package com.airlock.iam.common.domain.service.jwt.signature;

import com.airlock.iam.base.api.domain.model.exception.FailureException;
import com.nimbusds.jose.util.Base64URL;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.cert.Certificate;
import java.security.cert.CertificateEncodingException;

public final class CertificateThumbPrints {
   private static final String SHA_1 = "SHA-1";
   private static final String SHA_256 = "SHA-256";
   private final Certificate certificate;

   public Base64URL computeX5tThumbprint() {
      return this.getThumbPrint(this.certificate, "SHA-1");
   }

   public Base64URL computeX5tS256Thumbprint() {
      return this.getThumbPrint(this.certificate, "SHA-256");
   }

   private Base64URL getThumbPrint(Certificate cert, String alg) {
      try {
         MessageDigest md = MessageDigest.getInstance(alg);
         md.update(cert.getEncoded());
         byte[] digest = md.digest();
         return Base64URL.encode(digest);
      } catch (NoSuchAlgorithmException | CertificateEncodingException e) {
         throw new FailureException("Failed to compute certificate thumbprint", e);
      }
   }

   public static CertificateThumbPrints thumbPrints(Certificate certificate) {
      return new CertificateThumbPrints(certificate);
   }

   @SuppressFBWarnings(justification = "generated code")
   public CertificateThumbPrints(Certificate certificate) {
      this.certificate = certificate;
   }
}