/*
 * Licensed to the University Corporation for Advanced Internet Development,
 * Inc. (UCAID) under one or more contributor license agreements.  See the
 * NOTICE file distributed with this work for additional information regarding
 * copyright ownership. The UCAID licenses this file to You under the Apache
 * License, Version 2.0 (the "License"); you may not use this file except in
 * compliance with the License.  You may obtain a copy of the License at
 *
 *    http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package net.shibboleth.utilities.java.support.security;

import java.util.Enumeration;
import java.util.function.Predicate;

import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.servlet.ServletRequest;
import javax.servlet.http.HttpServletRequest;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.google.common.net.HttpHeaders;

import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.primitive.StringSupport;

/**
 * Access control implementation based on pre-shared API keys in the HTTP Authorization header or query parameters.
 */
public class APIKeyAccessControl  extends AbstractIdentifiableInitializableComponent implements AccessControl{
    
    
   /** Class logger. */
    @Nonnull private final Logger log = LoggerFactory.getLogger(APIKeyAccessControl.class);
    
    /** The API key to match in the request. */
    @NonnullAfterInit @NotEmpty private String apiKey;
    
    /** The HTTP Authorization scheme name.*/
    @Nonnull @NotEmpty public static final String API_KEY_HEADER_SCHEME="SHIB-API-KEY";
    
    /** The API key query parameter name.  */
    @Nonnull @NotEmpty public static final String API_KEY_PARAM_NAME="shibapikey";
    
    /** Whether API key has sufficient entropy, or conforms to a specific policy? */
    @Nonnull private Predicate<String> apiKeyValidationPolicyPredicate;
    
    /** Where the API key can be found in the request.   */
    public enum APIKeyIn{
        /** The API Key is contained in the HTTP Authorization header. */
        HEADER,
        /** The API Key is contained in a query string parameter. */
        QUERY,
    }
    
    /** Where the API key can be found in the request. Default is HEADER.*/
    @Nonnull private APIKeyIn apiKeyIn;
    
    /**
     * 
     * Constructor.
     *
     */
    public APIKeyAccessControl() {      
        apiKeyIn = APIKeyIn.HEADER;
        apiKeyValidationPolicyPredicate = new LengthBasedAPIKeyPolicyValidator();
    }
    
    @Override protected void doInitialize() throws ComponentInitializationException { 

        if (apiKey == null) {
            throw new ComponentInitializationException("API Key cannot be null");
        }
        
       if (!apiKeyValidationPolicyPredicate.test(apiKey)) {           
           throw new ComponentInitializationException("API Key does not satisfy validation policy");
       }
    
    }
    
    /**
     * Set the API key validation policy.
     * 
     * @param keyPolicy the API key validation policy.
     */
    public void setApiKeyValidationPolicyPredicate(@Nonnull final Predicate<String> keyPolicy) {
        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
        apiKeyValidationPolicyPredicate = Constraint.isNotNull(keyPolicy, "API key validation policy must not be null");
    }
    
    /**
     * Set the API Key.
     * 
     * @param key the API key, can not be {@literal null} or {@literal empty}.
     */
    public void setApiKey(@Nonnull @NotEmpty final String key) {
        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);             
        apiKey = Constraint.isNotEmpty(key, "API Key cannot be null or empty");
    }
    
    /**
     * Sets where to find the API key, either the HTTP header or the query parameters.
     * 
     * @param keyIn where to find the API key.
     */
    public void setApiKeyIn(@Nonnull final APIKeyIn keyIn) {
        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
        apiKeyIn = Constraint.isNotNull(keyIn, "API Key In (Header or Query Parameters) can not be null");
    }

    /** {@inheritDoc} */
    @Nonnull public boolean checkAccess(@Nonnull final ServletRequest request, @Nullable final String operation,
            @Nullable final String resource) {
      
       final String addr = request.getRemoteAddr()!=null ? request.getRemoteAddr():"unknown";

       if (request instanceof HttpServletRequest) {
           final HttpServletRequest httpRequest = (HttpServletRequest) request;  
           
          String requestApiKey = null;
           
           if (APIKeyIn.HEADER == apiKeyIn) {       
       
               requestApiKey = extractApiKeyFromHeaders(httpRequest);  
               
           } else if (APIKeyIn.QUERY == apiKeyIn) {              
               
               requestApiKey = extractApiKeyFromParameters(httpRequest);             
           }             
           if (apiKey.equals(requestApiKey)) {
               log.debug("{} Granted access to client [{}] using matching API key (Operation: {}, Resource: {})",
                       new Object[] {getLogPrefix(), addr, operation, resource});
               return true;
           }else {
               log.debug("{} Denied request from client [{}], API keys do not match (Operation: {}, Resource: {})",
                       new Object[] {getLogPrefix(), addr, operation, resource});
               return false;
           }
           
       } else {
           log.warn("{} Denied request from client [{}], request is not a HTTP request (Operation: {}, Resource: {})",
                  getLogPrefix(),addr, operation, resource);
           return false;
       }
       
      
       
    }
    
    /**
     * Gets the API key passed in via the HTTP parameters. Only one API key value is expected.
     *  
     * @param httpRequest current HTTP request
     * @return the API key, or {@literal null}
     */
    @Nullable private String extractApiKeyFromParameters(@Nonnull final HttpServletRequest httpRequest) {
        
        final String[] apiKeyValues = httpRequest.getParameterValues(API_KEY_PARAM_NAME);
      
        if (apiKeyValues==null || apiKeyValues.length!=1) {
            log.warn("{} One API key parameter expected, has {}",
                    getLogPrefix(),apiKeyValues==null?"none":apiKeyValues.length);
            return null;
        }
        
        return StringSupport.trimOrNull(apiKeyValues[0]);
       
    }
    
    /**
     * Gets the API key passed in via the {@link HttpHeaders#AUTHORIZATION} header. This method checks to
     * ensure that the authentication scheme is {@link #API_KEY_HEADER_SCHEME} and then strips off
     * and returns the follow on key. Extracts the first of such found.
     * 
     * @param httpRequest current HTTP request
     * 
     * @return the API key, or {@literal null}
     */
    @Nullable private String extractApiKeyFromHeaders(@Nonnull final HttpServletRequest httpRequest) {
        
        final Enumeration<String> header = httpRequest.getHeaders(HttpHeaders.AUTHORIZATION);
        
        while (header.hasMoreElements()) {
            final String[] splitValue = header.nextElement().split(" ");
            if (splitValue.length == 2) {
                final String authnScheme = StringSupport.trimOrNull(splitValue[0]);
                if (API_KEY_HEADER_SCHEME.equalsIgnoreCase(authnScheme)) {
                    return StringSupport.trimOrNull(splitValue[1]);
                }
            }
        }
        
        
        log.debug("{} No appropriate Authorization header found", getLogPrefix());
        return null;
    }
    
    
    /**
     * Get logging prefix.
     * 
     * @return  prefix
     */
    @Nonnull private String getLogPrefix() {
        return "Policy " + getId() + ":";
    }
    
    /**
     * Simple, default, API key validator. Requires the key to be >= 9 characters.
     */
    class LengthBasedAPIKeyPolicyValidator implements Predicate<String>{

        /** {@inheritDoc} */
        @Nonnull public boolean test(@Nullable final String key) {
            if (StringSupport.trimOrNull(key)==null) {
                return false;
            }
            if (key.length()>=9) {
                return true;
            }
            return false;
        }
        
    }

}