/*
 *  Copyright 2019 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.core.util;

import java.io.IOException;
import java.net.HttpURLConnection;
import java.net.ProtocolException;
import java.net.SocketTimeoutException;
import java.net.URI;
import java.net.URISyntaxException;
import java.net.URL;
import java.net.UnknownHostException;
import java.util.Collections;
import java.util.HashMap;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Optional;
import java.util.concurrent.TimeUnit;
import java.util.regex.Pattern;

import javax.net.ssl.SSLHandshakeException;

import org.apache.avalon.framework.activity.Disposable;
import org.apache.avalon.framework.activity.Initializable;
import org.apache.avalon.framework.component.Component;
import org.apache.commons.lang3.RegExUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.hc.client5.http.ContextBuilder;
import org.apache.hc.client5.http.classic.HttpClient;
import org.apache.hc.client5.http.classic.methods.HttpGet;
import org.apache.hc.client5.http.classic.methods.HttpHead;
import org.apache.hc.client5.http.classic.methods.HttpPost;
import org.apache.hc.client5.http.classic.methods.HttpUriRequestBase;
import org.apache.hc.client5.http.config.ConnectionConfig;
import org.apache.hc.client5.http.config.RequestConfig;
import org.apache.hc.client5.http.cookie.BasicCookieStore;
import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
import org.apache.hc.client5.http.impl.classic.HttpClients;
import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager;
import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
import org.apache.hc.client5.http.protocol.HttpClientContext;
import org.apache.hc.core5.http.ClassicHttpRequest;
import org.apache.hc.core5.http.HttpHeaders;
import org.apache.hc.core5.http.io.HttpClientResponseHandler;
import org.apache.hc.core5.io.CloseMode;
import org.apache.hc.core5.util.Timeout;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import org.ametys.core.ui.Callable;
import org.ametys.core.util.IPRestrictedSocket.IPRestrictedException;
import org.ametys.runtime.config.Config;

/**
 * Utility class for HTTP urls.
 */
public class HttpUtils implements Component, Initializable, Disposable
{
    /** The Avalon role */
    public static final String ROLE = HttpUtils.class.getName();
    
    /** Regexp for HTTP url */
    public static final Pattern HTTP_URL_VALIDATOR = Pattern.compile("^(https?:\\/\\/.+)?$");
    
    /** The status of HTTP check */
    public static enum HttpCheck
    {
        /** All right */
        SUCCESS,
        /** Server error. */
        SERVER_ERROR,
        /** URL not found.*/
        NOT_FOUND,
        /** Unauthorized. */
        UNAUTHORIZED,
        /** Timeout (too long) */
        TIMEOUT,
        /** A redirect occurs */
        REDIRECT,
        /** Security level error */
        SECURITY_LEVEL_ERROR,
        /** No HTTP url */
        NOT_HTTP
        
    }
    
    /**
     * HTTP Status-Code 307: Temporay Redirect
     */
    public static final int HTTP_REDIRECT_TEMP = 307;
    
    /**
     * HTTP Status-Code 308: Temporay Redirect
     */
    public static final int HTTP_REDIRECT_PERM = 308;
    
    
    private static Logger __logger = LoggerFactory.getLogger(HttpUtils.class);

    private static CloseableHttpClient __httpClient;
    private static CloseableHttpClient __unRestrictedHttpClient;
    
    public void initialize() throws Exception
    {
        __httpClient = createHttpClient(-1, -1, true);
        __unRestrictedHttpClient = createHttpClient(-1, -1, false);
    }
    
    public void dispose()
    {
        __httpClient.close(CloseMode.GRACEFUL);
        __unRestrictedHttpClient.close(CloseMode.GRACEFUL);
    }
    
    /**
     * Prepare the connection to the remote URL
     * @param httpUrl The HTTP URL
     * @param userAgent The user agent. Can be null.
     * @param method The method for the URL request. Can be null.
     * @param timeout The connection timeout in milliseconds. Set to -1 to not set a timeout.
     * @param readTimeOut The read timeout in milliseconds. Set to -1 to not set a timeout.
     * @param followRedirects Sets to true to follow HTTP redirects
     * @param requestHeaders The request headers.
     * @param responseHandler The handler that transform the HTTP response into the execution response
     * @param <T> The type of the value returned by the execution
     * @return The result obtained by the response handler
     * @throws IOException if an I/O exception occurs or the URL is invalid
     */
    public static <T> T executeRequest(String httpUrl, String userAgent, String method, int timeout, int readTimeOut, boolean followRedirects, Map<String, String> requestHeaders, HttpClientResponseHandler<? extends T> responseHandler) throws IOException
    {
        return executeRequest(httpUrl, userAgent, method, timeout, readTimeOut, followRedirects, requestHeaders, false, responseHandler);
    }
    /**
     * Prepare the connection to the remote URL
     * @param httpUrl The HTTP URL
     * @param userAgent The user agent. Can be null.
     * @param method The method for the URL request. Can be null.
     * @param timeout The connection timeout in milliseconds. Set to -1 to not set a timeout.
     * @param readTimeOut The read timeout in milliseconds. Set to -1 to not set a timeout.
     * @param followRedirects Sets to true to follow HTTP redirects
     * @param requestHeaders The request headers.
     * @param ignoreRestriction true to bypass security restriction on HTTP client
     * @param responseHandler The handler that transform the HTTP response into the execution response
     * @param <T> The type of the value returned by the execution
     * @return The result obtained by the response handler
     * @throws IOException if an I/O exception occurs or the URL is invalid
     */
    public static <T> T executeRequest(String httpUrl, String userAgent, String method, int timeout, int readTimeOut, boolean followRedirects, Map<String, String> requestHeaders, boolean ignoreRestriction, HttpClientResponseHandler<? extends T> responseHandler) throws IOException
    {
        try
        {
            ClassicHttpRequest request = buildRequest(new URI(httpUrl), userAgent, method, timeout, readTimeOut, followRedirects, 5, requestHeaders);
            
            return _executeRequest(request, ignoreRestriction, responseHandler);
        }
        catch (URISyntaxException e)
        {
            throw new IOException(e);
        }
    }

    private static <T> T _executeRequest(ClassicHttpRequest request, boolean ignoreRestriction, HttpClientResponseHandler<? extends T> responseHandler) throws IOException
    {
        // Provide a per request cookie store to isolate connection made by the client
        HttpClientContext context = ContextBuilder.create()
            .useCookieStore(new BasicCookieStore())
            .build();
        
        return (ignoreRestriction ? __unRestrictedHttpClient : __httpClient).execute(request, context, responseHandler);
    }
    
    /**
     * build a request to the remote URI
     * @param uri The URI to request
     * @param userAgent The user agent. Can be null.
     * @param method The method for the URL request. Can be null.
     * @param timeout The connection timeout in milliseconds. Set to -1 to not set a timeout.
     * @param readTimeOut The read timeout in milliseconds. Set to -1 to not set a timeout.
     * @param followRedirects Sets to true to follow HTTP redirects
     * @param maxRedirects The maximum number of redirects to follow
     * @param requestHeaders The request headers.
     * @return The HTTP request
     * @throws IOException if an I/O exception occurs
     */
    public static ClassicHttpRequest buildRequest(URI uri, String userAgent, String method, int timeout, int readTimeOut, boolean followRedirects, int maxRedirects, Map<String, String> requestHeaders) throws IOException
    {
        HttpUriRequestBase request = switch (method)
        {
            case null -> new HttpGet(uri);
            case HttpGet.METHOD_NAME -> new HttpGet(uri);
            case HttpPost.METHOD_NAME -> new HttpPost(uri);
            case HttpHead.METHOD_NAME -> new HttpHead(uri);
            default -> throw new ProtocolException("Unsupported http method: " + method);
        };

        RequestConfig config = RequestConfig.custom()
            .setRedirectsEnabled(followRedirects)
            .setMaxRedirects(maxRedirects)
            .setConnectionRequestTimeout(timeout, TimeUnit.MILLISECONDS)
            .setResponseTimeout(readTimeOut, TimeUnit.MILLISECONDS)
            .build();
        
        request.setConfig(config);
        
        for (Entry<String, String> headers : requestHeaders.entrySet())
        {
            request.setHeader(headers.getKey(), headers.getValue());
        }
        
        if (userAgent != null)
        {
            request.setHeader(HttpHeaders.USER_AGENT, userAgent);
        }
        
        return request;
    }
    
    /**
     * Check the HTTP url
     * @param httpUrl The HTTP url to test
     * @param userAgent The user agent. Can be null.
     * @param method The method for teh URL request. Can be null.
     * @param timeout The connection timeout in milliseconds. Set to -1 to not set a timeout.
     * @param readTimeOut The read timeout in milliseconds. Set to -1 to not set a timeout.
     * @param followRedirects Sets to true to follow HTTP redirects
     * @return The URL connection
     */
    public static HttpCheckReport checkHttpUrl(String httpUrl, String userAgent, String method, int timeout, int readTimeOut, boolean followRedirects)
    {
        return checkHttpUrl(httpUrl, userAgent, method, timeout, readTimeOut, followRedirects, Collections.EMPTY_MAP);
    }
    
    /**
     * Check the HTTP url
     * @param httpUrl The url to test
     * @param userAgent The user agent. Can be null.
     * @param method The method for teh URL request. Can be null.
     * @param timeout The connection timeout in milliseconds. Set to -1 to not set a timeout.
     * @param readTimeOut The read timeout in milliseconds. Set to -1 to not set a timeout.
     * @param followRedirects Sets to true to follow HTTP redirects
     * @param requestHeaders The request headers.
     * @return The URL connection
     */
    public static HttpCheckReport checkHttpUrl(String httpUrl, String userAgent, String method, int timeout, int readTimeOut, boolean followRedirects, Map<String, String> requestHeaders)
    {
        if (!HTTP_URL_VALIDATOR.matcher(StringUtils.defaultIfEmpty(httpUrl, "")).matches())
        {
            __logger.debug("Url '{}' is not a valid HTTP url", httpUrl);
            return new HttpCheckReport(HttpCheck.NOT_HTTP);
        }
        
        try
        {
            return _checkHttpUrl(new URI(httpUrl), userAgent, method, timeout, readTimeOut, followRedirects, requestHeaders, 5);
        }
        catch (URISyntaxException e)
        {
            __logger.debug("Unable to parse '{}' as a HTTP url", httpUrl, e);
            return new HttpCheckReport(HttpCheck.NOT_HTTP);
        }
    }
    
    /**
     * Check the HTTP url
     * @param url The url to test
     * @param userAgent The user agent. Can be null.
     * @param method The method for teh URL request. Can be null.
     * @param timeout The connection timeout in milliseconds. Set to -1 to not set a timeout.
     * @param readTimeOut The read timeout in milliseconds. Set to -1 to not set a timeout.
     * @param followRedirects Sets to true to follow HTTP redirects
     * @param requestHeaders The request headers.
     * @return The URL connection
     */
    public static HttpCheckReport checkHttpUrl(URL url, String userAgent, String method, int timeout, int readTimeOut, boolean followRedirects, Map<String, String> requestHeaders)
    {
        try
        {
            return _checkHttpUrl(url.toURI(), userAgent, method, timeout, readTimeOut, followRedirects, requestHeaders, 5);
        }
        catch (URISyntaxException e)
        {
            __logger.debug("Invalid URI: " + url.toString());
            return new HttpCheckReport(HttpCheck.NOT_HTTP);
        }
    }
    
    private static HttpCheckReport _checkHttpUrl(URI uri, String userAgent, String method, int timeout, int readTimeOut, boolean followRedirects, Map<String, String> requestHeaders, int maxRedirects)
    {
        try
        {
            ClassicHttpRequest request = buildRequest(uri, userAgent, method, timeout, readTimeOut, followRedirects, maxRedirects, requestHeaders);
            return _executeRequest(request, false, response -> {
                if (response.getCode() == HttpURLConnection.HTTP_OK)
                {
                    __logger.debug("Check of URL '{}' successed", uri);
                    return new HttpCheckReport(HttpCheck.SUCCESS);
                }
                else if (response.getCode() == HttpURLConnection.HTTP_MOVED_TEMP /* 302 */
                        || response.getCode() == HttpURLConnection.HTTP_MOVED_PERM /* 301 */
                        || response.getCode() == HttpURLConnection.HTTP_SEE_OTHER /* 303 */
                        || response.getCode() == HTTP_REDIRECT_TEMP /* 307 */
                        || response.getCode() == HTTP_REDIRECT_PERM /* 308 */)
                {
                    return new HttpCheckReport(HttpCheck.REDIRECT);
                }
                else
                {
                    int responseCode = response.getCode();
                    
                    __logger.debug("Check of URL '{}' returns the status code {}", uri, responseCode);
                    
                    switch (responseCode)
                    {
                        case HttpURLConnection.HTTP_NOT_FOUND:
                            return new HttpCheckReport(HttpCheck.NOT_FOUND);
                        case HttpURLConnection.HTTP_FORBIDDEN:
                        case HttpURLConnection.HTTP_UNAUTHORIZED:
                            return new HttpCheckReport(HttpCheck.UNAUTHORIZED);
                        case HttpURLConnection.HTTP_INTERNAL_ERROR:
                        default:
                            return new HttpCheckReport(HttpCheck.SERVER_ERROR, Optional.ofNullable(response.getReasonPhrase()));
                    }
                }
            });
        }
        catch (SSLHandshakeException e)
        {
            __logger.debug("Certificate error for URL '{}'", uri, e);
            return new HttpCheckReport(HttpCheck.SECURITY_LEVEL_ERROR, Optional.ofNullable(e.getMessage()));
        }
        catch (SocketTimeoutException e)
        {
            __logger.debug("Aborting test for URL '{}' because too long", uri, e);
            return new HttpCheckReport(HttpCheck.TIMEOUT);
        }
        catch (UnknownHostException e)
        {
            __logger.debug("Unknown host for URL '{}'", uri, e);
            return new HttpCheckReport(HttpCheck.NOT_FOUND);
        }
        catch (IPRestrictedException e)
        {
            __logger.debug("Access to '{}' is restricted", uri, e);
            return new HttpCheckReport(HttpCheck.UNAUTHORIZED);
        }
        catch (IOException e)
        {
            __logger.debug("Cannot test URL '{}'", uri, e);
            return new HttpCheckReport(HttpCheck.SERVER_ERROR, Optional.ofNullable(e.getMessage()));
        }
    }
    
    /**
     * Method to check a HTTP url from client side.
     * The HTTP redirects will be followed.
     * @param httpUrl the http url to check
     * @return the result of the check
     */
    @Callable (rights = Callable.NO_CHECK_REQUIRED) // Assume no right check (use by 'edition.url-reference' widget)
    public Map<String, Object> checkHttpUrl(String httpUrl)
    {
        Map<String, Object> result = new HashMap<>();
        
        HttpCheckReport report = checkHttpUrl(httpUrl, null, null, 2000, 2000, true);
        result.put("success", HttpCheck.SUCCESS.equals(report.status()));
        if (report.message().isPresent())
        {
            result.put("message", report.message().get());
        }
        result.put("checkResult", report.status().name());
        
        return result;
    }
    
    /**
     * Represent the result of a check and a potential message
     * @param status the result status
     * @param message the message if needed
     */
    public record HttpCheckReport(HttpCheck status, Optional<String> message) {
        /**
         * Create a report with the provided status and no message.
         * @param result the result status
         */
        public HttpCheckReport(HttpCheck result)
        {
            this(result, Optional.empty());
        }
    }
    
    /**
     * Create ands return a configured, ready to use, {@link HttpClient}.<br>
     * This method is well suited to create a client dedicated to a single route.
     * @param maxConnections the maximum simultaneous connections. If zero or negative, defaults to HttpClient's default values.
     * @param timeout the socket and connect timeout, in seconds. If zero or negative, defaults to HttpClient's default values.
     * @return a configured {@link HttpClient}
     */
    public static CloseableHttpClient createHttpClient(int maxConnections, int timeout)
    {
        return createHttpClient(maxConnections, timeout, true);
    }
    
    /**
     * Create ands return a configured, ready to use, {@link HttpClient}.<br>
     * This method is well suited to create a client dedicated to a single route.
     * @param maxConnections the maximum simultaneous connections. If zero or negative, defaults to HttpClient's default values.
     * @param timeout the socket and connect timeout, in seconds. If zero or negative, defaults to HttpClient's default values.
     * @param blockInternal true to prevent request to restricted IP address (as defined in configuration)
     * @return a configured {@link HttpClient}
     */
    public static CloseableHttpClient createHttpClient(int maxConnections, int timeout, boolean blockInternal)
    {
        ConnectionConfig connectionConfig = ConnectionConfig.custom()
                                                            .setConnectTimeout(timeout > 0 ? Timeout.ofSeconds(timeout) : null)
                                                            .setSocketTimeout(timeout > 0 ? Timeout.ofSeconds(timeout) : null)
                                                            .build();
        
        PoolingHttpClientConnectionManagerBuilder connectionManagerBuilder = _getConnectionManagerBuilder(blockInternal);
        
        PoolingHttpClientConnectionManager connectionManager = connectionManagerBuilder
                                                                    .setDefaultConnectionConfig(connectionConfig)
                                                                    .setMaxConnTotal(maxConnections > 0 ? maxConnections : PoolingHttpClientConnectionManager.DEFAULT_MAX_TOTAL_CONNECTIONS)
                                                                    .setMaxConnPerRoute(maxConnections > 0 ? maxConnections : PoolingHttpClientConnectionManager.DEFAULT_MAX_CONNECTIONS_PER_ROUTE)
                                                                    .build();
        
        return HttpClients.custom()
                          .setConnectionManager(connectionManager)
                          .useSystemProperties()
                          .build();
    }

    private static PoolingHttpClientConnectionManagerBuilder _getConnectionManagerBuilder(boolean blockInternal)
    {
        if (blockInternal)
        {
            Config config = Config.getInstance();
            if (config != null)
            {
                String rule = config.getValue("runtime.ssrf.block.rule");
                if (StringUtils.isNotBlank(rule))
                {
                    return IPRestrictedConnectionManagerBuilder.create(Pattern.compile(rule));
                }
            }
        }
        
        return PoolingHttpClientConnectionManagerBuilder.create();
    }
    
    /**
     * Strips the end of an uri to remove "*.html" ends and "/" ending characters
     * @param uri The uri to edit
     * @return The edited uri
     */
    public static String sanitize(String uri)
    {
        return StringUtils.stripEnd(RegExUtils.removePattern((CharSequence) uri, "[^/]*.html$"), "/");
    }
}