// Copyright 2015 The Vanadium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package io.v.baku.toolkit.blessings;

import android.content.Context;
import android.content.SharedPreferences;
import android.preference.PreferenceManager;
import android.util.Base64;
import android.util.JsonReader;

import com.google.common.base.Strings;
import com.google.common.collect.Collections2;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSet;
import com.google.common.collect.Maps;

import java.io.IOException;
import java.io.InputStreamReader;
import java.net.MalformedURLException;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.security.interfaces.ECPublicKey;
import java.util.ArrayList;
import java.util.List;
import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

import io.v.android.v23.V;
import io.v.impl.google.naming.NamingUtil;
import io.v.v23.context.VContext;
import io.v.v23.security.BlessingPattern;
import io.v.v23.security.BlessingRoots;
import io.v.v23.security.Blessings;
import io.v.v23.security.CryptoUtil;
import io.v.v23.security.VPrincipal;
import io.v.v23.security.VSecurity;
import io.v.v23.security.access.AccessList;
import io.v.v23.security.access.Constants;
import io.v.v23.security.access.Permissions;
import io.v.v23.security.access.Tag;
import io.v.v23.verror.VException;
import io.v.v23.vom.VomUtil;
import java8.util.stream.Collectors;
import java8.util.stream.Stream;
import java8.util.stream.StreamSupport;
import lombok.experimental.UtilityClass;
import lombok.extern.slf4j.Slf4j;

/**
 * Common utilities for blessing and ACL management. In the future, we may want to factor these out
 * of Baku into the V23 Java libraries.
 */
@Slf4j
@UtilityClass
public class BlessingsUtils {
    public static final String
            PREF_BLESSINGS = "VanadiumBlessings",
            GLOBAL_BLESSING_ROOT_URL = "https://dev.v.io/auth/blessing-root";
    public static final Pattern DEV_V_IO_CLIENT_USER =
            Pattern.compile("dev\\.v\\.io:o:([^:]+):([^:]+).*");

    public static final AccessList OPEN_ACL = new AccessList(
            ImmutableList.of(new BlessingPattern("...")), ImmutableList.of());

    public static final ImmutableSet<Tag>
            DATA_TAGS = ImmutableSet.of(Constants.READ, Constants.WRITE, Constants.ADMIN),
            MOUNT_TAGS = ImmutableSet.of(Constants.READ, Constants.RESOLVE, Constants.ADMIN),
            SYNCGROUP_TAGS = ImmutableSet.of(Constants.READ, Constants.WRITE, Constants.RESOLVE,
                    Constants.ADMIN, Constants.DEBUG);

    public static final Permissions
            OPEN_DATA_PERMS = dataPermissions(OPEN_ACL),
            OPEN_MOUNT_PERMS = mountPermissions(OPEN_ACL);

    public static void writeSharedPrefs(final Context context, final Blessings blessings)
            throws VException {
        writeSharedPrefs(PreferenceManager.getDefaultSharedPreferences(context), PREF_BLESSINGS,
                blessings);
    }

    public static void writeSharedPrefs(final SharedPreferences prefs, final String key,
                                        final Blessings blessings) throws VException {
        prefs.edit().putString(key, VomUtil.encodeToString(blessings, Blessings.class)).apply();
    }

    public static Blessings readSharedPrefs(final Context context) throws VException {
        return readSharedPrefs(PreferenceManager.getDefaultSharedPreferences(context),
                PREF_BLESSINGS);
    }

    public static Blessings readSharedPrefs(final SharedPreferences prefs, final String key)
            throws VException {
        final String blessingsVom = prefs.getString(key, "");
        return Strings.isNullOrEmpty(blessingsVom) ? null : decodeBlessings(blessingsVom);
    }

    public static Blessings decodeBlessings(final String blessings) throws VException {
        return (Blessings) VomUtil.decodeFromString(blessings, Blessings.class);
    }

    public static Blessings decodeBlessings(final byte[] blessings) throws VException {
        return (Blessings) VomUtil.decode(blessings, Blessings.class);
    }

    public static Set<String> getBlessingNames(final VContext ctx, final Blessings blessings) {
        return ImmutableSet.copyOf(VSecurity.getBlessingNames(V.getPrincipal(ctx), blessings));
    }

    public static AccessList blessingsToAcl(final VContext ctx, final Blessings blessings) {
        return new AccessList(ImmutableList.copyOf(Collections2.transform(
                getBlessingNames(ctx, blessings),
                s -> new BlessingPattern(s))), //method reference confuses Android Studio
                ImmutableList.of());
    }

    /**
     * This method adds the given {@link BlessingPattern} to the given {@link AccessList} but does
     * not perform deduping or checking to make sure the new pattern is not in
     * {@link AccessList#getNotIn()}.
     */
    public static AccessList augmentAcl(final AccessList acl, final BlessingPattern newBlessing) {
        return new AccessList(ImmutableList.<BlessingPattern>builder()
                .addAll(acl.getIn())
                .add(newBlessing).build(),
                ImmutableList.of());
    }

    public static Stream<ClientUser> blessingsToClientUserStream(final VContext ctx,
                                                                 final Blessings blessings) {
        return StreamSupport.stream(getBlessingNames(ctx, blessings))
                .map(DEV_V_IO_CLIENT_USER::matcher)
                .filter(Matcher::matches)
                .map(m -> new ClientUser(m.group(1), m.group(2)));
    }

    /**
     * This method finds and parses all blessings of the form dev.v.io/o/....
     */
    public static Set<ClientUser> blessingsToClientUsers(
            final VContext ctx, final Blessings blessings) {
        return blessingsToClientUserStream(ctx, blessings).collect(Collectors.toSet());
    }

    public static String userMount(final String username) {
        return NamingUtil.join("users", username);
    }

    public static String clientMount(final String clientId) {
        return NamingUtil.join("tmp", "clients", clientId);
    }

    public static Stream<String> blessingsToClientMountStream(final VContext ctx,
                                                              final Blessings blessings) {
        return blessingsToClientUserStream(ctx, blessings)
                .map(cu -> BlessingsUtils.clientMount(cu.getClientId()));
    }

    public static Set<String> blessingsToClientMounts(final VContext ctx,
                                                      final Blessings blessings) {
        return blessingsToClientMountStream(ctx, blessings).collect(Collectors.toSet());
    }

    public static Permissions homogeneousPermissions(final Set<Tag> tags, final AccessList acl) {
        return new Permissions(Maps.toMap(Collections2.transform(tags, Tag::getValue), x -> acl));
    }

    public static Permissions dataPermissions(final AccessList acl) {
        return homogeneousPermissions(DATA_TAGS, acl);
    }

    public static Permissions mountPermissions(final AccessList acl) {
        return homogeneousPermissions(MOUNT_TAGS, acl);
    }

    public static Permissions syncgroupPermissions(final AccessList acl) {
        return homogeneousPermissions(SYNCGROUP_TAGS, acl);
    }

    /**
     * TODO(rosswang): This probably won't be best practice in the long run, but we'll need it until
     * we can bless the cloud Syncbase instance remotely.
     */
    public static Permissions cloudSyngroupPermissions(final AccessList userAcl,
                                                       final BlessingPattern sgHostBlessing) {
        final AccessList cloudAcl = augmentAcl(userAcl, sgHostBlessing);
        return new Permissions(ImmutableMap.of(
                Constants.ADMIN.getValue(), cloudAcl,
                Constants.READ.getValue(), cloudAcl,
                Constants.WRITE.getValue(), userAcl,
                Constants.RESOLVE.getValue(), userAcl,
                Constants.DEBUG.getValue(), userAcl
        ));
    }

    /**
     * Standard blessing handling for Vanadium applications:
     * <ul>
     * <li>Provide the given blessings when anybody connects to us.</li>
     * <li>Provide these blessings when we connect to other services (for example, when we talk
     * to the mounttable).</li>
     * <li>Trust these blessings and all the "parent" blessings.</li>
     * </ul>
     */
    public static void assumeBlessings(final VContext vContext, final Blessings blessings)
            throws VException {
        log.info("Assuming blessings: " + blessings);
        final VPrincipal principal = V.getPrincipal(vContext);
        principal.blessingStore().setDefaultBlessings(blessings);
        principal.blessingStore().set(blessings, new BlessingPattern("..."));
        VSecurity.addToRoots(principal, blessings);
    }

    public static void addGlobalBlessingRoots(final VContext vContext)
            throws IOException, VException {
        final URL url;
        try {
            url = new URL(GLOBAL_BLESSING_ROOT_URL);
        } catch (final MalformedURLException e) {
            throw new RuntimeException(e);
        }

        ECPublicKey publicKey = null;
        final List<BlessingPattern> names = new ArrayList<>();

        try (final JsonReader json = new JsonReader(
                new InputStreamReader(url.openStream(), StandardCharsets.US_ASCII))) {
            json.beginObject();
            while (json.hasNext()) {
                final String name = json.nextName();
                if ("publicKey".equals(name)) {
                    final String strKey = json.nextString();
                    final byte[] binKey = Base64.decode(strKey.getBytes(StandardCharsets.US_ASCII),
                            Base64.URL_SAFE);
                    publicKey = CryptoUtil.decodeECPublicKey(binKey);
                } else if ("names".equals(name)) {
                    json.beginArray();
                    while (json.hasNext()) {
                        names.add(new BlessingPattern(json.nextString()));
                    }
                    json.endArray();
                } else {
                    json.skipValue();
                }
            }
        }

        if (publicKey != null) {
            final BlessingRoots roots = V.getPrincipal(vContext).roots();
            for (final BlessingPattern name : names) {
                log.info("Adding global blessing root " + name);
                roots.add(publicKey, name);
            }
        } else {
            log.warn("No global blessing roots found");
        }
    }
}