/*
 * Copyright 2018 A-SIT Plus GmbH
 * AT-specific eIDAS Connector has been developed in a cooperation between EGIZ,
 * A-SIT Plus GmbH, A-SIT, and Graz University of Technology.
 *
 * Licensed under the EUPL, Version 1.2 or - as soon they will be approved by
 * the European Commission - subsequent versions of the EUPL (the "License");
 * You may not use this work except in compliance with the License.
 * You may obtain a copy of the License at:
 * https://joinup.ec.europa.eu/news/understanding-eupl-v12
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" basis,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * This product combines work with different licenses. See the "NOTICE" text
 * file for details on the various modules and licenses.
 * The "NOTICE" text file is part of the distribution. Any derivative works
 * that you distribute must include a readable copy of the "NOTICE" text file.
*/

package at.gv.egiz.eaaf.modules.pvp2.impl.validation.metadata;

import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.List;

import javax.annotation.Nonnull;

import org.opensaml.saml.common.SignableSAMLObject;
import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
import org.opensaml.saml.security.impl.SAMLSignatureProfileValidator;
import org.opensaml.security.x509.BasicX509Credential;
import org.opensaml.xmlsec.signature.support.SignatureException;
import org.opensaml.xmlsec.signature.support.SignatureValidator;

import at.gv.egiz.eaaf.core.exceptions.EaafConfigurationException;
import at.gv.egiz.eaaf.core.exceptions.EaafException;
import at.gv.egiz.eaaf.core.impl.credential.EaafKeyStoreUtils;
import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2MetadataException;
import at.gv.egiz.eaaf.modules.pvp2.exception.SamlMetadataSignatureException;
import lombok.extern.slf4j.Slf4j;

@Slf4j
public class SimpleMetadataSignatureVerificationFilter extends AbstractMetadataSignatureFilter {

  private final String metadataUrl;
  private final KeyStore trustedCredential;

  private static final String ERROR_07 = "internal.pvp.07";
  private static final String ERROR_12 = "internal.pvp.12";
  private static final String ERROR_MSG_ENTITIESDESC = "EntitiesDescritors are NOT supported";
  private static final String ERROR_MSG_SIGNOTVALID = "Signature not valid or no trusted certificate found";

  /**
   * SAML2 metadata-signature verification-filter that uses a simple {@link List}
   * of trusted {@link BasicX509Credential} as truststore. <br>
   * <p>
   * This filter only validates {@link EntityDescriptor} elements.<br>
   * SAML2 metadata with {@link EntitiesDescriptor} <b>are not supported.</b>
   * </p>
   *
   * @param keyStore TrustStore that contains trusted X509 certificates
   * @param metadataUrl Metadata URL for logging purposes
   */
  public SimpleMetadataSignatureVerificationFilter(@Nonnull KeyStore keyStore,
      @Nonnull String metadataUrl) {
    this.metadataUrl = metadataUrl;
    this.trustedCredential = keyStore;

  }

  @Override
  protected void verify(EntityDescriptor desc) throws Pvp2MetadataException {
    try {
      internalVerify(desc);

    } catch (final EaafException e) {
      log.info("Metadata verification FAILED for: {} Reason: {}", metadataUrl, e.getMessage());
      throw new Pvp2MetadataException(ERROR_07,
          new Object[] { metadataUrl, e.getMessage() }, e);

    }
  }

  @Override
  protected void verify(EntitiesDescriptor desc) throws Pvp2MetadataException {
    throw new Pvp2MetadataException(ERROR_07,
        new Object[] { metadataUrl, ERROR_MSG_ENTITIESDESC });

  }

  @Override
  protected void verify(EntityDescriptor entity, EntitiesDescriptor desc) throws Pvp2MetadataException {
    throw new Pvp2MetadataException(ERROR_07,
        new Object[] { metadataUrl, ERROR_MSG_ENTITIESDESC });

  }

  private void internalVerify(SignableSAMLObject signedElement)
      throws EaafException {
    // check if signature exists
    if (signedElement.getSignature() == null) {
      throw new Pvp2MetadataException(ERROR_12,
          new Object[] { metadataUrl });

    }

    // perform general signature validation
    try {
      final SAMLSignatureProfileValidator sigValidator = new SAMLSignatureProfileValidator();
      sigValidator.validate(signedElement.getSignature());

    } catch (final SignatureException e) {
      log.error("Failed to validate Signature", e);
      throw new Pvp2MetadataException(ERROR_07,
          new Object[] { metadataUrl, e.getMessage() }, e);

    }

    // perform cryptographic signature verification
    boolean isTrusted = false;
    for (final BasicX509Credential cred : getTrustedCertificates()) {
      log.trace("Validating signature with credential: {} ... ",
          cred.getEntityCertificate().getSubjectDN());
      try {
        SignatureValidator.validate(signedElement.getSignature(), cred);
        isTrusted = true;

      } catch (final SignatureException e) {
        log.debug("Failed to verfiy Signature with cert: {} Reason: {}",
            cred.getEntityCertificate().getSubjectDN(), e.getMessage());

      }
    }

    if (!isTrusted) {
      log.info("PVP2 metadata: " + metadataUrl + " are NOT trusted!");
      throw new SamlMetadataSignatureException(metadataUrl, ERROR_MSG_SIGNOTVALID);

    }
  }
  
  private List<BasicX509Credential> getTrustedCertificates() throws EaafConfigurationException {
    try {
      final List<X509Certificate> certs =
          EaafKeyStoreUtils.readCertsFromKeyStore(trustedCredential);
      if (certs.isEmpty()) {
        log.warn("No trusted metadata-signing certificates in configuration");
        throw new EaafConfigurationException("module.eidasauth.02",
            new Object[] { "No trusted metadata-signing certificates" });

      }

      final List<BasicX509Credential> result = new ArrayList<>();
      for (final X509Certificate cert : certs) {
        result.add(new BasicX509Credential(cert));

      }
      return result;

    } catch (final KeyStoreException e) {
      throw new EaafConfigurationException("module.eidasauth.01",
          new Object[] { "Trusted metadata-signing certificates", e.getMessage() }, e);

    }
  }

}