package com.airlock.iam.oauth2.application.configuration.client;

import com.airlock.iam.base.misc.log.LogUtil;
import com.airlock.iam.elog.api.ELogger;
import com.airlock.iam.elog.api.ELoggerFactory;
import com.airlock.iam.oauth2.domain.model.client.OAuth2ClientSideCredentials;
import com.airlock.iam.oauth2.domain.model.client.communication.OpenIDConnectIdTokenSignatureValidator;
import com.airlock.iam.oauth2.domain.model.token.IdToken;
import com.airlock.iam.plugin.api.annotation.config.Plugin;
import com.airlock.iam.plugin.api.annotation.license.PluginLicenseRestriction;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;

@Plugin(
   description = "OpenID Connect ID Token signature validation plugin which only accepts unsigned ID Tokens (with algorithm 'none').",
   displayName = "OIDC No Signature Validator"
)
@PluginLicenseRestriction(moduleAffiliation = "OAuthClient")
public class OpenIDConnectNoSignatureValidator implements OpenIDConnectIdTokenSignatureValidator {
   private static final ELogger LOG = ELoggerFactory.getLogger(OpenIDConnectNoSignatureValidator.class);

   @Override
   public boolean validateIdTokenSignature(IdToken idToken, OAuth2ClientSideCredentials clientCredentials) {
      if (idToken.isSigned()) {
         LOG.info("ID Token is signed but was expected to be unsigned.");
         return false;
      } else if (!idToken.signatureAlgorithmName().equalsIgnoreCase("none")) {
         LOG.info("ID Token does not have expected signature algorithm \"none\"; but instead has " + LogUtil.quote(idToken.signatureAlgorithmName()));
         return false;
      } else {
         return true;
      }
   }

   @SuppressFBWarnings(justification = "generated code")
   public static OpenIDConnectNoSignatureValidator.OpenIDConnectNoSignatureValidatorBuilder builder() {
      return new OpenIDConnectNoSignatureValidator.OpenIDConnectNoSignatureValidatorBuilder();
   }

   @SuppressFBWarnings(justification = "generated code")
   public static class OpenIDConnectNoSignatureValidatorBuilder {
      @SuppressFBWarnings(justification = "generated code")
      OpenIDConnectNoSignatureValidatorBuilder() {
      }

      @SuppressFBWarnings(justification = "generated code")
      public OpenIDConnectNoSignatureValidator build() {
         return new OpenIDConnectNoSignatureValidator();
      }

      @SuppressFBWarnings(justification = "generated code")
      @Override
      public String toString() {
         return "OpenIDConnectNoSignatureValidator.OpenIDConnectNoSignatureValidatorBuilder()";
      }
   }
}