package com.airlock.iam.oauth2.infrastructure.discovery.compatibility;

import com.airlock.iam.oauth2.application.configuration.client.OpenIDConnectDiscoverySignatureValidator;
import com.google.common.collect.Sets;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import java.util.List;
import java.util.Set;

public final class OpenIDConnectConfigurationIdTokenSigningAlgorithms implements OpenIDConnectConfiguration {
   static final String ID_TOKEN_SIGNING_ALGORITHMS_CONFIGURATION_NAME = "id token signing algorithms";

   @Override
   public String getName() {
      return "id token signing algorithms";
   }

   @Override
   public OpenIDConnectCompatibilityResult validate(OIDCProviderMetadata providerMetadata) {
      List<JWSAlgorithm> idTokenJWSAlgorithms = providerMetadata.getIDTokenJWSAlgs();
      if (idTokenJWSAlgorithms == null) {
         return OpenIDConnectCompatibilityResult.withIncompatibility(new OpenIDConnectIncompatibilityMissingConfiguration(this));
      } else {
         Set<JWSAlgorithm> algorithmsFromMetadata = Sets.newHashSet(idTokenJWSAlgorithms);
         if (Sets.intersection(OpenIDConnectDiscoverySignatureValidator.COMPATIBLE_ID_TOKEN_SIGNING_ALGORITHMS, algorithmsFromMetadata).isEmpty()) {
            return OpenIDConnectCompatibilityResult.withIncompatibility(
               new OpenIDConnectIncompatibilityNoneFoundValuesSupported<>(
                  this, OpenIDConnectDiscoverySignatureValidator.COMPATIBLE_ID_TOKEN_SIGNING_ALGORITHMS, idTokenJWSAlgorithms
               )
            );
         } else {
            return !Sets.difference(algorithmsFromMetadata, OpenIDConnectDiscoverySignatureValidator.COMPATIBLE_ID_TOKEN_SIGNING_ALGORITHMS).isEmpty()
               ? OpenIDConnectCompatibilityResult.withWarning(
                  new OpenIDConnectCompatibilityWarningNotAllAlgorithmsSupported(
                     this, OpenIDConnectDiscoverySignatureValidator.COMPATIBLE_ID_TOKEN_SIGNING_ALGORITHMS, idTokenJWSAlgorithms
                  )
               )
               : OpenIDConnectCompatibilityResult.SUCCESS;
         }
      }
   }
}