package com.airlock.iam.common.domain.model.gateway;

import com.airlock.iam.base.api.domain.model.plugin.LogicForConfig;
import com.airlock.iam.base.domain.service.uri.UrlUtils;
import com.airlock.iam.common.application.configuration.gateway.extractor.ClientCertificatePemExtractionFormatConfig;
import com.airlock.iam.common.domain.model.request.ClientTlsCertificate;
import com.airlock.iam.security.certificate.CertificateIO;
import jakarta.inject.Inject;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.text.ParseException;

@LogicForConfig(ClientCertificatePemExtractionFormatConfig.class)
public final class ClientCertificatePemExtractionFormat implements ClientCertificateExtractionFormat {
   @Override
   public ClientTlsCertificate extractCertificate(String headerValue) {
      try {
         String pemString = UrlUtils.urlDecode(headerValue);
         X509Certificate x509Certificate = CertificateIO.certificateFromPemString(pemString);
         return ClientTlsCertificate.validClientTlsCertificate(x509Certificate);
      } catch (CertificateException | ParseException | IllegalArgumentException e) {
         return ClientTlsCertificate.invalidClientTlsCertificate("Tried to read URL encoded PEM mTLS certificate from header but it failed - " + e.getMessage());
      }
   }
}