add(new BasicNameValuePair("preauth", computedPreauth));
        if (targetApp != null)
        {
            params.add(new BasicNameValuePair("redirectURL", "/?app=" + targetApp));
        }
        
        // Computing query string
        return URLEncodedUtils.format(params, StandardCharsets.UTF_8);
    }

    /**
     * Compute the preauth key.
     * @param zimbraUser The Zimbra User
     * @param timestamp The timestamp
     * @param secretKey The secret key
     * @return The computed preauth key
     * @throws NoSuchAlgorithmException if no Provider supports a MacSpi
     *             implementation for the specified algorithm (HmacSHA1).
     * @throws InvalidKeyException if the given key is inappropriate for
     *             initializing the MAC
     * @throws UnsupportedEncodingException If the named charset (UTF-8) is not
     *             supported
     */
    protected String _getComputedPreauth(String zimbraUser, String timestamp, String secretKey) throws NoSuchAlgorithmException, InvalidKeyException, UnsupportedEncodingException
    {
        SecretKeySpec signingKey = new SecretKeySpec(secretKey.getBytes(), "HmacSHA1");
        Mac mac = Mac.getInstance("HmacSHA1");
        mac.init(signingKey);

        String data = StringUtils.join(new String[] {zimbraUser, "name", "0", timestamp}, '|');
        byte[] rawHmac = mac.doFinal(data.getBytes());
        byte[] hexBytes = new Hex().encode(rawHmac);
        return new String(hexBytes, "UTF-8");
    }

    @Override
    protected List<CalendarEvent> internalGetEvents(UserIdentity userIdentity, int maxDays, int maxEvents) throws MessagingConnectorException
    {
        Document response = _getSoapEvents(userIdentity, maxDays);
        
        if (response == null)
        {
            return Collections.EMPTY_LIST;
        }
        
        NodeList events = _xPathProcessor.selectNodeList(response, "/soap:Envelope/soap:Body/mail:SearchResponse/mail:appt/mail:inst", __PREFIX_RESOLVER);
        int count = 0;
        Map<Long, CalendarEvent> calendarEvents = new TreeMap<>();
        while (count < events.getLength())
        {
            Element item = (Element) events.item(count);
            
            String rawStart = _getAttribute(item, "s");
            long longStart = Long.parseLong(rawStart);
            Instant startInst = Instant.ofEpochMilli(longStart);
            Date start = Date.from(startInst);
            
            String duration = _getAttribute(item, "dur");
            Instant endInst = startInst.plusMillis(Long.parseLong(duration));
            Date end = Date.from(endInst);
            
            String name = _getAttribute(item, "name");
            String location = _getAttribute(item, "loc");
            
            CalendarEvent newEvent = new CalendarEvent();
            newEvent.setStartDate(start);
            newEvent.setEndDate(end);
            newEvent.setSubject(name);
            newEvent.setLocation(location);
            calendarEvents.put(longStart, newEvent);
            
            count++;
        }
        
        return calendarEvents.entrySet().stream().limit(maxEvents).map(e -> e.getValue()).collect(Collectors.toList());
    }

    private String _getAttribute(Element item, String name)
    {
        String value = item.getAttribute(name);
        if (StringUtils.isEmpty(value))
        {
            value = ((Element) item.getParentNode()).getAttribute(name);
        }
        
        return value;
    }

    @Override
    protected int internalGetEventsCount(UserIdentity userIdentity, int maxDays) throws MessagingConnectorException
    {
        Document response = _getSoapEvents(userIdentity, maxDays);
        
        if (response == null)
        {
            return 0;
        }
        
        return _xPathProcessor.evaluateAsNumber(response, "count(/soap:Envelope/soap:Body/mail:SearchResponse/mail:appt/mail:inst)", __PREFIX_RESOLVER).intValue();
    }
    
    private Document _getSoapEvents(UserIdentity userIdentity, int maxDays) throws MessagingConnectorException
    {
        ZonedDateTime now = ZonedDateTime.now();
        String soapRequestBody = "<SearchRequest xmlns=\"urn:zimbraMail\" types=\"appointment\" calExpandInstStart=\"" + now.toInstant().toEpochMilli() + "\" calExpandInstEnd =\"" + now.plusDays(maxDays).toInstant().toEpochMilli() + "\" >"
                               + "  <query>in:calendar</query>"
                               + "</SearchRequest>";

        return _executeSoapRequest(userIdentity, soapRequestBody, "next events");
    }

    @Override
    protected List<EmailMessage> internalGetEmails(UserIdentity userIdentity, int maxEmails) throws MessagingConnectorException
    {
        String soapRequestBody = "<SearchRequest xmlns=\"urn:zimbraMail\" types=\"message\" limit=\"" + maxEmails + "\">"
                               + "  <query>is:unread in:inbox</query>"
                               + "</SearchRequest>";

        Document document = _executeSoapRequest(userIdentity, soapRequestBody, "unread email");
        
        if (document != null)
        {
            NodeList emails = _xPathProcessor.selectNodeList(document, "/soap:Envelope/soap:Body/mail:SearchResponse/mail:m", __PREFIX_RESOLVER);
            
            List<EmailMessage> result = new ArrayList<>();
            int count = 0;
            while (count < emails.getLength())
            {
                Node item = emails.item(count);
     
                EmailMessage email = new EmailMessage();
                email.setSender(_xPathProcessor.evaluateAsString(item, "mail:e/@a", __PREFIX_RESOLVER));
                email.setSubject(_xPathProcessor.evaluateAsString(item, "mail:su", __PREFIX_RESOLVER));
                email.setSummary(_xPathProcessor.evaluateAsString(item, "mail:fr", __PREFIX_RESOLVER));
                
                result.add(email);
     
                count++;
            }
            
            return result;
        }
        
        return Collections.emptyList();
    }

    @Override
    protected int internalGetEmailsCount(UserIdentity userIdentity) throws MessagingConnectorException
    {
        String soapRequestBody = "<GetFolderRequest xmlns=\"urn:zimbraMail\" depth=\"0\">"
                               + "  <folder path=\"inbox\" />"
                               + "</GetFolderRequest>";
        
        Document document = _executeSoapRequest(userIdentity, soapRequestBody, "email count");
        if (document != null)
        {
            return _xPathProcessor.evaluateAsNumber(document, "/soap:Envelope/soap:Body/mail:GetFolderResponse/mail:folder/@u", __PREFIX_RESOLVER).intValue();
        }
        
        return 0;
    }
    
    private Document _executeSoapRequest(UserIdentity userIdentity, String soapRequestBody, String shortDescription) throws MessagingConnectorException
    {
        // Connection to the zimbra mail server
        String authToken = _getToken(userIdentity);
        
        if (StringUtils.isEmpty(authToken))
        {
            return null;
        }
        
        String soapRequest = "<soap:Envelope xmlns:soap=\"http://www.w3.org/2003/05/soap-envelope\">" 
                + "  <soap:Header>"
                + "    <context xmlns=\"urn:zimbra\">"
                + "       <authToken>" + authToken + "</authToken>" 
                + "    </context>"
                + "  </soap:Header>"
                + "  <soap:Body>"
                +      soapRequestBody
                + "  </soap:Body>" 
                + "</soap:Envelope>";
        
        HttpPost req = new HttpPost(_zimbraUrl + "/service/soap");
        req.setEntity(new StringEntity(soapRequest, StandardCharsets.UTF_8));
        
        try (
                CloseableHttpClient httpClient = _getHttpClient();
                CloseableHttpResponse response = httpClient.execute(req, HttpClientContext.create())
            )
        {
            int status = response.getStatusLine().getStatusCode();
            if (status != 200)
            {
                getLogger().error("Zimbra failed on calling '{}' with status {} and reason: {}", shortDescription, status, response.getStatusLine().getReasonPhrase());
                if (getLogger().isDebugEnabled())
                {
                    StringBuilder sb = new StringBuilder("Headers:");
                    for (Header header : response.getAllHeaders())
                    {
                        sb.append("\n - ").append(header.getName()).append(": ").append(header.getValue());
                    }
                    getLogger().debug(sb.toString());
                }
                return null;
            }
            
            String content = EntityUtils.toString(response.getEntity());
            if (getLogger().isDebugEnabled())
            {
                getLogger().debug("{}: {}", userIdentity, content);
            }
            Document document = _domParser.parseDocument(new InputSource(new StringReader(content)));
            
            String failure = _xPathProcessor.evaluateAsString(document, "/soap:Envelope/soap:Body/soap:Fault/soap:Reason/soap:Text", __PREFIX_RESOLVER);
            
            if (StringUtils.isEmpty(failure))
            {
                return document;
            }
            else
            {
                getLogger().warn("Zimbra failed to return {} for user {}: {}", shortDescription, userIdentity, failure);
                return null;
            }
        }
        catch (IOException | SAXException e)
        {
            throw new MessagingConnectorException("Failed to get Zimbra " + shortDescription + " for user " + userIdentity, MessagingConnectorException.ExceptionType.UNKNOWN, e);
        }
    }
    
    private static class ZimbraPrefixResolver implements PrefixResolver
    {
        private Map<String, String> _namespaces = Map.of("soap", "http://www.w3.org/2003/05/soap-envelope",
                                                         "mail", "urn:zimbraMail");
        
        public String prefixToNamespace(String prefix)
        {
            return _namespaces.get(prefix);
        }
    }

    private String _getToken (UserIdentity user)
    {
        if (user == null)
        {
            return null;
        }
         
        Cache<UserIdentity, String> cache = _getCache();
        
        return cache.get(user, key -> _doPreauthRequest(key));
    }
    
    private Cache<UserIdentity, String> _getCache() 
    {
        return this._cacheManager.get(TOKEN_CACHE);
    }    
}