package com.airlock.iam.common.application.configuration.security;

import com.airlock.iam.common.domain.model.jwt.JwtSecret;
import com.airlock.iam.common.domain.model.jwt.encryption.DirectEncryptionMethod;
import com.airlock.iam.common.domain.model.jwt.signature.JwsAlgorithmHmac;
import com.airlock.iam.common.domain.service.jwt.JwtSettingsValidationError;
import com.airlock.iam.common.domain.service.jwt.encryption.JwtTicketDirectAesEncrypterDecrypter;
import com.airlock.iam.common.domain.service.jwt.signature.HmacJwtSigner;
import com.airlock.iam.common.domain.service.jwt.signature.JwtSignatureVerifierImpl;
import com.airlock.iam.plugin.api.annotation.config.ConfigurationValidator;
import com.airlock.iam.plugin.api.annotation.config.Plugin;
import com.airlock.iam.plugin.api.annotation.property.StringProperty;
import com.airlock.iam.plugin.api.config.ConfigurationContext;
import com.airlock.iam.plugin.api.config.ConfigurationEnvironment;
import com.airlock.iam.plugin.api.config.Environment;
import com.airlock.iam.plugin.api.config.PluginConfiguration;
import com.airlock.iam.plugin.api.exception.PropertyConstraintViolationException;
import com.airlock.iam.plugin.api.exception.PropertyTypeMismatchException;
import com.airlock.iam.plugin.api.valuereader.StringPropertyValueReader;
import com.airlock.iam.plugin.framework.misc.processor.PasswordPropertyProcessor;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
import java.util.Optional;

@Plugin(
   displayName = "Storage Encryption Configuration",
   description = "<p>Defines how data is encrypted when stored on the database.</p><p><b>Beware that changing the configured secret may result in data loss.</b></p>"
)
public class StorageEncryptionConfig {
   @StringProperty(
      displayName = "Secret (Base64-encoded)",
      description = "<p>A Base64-encoded secret. It must be exactly 768 bits (96 bytes or 128 Base64-encoded characters) long.</p><p>One can, for example, generate a random Base64 string with 768 bits (96 bytes) using openssl as follows: <code>openssl rand -base64 96</code></p>",
      optional = false,
      isSensitive = true,
      minLength = 128,
      maxLength = 128
   )
   private String secret;
   public static final String SECRET_PROPERTY_NAME = "secret";

   public JwtSecret getJwtSecret() {
      return JwtSecret.jwtSecret(this.secret);
   }

   @ConfigurationValidator(localOnly = true)
   static void ensureHmacAlgorithmAndKeyWork(PluginConfiguration config, ConfigurationEnvironment env, ConfigurationContext context, Environment valenv) throws PropertyConstraintViolationException, PropertyTypeMismatchException {
      if (!validationNotPossible(config, env, context, valenv)) {
         JwtSecret jwtSecret = readJwtSecret(config, env, context);
         String hmacKey = jwtSecret.getJwtKeys().hmacKey();
         Optional<JwtSettingsValidationError> signerError = HmacJwtSigner.validate(JwsAlgorithmHmac.HS512, hmacKey);
         Optional<JwtSettingsValidationError> verifierError = JwtSignatureVerifierImpl.validate(JwsAlgorithmHmac.HS512, hmacKey);
         if (signerError.isPresent() || verifierError.isPresent()) {
            JwtSettingsValidationError error = signerError.orElseGet(verifierError::get);
            throw new PropertyConstraintViolationException("secret", config, env, context, error.getMessage(), error.getCause().orElse(null));
         }
      }
   }

   @ConfigurationValidator(localOnly = true)
   static void ensureEncryptionMethodAndKeyWork(PluginConfiguration config, ConfigurationEnvironment env, ConfigurationContext context, Environment valenv) throws PropertyConstraintViolationException, PropertyTypeMismatchException {
      if (!validationNotPossible(config, env, context, valenv)) {
         JwtSecret jwtSecret = readJwtSecret(config, env, context);
         String encryptionKey = jwtSecret.getJwtKeys().encryptionKey();
         Optional<JwtSettingsValidationError> error = JwtTicketDirectAesEncrypterDecrypter.validate(DirectEncryptionMethod.A256GCM, encryptionKey);
         if (error.isPresent()) {
            throw new PropertyConstraintViolationException("secret", config, env, context, error.get().getMessage(), error.get().getCause().orElse(null));
         }
      }
   }

   @ConfigurationValidator(localOnly = true)
   static void validateEncryption(PluginConfiguration config, ConfigurationEnvironment env, ConfigurationContext context, Environment valenv) throws PropertyConstraintViolationException, PropertyTypeMismatchException {
      if (!validationNotPossible(config, env, context, valenv)) {
         JwtSecret jwtSecret = readJwtSecret(config, env, context);
         String encryptionKey = jwtSecret.getJwtKeys().encryptionKey();

         try {
            JwtTicketDirectAesEncrypterDecrypter.builder().directEncryptionMethod(DirectEncryptionMethod.A256GCM).encryptionKey(encryptionKey).build();
         } catch (Exception e) {
            throw new PropertyConstraintViolationException(
               "secret", config, env, context, "Encryption not possible with A256GCM and the given secret. Maybe the secret is not a valid Base64 string?"
            );
         }
      }
   }

   private static boolean validationNotPossible(PluginConfiguration config, ConfigurationEnvironment env, ConfigurationContext context, Environment valenv) throws PropertyTypeMismatchException {
      return valenv != Environment.CURRENT_VM && PasswordPropertyProcessor.isExternallyStored(config, "secret", env, context);
   }

   private static JwtSecret readJwtSecret(PluginConfiguration config, ConfigurationEnvironment env, ConfigurationContext context) throws PropertyTypeMismatchException, PropertyConstraintViolationException {
      String secret = StringPropertyValueReader.effectiveStringConfigValue(config, "secret", env, context);
      return requireValidSecret(secret, config, env, context);
   }

   private static JwtSecret requireValidSecret(String secret, PluginConfiguration config, ConfigurationEnvironment env, ConfigurationContext context) throws PropertyConstraintViolationException {
      try {
         return JwtSecret.jwtSecret(secret);
      } catch (IllegalArgumentException e) {
         throw new PropertyConstraintViolationException(
            "secret", config, env, context, "Error parsing secret: " + e.getMessage() + ". Maybe the secret is not a valid Base64 string?"
         );
      }
   }

   @SuppressFBWarnings(justification = "generated code")
   public static StorageEncryptionConfig.StorageEncryptionConfigBuilder builder() {
      return new StorageEncryptionConfig.StorageEncryptionConfigBuilder();
   }

   @SuppressFBWarnings(justification = "generated code")
   public StorageEncryptionConfig(String secret) {
      this.secret = secret;
   }

   @SuppressFBWarnings(justification = "generated code")
   public StorageEncryptionConfig() {
   }

   @SuppressFBWarnings(justification = "generated code")
   public static class StorageEncryptionConfigBuilder {
      @SuppressFBWarnings(justification = "generated code")
      private String secret;

      @SuppressFBWarnings(justification = "generated code")
      StorageEncryptionConfigBuilder() {
      }

      @SuppressFBWarnings(justification = "generated code")
      public StorageEncryptionConfig.StorageEncryptionConfigBuilder secret(String secret) {
         this.secret = secret;
         return this;
      }

      @SuppressFBWarnings(justification = "generated code")
      public StorageEncryptionConfig build() {
         return new StorageEncryptionConfig(this.secret);
      }

      @SuppressFBWarnings(justification = "generated code")
      @Override
      public String toString() {
         return "StorageEncryptionConfig.StorageEncryptionConfigBuilder(secret=" + this.secret + ")";
      }
   }
}