package com.airlock.iam.servicecontainer.app.application.configuration.radius;

import com.airlock.iam.elog.api.ELogger;
import com.airlock.iam.elog.api.ELoggerFactory;
import com.airlock.iam.plugin.api.annotation.config.Plugin;
import com.airlock.iam.plugin.api.annotation.license.PluginLicenseRestriction;
import com.airlock.iam.plugin.api.annotation.property.StringProperty;
import com.airlock.iam.servicecontainer.app.application.configuration.RoleTransformationRuleConfig;
import com.airlock.iam.servicecontainer.app.application.service.radius.wrapper.lib.IamRadiusServerAccessRequest;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
import java.net.InetAddress;
import java.util.List;
import java.util.Optional;
import org.apache.commons.lang3.Strings;

@Plugin(
   description = "This target service is associated with a NAS-IP-Address attribute.<p>The target service is meant to be used if the NAS-IP-Address of the RADIUS client matches the one in the configuration.</p>",
   displayName = "NAS-IP-Address-based Target Service"
)
@PluginLicenseRestriction(moduleAffiliation = "RadiusServer")
public final class NasIpBasedTargetServiceConfig extends TargetServiceConfig {
   private static final ELogger LOG = ELoggerFactory.getLogger(NasIpBasedTargetServiceConfig.class);
   @StringProperty(
      description = "NAS-IP-Address of the RADIUS client.",
      optional = false,
      displayName = "Client NAS-IP-Address",
      exampleValues = "192.168.1.55"
   )
   private String clientNasIp;

   NasIpBasedTargetServiceConfig(String clientNasIp, List<String> requiredRoles, List<RoleTransformationRuleConfig> roleTransformationRules) {
      super(requiredRoles, roleTransformationRules);
      this.clientNasIp = clientNasIp;
   }

   @Override
   public boolean matches(IamRadiusServerAccessRequest request, InetAddress sourceAddress) {
      Optional<InetAddress> nasIpAddress = extractNasIpAddress(request);
      return this.doesClientNasIpMatch(nasIpAddress);
   }

   private static Optional<InetAddress> extractNasIpAddress(IamRadiusServerAccessRequest request) {
      return Optional.ofNullable((InetAddress)request.attributeValue(4));
   }

   private boolean doesClientNasIpMatch(Optional<InetAddress> nasIpAddress) {
      if (nasIpAddress.isEmpty()) {
         LOG.info("RADIUS NAS-IP-Address is not available.");
         return false;
      } else if (Strings.CS.equals(this.clientNasIp, nasIpAddress.get().getHostAddress())) {
         LOG.info("Configured NAS-IP-Address: " + this.clientNasIp + " matches with the RADIUS client NAS-IP-Address.");
         return true;
      } else {
         LOG.debug("No match for RADIUS client with NAS-IP-Address: " + nasIpAddress.get().getHostAddress());
         return false;
      }
   }

   @SuppressFBWarnings(justification = "generated code")
   public static NasIpBasedTargetServiceConfig.NasIpBasedTargetServiceConfigBuilder builder() {
      return new NasIpBasedTargetServiceConfig.NasIpBasedTargetServiceConfigBuilder();
   }

   @SuppressFBWarnings(justification = "generated code")
   public NasIpBasedTargetServiceConfig() {
   }

   @SuppressFBWarnings(justification = "generated code")
   public static class NasIpBasedTargetServiceConfigBuilder {
      @SuppressFBWarnings(justification = "generated code")
      private String clientNasIp;
      @SuppressFBWarnings(justification = "generated code")
      private List<String> requiredRoles;
      @SuppressFBWarnings(justification = "generated code")
      private List<RoleTransformationRuleConfig> roleTransformationRules;

      @SuppressFBWarnings(justification = "generated code")
      NasIpBasedTargetServiceConfigBuilder() {
      }

      @SuppressFBWarnings(justification = "generated code")
      public NasIpBasedTargetServiceConfig.NasIpBasedTargetServiceConfigBuilder clientNasIp(String clientNasIp) {
         this.clientNasIp = clientNasIp;
         return this;
      }

      @SuppressFBWarnings(justification = "generated code")
      public NasIpBasedTargetServiceConfig.NasIpBasedTargetServiceConfigBuilder requiredRoles(List<String> requiredRoles) {
         this.requiredRoles = requiredRoles;
         return this;
      }

      @SuppressFBWarnings(justification = "generated code")
      public NasIpBasedTargetServiceConfig.NasIpBasedTargetServiceConfigBuilder roleTransformationRules(
         List<RoleTransformationRuleConfig> roleTransformationRules
      ) {
         this.roleTransformationRules = roleTransformationRules;
         return this;
      }

      @SuppressFBWarnings(justification = "generated code")
      public NasIpBasedTargetServiceConfig build() {
         return new NasIpBasedTargetServiceConfig(this.clientNasIp, this.requiredRoles, this.roleTransformationRules);
      }

      @SuppressFBWarnings(justification = "generated code")
      @Override
      public String toString() {
         return "NasIpBasedTargetServiceConfig.NasIpBasedTargetServiceConfigBuilder(clientNasIp="
            + this.clientNasIp
            + ", requiredRoles="
            + this.requiredRoles
            + ", roleTransformationRules="
            + this.roleTransformationRules
            + ")";
      }
   }
}