/**
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements. See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership. The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License. You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied. See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
package org.apache.cxf.rs.security.oauth.services;

import java.io.IOException;
import java.net.URI;
import java.util.HashMap;
import java.util.Map;
import java.util.UUID;
import java.util.logging.Level;
import java.util.logging.Logger;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.UriBuilder;

import net.oauth.OAuth;
import net.oauth.OAuthMessage;
import net.oauth.OAuthProblemException;

import org.apache.cxf.common.logging.LogUtils;
import org.apache.cxf.common.util.StringUtils;
import org.apache.cxf.rs.security.oauth.data.OAuthAuthorizationData;
import org.apache.cxf.rs.security.oauth.data.RequestToken;
import org.apache.cxf.rs.security.oauth.provider.DefaultOAuthValidator;
import org.apache.cxf.rs.security.oauth.provider.OAuthDataProvider;
import org.apache.cxf.rs.security.oauth.utils.OAuthConstants;
import org.apache.cxf.rs.security.oauth.utils.OAuthUtils;


public class AuthorizationRequestHandler {

    private static final Logger LOG = LogUtils.getL7dLogger(AuthorizationRequestHandler.class);
    private static final String[] REQUIRED_PARAMETERS = 
        new String[] {
            OAuth.OAUTH_TOKEN
        };
    
    public Response handle(HttpServletRequest request, OAuthDataProvider dataProvider) {

        try {
            OAuthMessage oAuthMessage = 
                OAuthUtils.getOAuthMessage(request, REQUIRED_PARAMETERS);
            new DefaultOAuthValidator().checkSingleParameter(oAuthMessage);

            RequestToken token = dataProvider.getRequestToken(oAuthMessage.getToken());
            if (token == null) {
                throw new OAuthProblemException(OAuth.Problems.TOKEN_REJECTED);
            }
            
            OAuthAuthorizationData secData = new OAuthAuthorizationData();
            if (!compareRequestSessionTokens(request, oAuthMessage)) {
                addAuthenticityTokenToSession(secData, request);
                return Response.ok(
                        addAdditionalParams(secData, dataProvider, token)).build();
            }
            
            String decision = oAuthMessage.getParameter(OAuthConstants.AUTHORIZATION_DECISION_KEY);
            boolean allow = OAuthConstants.AUTHORIZATION_DECISION_ALLOW.equals(decision);

            Map<String, String> queryParams = new HashMap<String, String>();
            if (allow) {
                String verifier = dataProvider.setRequestTokenVerifier(token);
                queryParams.put(OAuth.OAUTH_VERIFIER, verifier);
            } else {
                dataProvider.removeToken(token);
            }
            queryParams.put(OAuth.OAUTH_TOKEN, token.getTokenKey());
            if (token.getState() != null) {
                queryParams.put("state", token.getState());
            }
            URI callback = buildCallbackURI(getCallbackURI(token), queryParams);
            return Response.seeOther(callback).build();
            
        } catch (OAuthProblemException e) {
            if (LOG.isLoggable(Level.WARNING)) {
                LOG.log(Level.WARNING, "An OAuth related problem: {0}", new Object[]{e.fillInStackTrace()});
            }
            return OAuthUtils.handleException(e, e.getHttpStatusCode(),
                    String.valueOf(e.getParameters().get("realm")));
        } catch (Exception e) {
            if (LOG.isLoggable(Level.SEVERE)) {
                LOG.log(Level.SEVERE, "Server exception: {0}", new Object[]{e.fillInStackTrace()});
            }
            return OAuthUtils.handleException(e, HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
        }
    }

    protected String getCallbackURI(RequestToken token) throws OAuthProblemException {
        String callback = token.getCallback();
        if (callback == null) {
            callback = token.getClient().getApplicationURI();
        }
        if (callback == null) {
            throw new OAuthProblemException(OAuth.Problems.TOKEN_REJECTED);
        }
        return callback;
    }
    
    private URI buildCallbackURI(String callback, final Map<String, String> queryParams) {

        UriBuilder builder = UriBuilder.fromUri(callback);
        for (Map.Entry<String, String> entry : queryParams.entrySet()) {
            builder.queryParam(entry.getKey(), entry.getValue());
        }

        return builder.build(); 
    }
    
    protected OAuthAuthorizationData addAdditionalParams(OAuthAuthorizationData secData,
                                                         OAuthDataProvider dataProvider,
                                                         RequestToken token) {
        secData.setOauthToken(token.getTokenKey());
        secData.setApplicationName(token.getClient().getApplicationName()); 
        secData.setApplicationURI(token.getClient().getApplicationURI());
        
        secData.setPermissions(
                dataProvider.getPermissionsInfo(token.getScopes()));
        secData.setUris(token.getUris());
        
        return secData;
    }
    
    private void addAuthenticityTokenToSession(OAuthAuthorizationData secData,
            HttpServletRequest request) {
        HttpSession session = request.getSession();
        String value = UUID.randomUUID().toString();
        
        secData.setAuthenticityToken(value);
        session.setAttribute(OAuthConstants.AUTHENTICITY_TOKEN, value);
    }
    
    private boolean compareRequestSessionTokens(HttpServletRequest request,
            OAuthMessage oAuthMessage) {
        HttpSession session = request.getSession();
        String requestToken = null; 
        try {
            requestToken = oAuthMessage.getParameter(OAuthConstants.AUTHENTICITY_TOKEN);
        } catch (IOException ex) {
            return false;
        }
        String sessionToken = (String) session.getAttribute(OAuthConstants.AUTHENTICITY_TOKEN);
        
        if (StringUtils.isEmpty(requestToken) || StringUtils.isEmpty(sessionToken)) {
            return false;
        }
        
        boolean b = requestToken.equals(sessionToken);
        session.removeAttribute(OAuthConstants.AUTHENTICITY_TOKEN);
        return b;
    }
}
