package com.hfg.webapp.filter.auth;


import java.io.ByteArrayInputStream;
import java.io.File;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.security.KeyPair;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.util.Arrays;
import java.util.Base64;
import java.util.HashSet;
import java.util.Set;
import java.util.logging.Level;
import java.util.logging.Logger;
import java.util.regex.Pattern;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import com.hfg.security.CredentialsMgr;
import com.hfg.security.LoginCredentials;
import com.hfg.units.TimeSpan;
import com.hfg.units.TimeUnit;
import com.hfg.util.*;
import com.hfg.webapp.HfgCookie;
import com.hfg.xml.XMLException;
import com.hfg.xml.XMLTag;

//------------------------------------------------------------------------------
/**
 Base class for LDAP_AuthenticationFilter and GooglePlusAuthenticationFilter.
 <div>
  @author J. Alex Taylor, hairyfatguy.com
 </div>
*/
//------------------------------------------------------------------------------
// com.hfg XML/HTML Coding Library
//
// This library is free software; you can redistribute it and/or
// modify it under the terms of the GNU Lesser General Public
// License as published by the Free Software Foundation; either
// version 2.1 of the License, or (at your option) any later version.
//
// This library is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
// Lesser General Public License for more details.
//
// You should have received a copy of the GNU Lesser General Public
// License along with this library; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
//
// J. Alex Taylor, President, Founder, CEO, COO, CFO, OOPS hairyfatguy.com
// jataylor@hairyfatguy.com
//------------------------------------------------------------------------------

public abstract class AuthenticationFilter implements Filter
{
   private FilterConfig mFilterConfig;
   private String       mAppName;
   private String       mInitialUrl;
   private boolean      mPreserveRequestedUrl = true;
   private boolean      mUseSessionCookie;
   private KeyPair      mECKeyPair;
   private Pattern      mBypassPattern;
   private Set<String>  mAllowedUserDomains;

   // Session attribute keys
   public  static final String SESSION_USER = "SESSION_USER";
   public  static final String STATE        = "STATE";
   public  static final String REDIRECT_URL = "REDIRECT_URL";

   public  static final String AUTH_FILTER  = "authFilter";

   public static final  String BROWSER_SESSION_AUTH_COOKIE_NAME = "com.hfg.auth.session";
   public static final  String AUTH_USERNAME_COOKIE_NAME = "com.hfg.auth.username";

   protected static final String USERNAME  = "username";
   protected static final String PASSWORD  = "password";
   protected static final String DOMAIN    = "domain";
   protected static final String TIMEZONE_OFFSET  = "timezoneOffset";
   protected static final String REMEMBER_USERNAME  = "rememberUsername";


   private static final String ApplicationName    = "ApplicationName";
   private static final String InitialUrl         = "InitialUrl";
   private static final String PreserveRequestedUrl = "PreserveRequestedUrl";
   private static final String UseSessionCookie   = "UseSessionCookie";
   private static final String ECKeyDir           = "ECKeyDir";
   private static final String BypassRegexp       = "BypassRegexp";
   private static final String DomainRestriction  = "DomainRestriction";

   private static final Logger LOGGER = Logger.getLogger(AuthenticationFilter.class.getPackage().getName());

   //###########################################################################
   // PUBLIC METHODS
   //###########################################################################

   //---------------------------------------------------------------------------
   public static UserImpl getUser(HttpServletRequest inRequest)
   {
      if (null == inRequest)
      {
         throw new RuntimeException("Null request provided!");
      }

      return getUser(inRequest.getSession());
   }

   //---------------------------------------------------------------------------
   public static UserImpl getUser(HttpSession inSession)
   {
      if (null == inSession)
      {
         throw new RuntimeException("Null session provided!");
      }

      return (UserImpl) inSession.getAttribute(SESSION_USER);
   }

   //---------------------------------------------------------------------------
   public void init(FilterConfig inFilterConfig)
         throws ServletException
   {
      mFilterConfig = inFilterConfig;

      // Save a reference to this filter in the servlet context. This can be used
      // to provide filter-specific logout instructions.
      mFilterConfig.getServletContext().setAttribute(AUTH_FILTER, this);

      mInitialUrl = inFilterConfig.getInitParameter(InitialUrl);
      if (! StringUtil.isSet(mInitialUrl))
      {
         String msg = "No " + InitialUrl + " init-param defined in the web.xml!";
         LOGGER.log(Level.SEVERE, msg);
         throw new RuntimeException(msg);
      }


      String valueString = inFilterConfig.getInitParameter(PreserveRequestedUrl);
      if (StringUtil.isSet(valueString))
      {
         mPreserveRequestedUrl = BooleanUtil.valueOf(valueString.trim());
      }


      mAppName = inFilterConfig.getInitParameter(ApplicationName);
      if (! StringUtil.isSet(mAppName))
      {
         String msg = "No " + ApplicationName + " init-param defined in the web.xml!";
         LOGGER.log(Level.SEVERE, msg);
         throw new RuntimeException(msg);
      }

      // Optionally, a browser session cookie can be used
      mUseSessionCookie = BooleanUtil.valueOf(inFilterConfig.getInitParameter(UseSessionCookie));
      if (mUseSessionCookie)
      {
         File ecKeyDir = new File(System.getProperty("user.home"));
         // Optionally, a directory containing an elliptic curve key pair for signing
         // a browser session cookie can be specified
         String ecKeyDirPath = inFilterConfig.getInitParameter(ECKeyDir);
         if (StringUtil.isSet(ecKeyDirPath))
         {
            ecKeyDir = new File(ecKeyDirPath.trim());
         }

         mECKeyPair = getECKeyPair(ecKeyDir);

         if (mECKeyPair != null)
         {
            LOGGER.info("LDAP Authorization Filter configured to use EC-signed session cookie");
         }
      }

      // Optionally, a regexp to use for authentication bypass can be specified
      String bypassRegexp = inFilterConfig.getInitParameter(BypassRegexp);
      if (StringUtil.isSet(bypassRegexp))
      {
         mBypassPattern = Pattern.compile(bypassRegexp.trim());
      }

      String domainRestriction = inFilterConfig.getInitParameter(DomainRestriction);
      if (StringUtil.isSet(domainRestriction))
      {
         String[] values = domainRestriction.trim().split("(\\s|;|,)\\s*");
         mAllowedUserDomains = new HashSet<>(Arrays.asList(values));
      }
   }

   //---------------------------------------------------------------------------
   @Override
   public void doFilter(ServletRequest inRequest, ServletResponse inResponse,
                        FilterChain inFilterChain)
         throws IOException, ServletException
   {
       if (getFilterConfig() != null)
       {
           try
           {
               innerDoFilter(inRequest, inResponse, inFilterChain);
           }
           catch (ServletException e)
           {
              throw e;
           }
           catch (Exception e)
           {
              throw new ServletException(e);
           }
       }
   }

   //---------------------------------------------------------------------------
   public void logout(HttpServletRequest inServletRequest, HttpServletResponse inServletResponse)
         throws Exception
   {
      HttpSession session = inServletRequest.getSession();

      session.removeAttribute(SESSION_USER);

      // Expire the cookie. (Won't hurt if it's not in use)
      Cookie cookie = new Cookie(BROWSER_SESSION_AUTH_COOKIE_NAME, "");
      cookie.setPath("/");
      cookie.setMaxAge(0); // Expire now
      inServletResponse.addCookie(cookie);
   }

   //---------------------------------------------------------------------------
   public static HfgCookie getBrowserSessionCookie(HttpServletRequest inRequest)
   {
      HfgCookie authCookie = null;
      Cookie[] cookies = inRequest.getCookies();
      if (cookies != null
          && cookies.length > 0)
      {
         for (Cookie cookie : cookies)
         {
            if (cookie.getName().equals(BROWSER_SESSION_AUTH_COOKIE_NAME))
            {
               authCookie = new HfgCookie(cookie);
               break;
            }
         }
      }

      return authCookie;
   }

   //---------------------------------------------------------------------------
   public FilterConfig getFilterConfig()
   {
      return mFilterConfig;
   }

   //---------------------------------------------------------------------------
   public String getInitialURL()
   {
      return mInitialUrl;
   }

   //---------------------------------------------------------------------------
   public boolean getPreserveRequestedURL()
   {
      return mPreserveRequestedUrl;
   }

   //---------------------------------------------------------------------------
   public String getAppName()
   {
      return mAppName;
   }

   //---------------------------------------------------------------------------
   public boolean getUseSessionCookie()
   {
      return mUseSessionCookie;
   }

   //---------------------------------------------------------------------------
   public KeyPair getECKeyPair()
   {
      return mECKeyPair;
   }

   //---------------------------------------------------------------------------
   public Pattern getBypassPattern()
   {
      return mBypassPattern;
   }

   //---------------------------------------------------------------------------
   public Set<String> getAllowedUserDomains()
   {
      return mAllowedUserDomains;
   }

   //---------------------------------------------------------------------------
   public boolean isAllowedUserDomain(String inValue)
   {
      return null == mAllowedUserDomains || mAllowedUserDomains.contains(inValue);
   }

   //###########################################################################
   // PROTECTED METHODS
   //###########################################################################

   //---------------------------------------------------------------------------
   protected abstract void innerDoFilter(ServletRequest inRequest, ServletResponse inResponse,
                                FilterChain inFilterChain)
         throws Exception;

   //---------------------------------------------------------------------------
   protected static KeyPair getECKeyPair(File inKeyDir)
   {
      KeyPair keyPair = null;

      boolean createNewKeys = false;
      File keyDir = inKeyDir;
      if (! keyDir.exists())
      {
         LOGGER.warning("The specified " + ECKeyDir + ", " + StringUtil.singleQuote(inKeyDir.getPath()) + " does not exist!");
         createNewKeys = true;
      }
      else
      {
         File publicKeyFile = new File(keyDir, "ECPublic.key");
         if (! publicKeyFile.exists())
         {
            LOGGER.warning("The public key file " + StringUtil.singleQuote(publicKeyFile.getPath()) + " does not exist!");
            createNewKeys = true;
         }
         else if (! publicKeyFile.canRead())
         {
            LOGGER.warning("The public key file " + StringUtil.singleQuote(publicKeyFile.getPath()) + " is not readable by the user executing the app server!");
            createNewKeys = true;
         }

         File privateKeyFile = new File(keyDir, "ECPrivate.key");
         if (! privateKeyFile.exists())
         {
            LOGGER.warning("The private key file " + StringUtil.singleQuote(privateKeyFile.getPath()) + " does not exist!");
            createNewKeys = true;
         }
         else if (! publicKeyFile.canRead())
         {
            LOGGER.warning("The private key file " + StringUtil.singleQuote(privateKeyFile.getPath()) + " is not readable by the user executing the app server!");
            createNewKeys = true;
         }

         try
         {
            PublicKey publicKey = CryptoUtil.readPublicEllipticCurveKeyFile(publicKeyFile);
            PrivateKey privateKey = CryptoUtil.readPrivateEllipticCurveKeyFile(privateKeyFile);

            keyPair = new KeyPair(publicKey, privateKey);
         }
         catch (Exception e)
         {
            LOGGER.warning("Problem reading the EC key files: " + e.getMessage());
            createNewKeys = true;
         }
      }

      if (createNewKeys)
      {
         if (! keyDir.exists())
         {
            keyDir = new File(System.getProperty("user.dir"));
         }

         try
         {
            keyPair = CryptoUtil.generateEllipticCurveKeyPair();
            CryptoUtil.writePublicEllipticCurveKeyToFile(keyPair.getPublic(), new File(keyDir, "ECPublic.key"));
            CryptoUtil.writePrivateEllipticCurveKeyToFile(keyPair.getPrivate(), new File(keyDir, "ECPrivate.key"));
            LOGGER.warning("New EC keys created in " + StringUtil.singleQuote(keyDir.getPath()) + ".");
         }
         catch (Exception e)
         {
            LOGGER.warning("Could not create EC keys in directory " + StringUtil.singleQuote(keyDir.getPath()) + "!");
            keyPair = null;
         }
      }


      return keyPair;
   }

   //---------------------------------------------------------------------------
   protected boolean browserSessionCookieIsValid(HfgCookie inSessionCookie)
      throws Exception
   {
      boolean result = false;

      if (inSessionCookie != null
          && mECKeyPair != null)
      {
         String cookieValue = getBrowserSessionCookieValue(inSessionCookie);
         int sigIndex = cookieValue.indexOf("Sig:");
         if (sigIndex > 0)
         {
            String cookieData = cookieValue.substring(0, sigIndex);
            byte[] signature = Base64.getDecoder().decode(cookieValue.substring(sigIndex + 4));

            result = CryptoUtil.verifySignatureWithECDSA(mECKeyPair.getPublic(), cookieData, signature);
         }
      }

      return result;
   }

   //---------------------------------------------------------------------------
   protected HfgCookie generateBrowserSessionCookie(UserImpl inUser)
         throws Exception
   {
      HfgCookie cookie = null;

      if (mECKeyPair != null)
      {
         String data = inUser.toXMLTag().toXML();
         byte[] signature = CryptoUtil.generateSignatureWithECDSA(mECKeyPair.getPrivate(), data);

         // Create the Base64-encoded cookie
         String cookieValue = Base64.getEncoder().encodeToString((data + "Sig:" + Base64.getEncoder().encodeToString(signature)).getBytes());

         cookie = new HfgCookie(BROWSER_SESSION_AUTH_COOKIE_NAME, cookieValue);
         cookie.setPath("/");
         cookie.setMaxAge(-1); // Expire at the end of the browser session
      }

      return cookie;
   }

   //---------------------------------------------------------------------------
   protected static UserImpl createUserObjFromBrowserSessionCookie(HfgCookie inSessionCookie)
         throws XMLException, IOException
   {
      UserImpl user = null;

      String cookieValue = getBrowserSessionCookieValue(inSessionCookie);
      int sigIndex = cookieValue.indexOf("Sig:");
      if (sigIndex > 0)
      {
         String cookieData = cookieValue.substring(0, sigIndex);

         XMLTag xmlTag = new XMLTag(new ByteArrayInputStream(cookieData.getBytes()));
         user = new UserImpl(xmlTag);
      }

      return user;
   }

   //---------------------------------------------------------------------------
   private static String getBrowserSessionCookieValue(HfgCookie inCookie)
   {
      String value = null;

      if (inCookie != null)
      {
         try
         {
            String urlDecodedCookieValue = inCookie.getValue();
            if(inCookie.getValue().contains("%"))
            {
               //percent sign indicates that the current value has been encoded.
               urlDecodedCookieValue = URLDecoder.decode(inCookie.getValue(), "UTF-8");
            }
            value = new String(Base64.getDecoder().decode(urlDecodedCookieValue));
         }
         catch (Exception e)
         {
            // Backwards-compatibility with the un-Base64 version of the cookie. Just in case.
            value = inCookie.getDecodedValue();
         }
      }

      return value;
   }

   //---------------------------------------------------------------------------
   protected HfgCookie generateAuthUsernameCookie(String inUsername, String inDomain)
         throws Exception
   {
      HfgCookie cookie = null;

      StringBuilderPlus cookieValue = new StringBuilderPlus().setDelimiter(";")
                                                             .append(USERNAME + "=" + inUsername)
                                                             .delimitedAppend(DOMAIN + "=" + inDomain);

      cookie = new HfgCookie(AUTH_USERNAME_COOKIE_NAME, cookieValue.toString());
      cookie.setPath("/");
      cookie.setMaxAge(new TimeSpan(6, "months").convertTo(TimeUnit.second).intValue()); // Expire in 6 months

      return cookie;
   }

   //---------------------------------------------------------------------------
   public static HfgCookie getAuthUsernameCookie(HttpServletRequest inRequest)
   {
      HfgCookie authCookie = null;
      Cookie[] cookies = inRequest.getCookies();
      if (cookies != null
            && cookies.length > 0)
      {
         for (Cookie cookie : cookies)
         {
            if (cookie.getName().equals(AUTH_USERNAME_COOKIE_NAME))
            {
               authCookie = new HfgCookie(cookie);
               break;
            }
         }
      }

      return authCookie;
   }

   //---------------------------------------------------------------------------
   protected static LoginCredentials getAuthUsernameCookieValue(HfgCookie inCookie)
   {
      LoginCredentials credentials = null;

      if (inCookie != null)
      {
         String urlDecodedCookieValue = inCookie.getValue();
         if (inCookie.getValue().contains("%"))
         {
            try
            {
               //percent sign indicates that the current value has been encoded.
               urlDecodedCookieValue = URLDecoder.decode(inCookie.getValue(), "UTF-8");
            }
            catch (UnsupportedEncodingException e)
            {
               throw new RuntimeException(e);
            }
         }

         credentials = new LoginCredentials(null, null);

         String[] pieces = urlDecodedCookieValue.split(";");
         for (String piece : pieces)
         {
            String[] fields = piece.split("=");
            if (fields[0].equals(USERNAME))
            {
               credentials.setUser(fields[1]);
            }
            else if (fields[0].equals(DOMAIN))
            {
               credentials.setDomain(fields[1]);
            }
         }
      }

      return credentials;
   }

}