package com.airlock.iam.oauth2.application.configuration.tokenexchange;

import com.airlock.iam.oauth2.application.configuration.OAuth2IssuerIdConfig;
import com.airlock.iam.plugin.api.annotation.config.Plugin;
import com.airlock.iam.plugin.api.annotation.license.PluginLicenseRestriction;
import com.airlock.iam.plugin.api.annotation.property.PluginListProperty;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
import java.util.List;

@Plugin(
   description = "Requires a subject token to be present in the token exchange request, but does not check the signature.\nTokens are expected to have at least the following claims: <tt>iss</tt> <tt>sub</tt>. If present, the claims <tt>exp</tt> and <tt>nbf</tt> are validated.<br>\n<b>Caution</b>: JWT tokens with <tt>alg=none</tt> are accepted: This may be a security risk.",
   displayName = "Subject Token Unsigned Claims Extractor"
)
@PluginLicenseRestriction(moduleAffiliation = "OAuthTokenExchange")
public final class OAuth2SubjectTokenUnsignedClaimsExtractorConfig implements OAuth2SubjectTokenValidationConfig {
   @PluginListProperty(
      description = "Only tokens issued by these issuers can be exchanged at the endpoint. If left empty, all issuers are allowed.",
      optional = true
   )
   private List<OAuth2IssuerIdConfig> allowedTokenIssuers;

   public List<OAuth2IssuerIdConfig> getAllowedTokenIssuers() {
      return this.allowedTokenIssuers;
   }

   @SuppressFBWarnings(justification = "generated code")
   public static OAuth2SubjectTokenUnsignedClaimsExtractorConfig.OAuth2SubjectTokenUnsignedClaimsExtractorConfigBuilder builder() {
      return new OAuth2SubjectTokenUnsignedClaimsExtractorConfig.OAuth2SubjectTokenUnsignedClaimsExtractorConfigBuilder();
   }

   @SuppressFBWarnings(justification = "generated code")
   public OAuth2SubjectTokenUnsignedClaimsExtractorConfig() {
   }

   @SuppressFBWarnings(justification = "generated code")
   public OAuth2SubjectTokenUnsignedClaimsExtractorConfig(List<OAuth2IssuerIdConfig> allowedTokenIssuers) {
      this.allowedTokenIssuers = allowedTokenIssuers;
   }

   @SuppressFBWarnings(justification = "generated code")
   public static class OAuth2SubjectTokenUnsignedClaimsExtractorConfigBuilder {
      @SuppressFBWarnings(justification = "generated code")
      private List<OAuth2IssuerIdConfig> allowedTokenIssuers;

      @SuppressFBWarnings(justification = "generated code")
      OAuth2SubjectTokenUnsignedClaimsExtractorConfigBuilder() {
      }

      @SuppressFBWarnings(justification = "generated code")
      public OAuth2SubjectTokenUnsignedClaimsExtractorConfig.OAuth2SubjectTokenUnsignedClaimsExtractorConfigBuilder allowedTokenIssuers(
         List<OAuth2IssuerIdConfig> allowedTokenIssuers
      ) {
         this.allowedTokenIssuers = allowedTokenIssuers;
         return this;
      }

      @SuppressFBWarnings(justification = "generated code")
      public OAuth2SubjectTokenUnsignedClaimsExtractorConfig build() {
         return new OAuth2SubjectTokenUnsignedClaimsExtractorConfig(this.allowedTokenIssuers);
      }

      @SuppressFBWarnings(justification = "generated code")
      @Override
      public String toString() {
         return "OAuth2SubjectTokenUnsignedClaimsExtractorConfig.OAuth2SubjectTokenUnsignedClaimsExtractorConfigBuilder(allowedTokenIssuers="
            + this.allowedTokenIssuers
            + ")";
      }
   }
}