/*******************************************************************************
 * Copyright 2014 Federal Chancellery Austria
 * MOA-ID has been developed in a cooperation between BRZ, the Federal
 * Chancellery Austria - ICT staff unit, and Graz University of Technology.
 *
 * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
 * the European Commission - subsequent versions of the EUPL (the "Licence");
 * You may not use this work except in compliance with the Licence.
 * You may obtain a copy of the Licence at:
 * http://www.osor.eu/eupl/
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the Licence is distributed on an "AS IS" basis,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the Licence for the specific language governing permissions and
 * limitations under the Licence.
 *
 * This product combines work with different licenses. See the "NOTICE" text
 * file for details on the various modules and licenses.
 * The "NOTICE" text file is part of the distribution. Any derivative works
 * that you distribute must include a readable copy of the "NOTICE" text file.
 *******************************************************************************/
package at.gv.egovernment.moa.id.protocols.pvp2x.metadata;

import java.security.cert.CertificateException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Date;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Timer;

import javax.net.ssl.SSLHandshakeException;
import javax.xml.namespace.QName;

import org.apache.commons.httpclient.MOAHttpClient;
import org.opensaml.saml2.metadata.EntitiesDescriptor;
import org.opensaml.saml2.metadata.EntityDescriptor;
import org.opensaml.saml2.metadata.RoleDescriptor;
import org.opensaml.saml2.metadata.provider.ChainingMetadataProvider;
import org.opensaml.saml2.metadata.provider.HTTPMetadataProvider;
import org.opensaml.saml2.metadata.provider.MetadataFilter;
import org.opensaml.saml2.metadata.provider.MetadataProvider;
import org.opensaml.saml2.metadata.provider.MetadataProviderException;
import org.opensaml.xml.XMLObject;
import org.opensaml.xml.parse.BasicParserPool;

import at.gv.egovernment.moa.id.commons.db.ConfigurationDBRead;
import at.gv.egovernment.moa.id.commons.db.dao.config.ChainingModeType;
import at.gv.egovernment.moa.id.commons.db.dao.config.OAPVP2;
import at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplication;
import at.gv.egovernment.moa.id.commons.ex.MOAHttpProtocolSocketFactoryException;
import at.gv.egovernment.moa.id.commons.utils.MOAHttpProtocolSocketFactory;
import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.filter.SchemaValidationException;
import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.filter.SignatureValidationException;
import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.InterfederatedIDPPublicServiceFilter;
import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.MetadataFilterChain;
import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.SchemaValidationFilter;
import at.gv.egovernment.moa.logging.Logger;
import at.gv.egovernment.moa.util.MiscUtil;

public class MOAMetadataProvider implements MetadataProvider {

	private static MOAMetadataProvider instance = null;

	private static Object mutex = new Object();
	private static Date timestamp = null;
	
	public static MOAMetadataProvider getInstance() {
		if (instance == null) {
			synchronized (mutex) {
				if (instance == null) {
					instance = new MOAMetadataProvider();
				}
			}
		}
		return instance;
	}

	public static Date getTimeStamp() {
		return timestamp;
	}
	
	public static void reInitialize() {
		synchronized (mutex) {
			
			/**add new Metadataprovider or remove Metadataprovider which are not in use any more.**/
			if (instance != null)
				instance.addAndRemoveMetadataProvider();
			
			else
				Logger.info("MOAMetadataProvider is not loaded.");
		}
	}
	
	public static void destroy() {
		if (instance != null) {
			instance.internalDestroy();
			
		} else {
			Logger.info("MOAMetadataProvider is not loaded. Accordingly it can not be destroyed");
		}
	}
	
	MetadataProvider internalProvider;

	
	private void addAndRemoveMetadataProvider() {
		if (internalProvider != null && internalProvider instanceof ChainingMetadataProvider) {
			Logger.info("Relaod MOAMetaDataProvider.");
			
			/*OpenSAML ChainingMetadataProvider can not remove a MetadataProvider (UnsupportedOperationException)
			 *The ChainingMetadataProvider use internal a unmodifiableList to hold all registrated MetadataProviders.*/ 
			Map<String, MetadataProvider> providersinuse = new HashMap<String, MetadataProvider>();

			Map<String, HTTPMetadataProvider> loadedproviders = new HashMap<String, HTTPMetadataProvider>();
			ChainingMetadataProvider chainProvider = (ChainingMetadataProvider) internalProvider;
			
			//make a Map of all actually loaded HTTPMetadataProvider
			List<MetadataProvider> providers = chainProvider.getProviders();
			for (MetadataProvider provider : providers) {
				if (provider instanceof HTTPMetadataProvider) {
					HTTPMetadataProvider httpprovider = (HTTPMetadataProvider) provider;
					loadedproviders.put(httpprovider.getMetadataURI(), httpprovider);
				}
			}
			
			//set Timestamp
			Date oldTimeStamp = timestamp;
			timestamp = new Date();
			
			//load all PVP2 OAs form ConfigurationDatabase and 
			//compare actually loaded Providers with configured PVP2 OAs
			List<OnlineApplication> oaList = ConfigurationDBRead
					.getAllActiveOnlineApplications();
						
			Iterator<OnlineApplication> oaIt = oaList.iterator();
			while (oaIt.hasNext()) {
				HTTPMetadataProvider httpProvider = null;
				
				try {
					OnlineApplication oa = oaIt.next();
					OAPVP2 pvp2Config = oa.getAuthComponentOA().getOAPVP2();
					if (pvp2Config != null && MiscUtil.isNotEmpty(pvp2Config.getMetadataURL())) {
						
						String metadataurl = pvp2Config.getMetadataURL();
						
						if (loadedproviders.containsKey(metadataurl)) {
							
							if (pvp2Config.getUpdateRequiredItem() != null &&
									pvp2Config.getUpdateRequiredItem().after(oldTimeStamp)) {
								//PVP2 OA is actually loaded, but update is requested
								Logger.info("Reload metadata for: " + oa.getFriendlyName());
								loadedproviders.get(metadataurl).refresh();
								
							}

							//	PVP2 OA is actually loaded, to nothing
							providersinuse.put(metadataurl, loadedproviders.get(metadataurl));
							loadedproviders.remove(metadataurl);
							
							
						} else if ( MiscUtil.isNotEmpty(metadataurl) &&
								!providersinuse.containsKey(metadataurl) ) {
							//PVP2 OA is new, add it to MOAMetadataProvider
													
							Logger.info("Loading metadata for: " + oa.getFriendlyName());
							httpProvider = createNewHTTPMetaDataProvider(
									pvp2Config.getMetadataURL(), 
									pvp2Config.getCertificate(),
									oa.getFriendlyName(),
									buildMetadataFilterChain(oa, pvp2Config.getMetadataURL(), 
											pvp2Config.getCertificate()));
							
							if (httpProvider != null)
								providersinuse.put(metadataurl, httpProvider);
						
						}
					}
				} catch (Throwable e) {
					Logger.error(
							"Failed to add Metadata (unhandled reason: "
									+ e.getMessage(), e);
					
					if (httpProvider != null) {
						Logger.debug("Destroy failed Metadata provider");
						httpProvider.destroy();
					}
					
				}	
			}
			
			//remove all actually loaded MetadataProviders with are not in ConfigurationDB any more
			Collection<HTTPMetadataProvider> notusedproviders = loadedproviders.values();
			for (HTTPMetadataProvider provider : notusedproviders) {
				String metadataurl = provider.getMetadataURI();
				
				try {
					
					provider.destroy();
					
					/*OpenSAML ChainingMetadataProvider can not remove a MetadataProvider (UnsupportedOperationException)
					 *The ChainingMetadataProvider use internal a unmodifiableList to hold all registrated MetadataProviders.*/
					//chainProvider.removeMetadataProvider(provider);
					
					Logger.info("Remove not used MetadataProvider with MetadataURL " + metadataurl);
					
				} catch (Throwable e) {
					Logger.error("HTTPMetadataProvider with URL " + metadataurl 
							+ " can not be removed from the list of actually loaded Providers.", e);
					
				}
				
			}
			
			try {
				chainProvider.setProviders(new ArrayList<MetadataProvider>(providersinuse.values()));
				
			} catch (MetadataProviderException e) {
				Logger.warn("ReInitalize MOAMetaDataProvider is not possible! MOA-ID Instance has to be restarted manualy", e);
				
			}
			
			
			
		} else {
			Logger.warn("ReInitalize MOAMetaDataProvider is not possible! MOA-ID Instance has to be restarted manualy");
		}
		
	}
	
	
	public void internalDestroy() {
		if (internalProvider != null && internalProvider instanceof ChainingMetadataProvider) {
			Logger.info("Destrorying MOAMetaDataProvider.");
			ChainingMetadataProvider chainProvider = (ChainingMetadataProvider) internalProvider;				
			
			List<MetadataProvider> providers = chainProvider.getProviders();
			for (MetadataProvider provider : providers) {
				if (provider instanceof HTTPMetadataProvider) {
					HTTPMetadataProvider httpprovider = (HTTPMetadataProvider) provider;
					Logger.debug("Destroy HTTPMetadataProvider +" + httpprovider.getMetadataURI());
					httpprovider.destroy();
					
				} else {
					Logger.warn("MetadataProvider can not be destroyed.");
				}
			}	
			instance = null;
		} else {
			Logger.warn("ReInitalize MOAMetaDataProvider is not possible! MOA-ID Instance has to be restarted manualy");
		}
	}
	
	private MOAMetadataProvider() {
		ChainingMetadataProvider chainProvider = new ChainingMetadataProvider();
		Logger.info("Loading metadata");
		
		Map<String, MetadataProvider> providersinuse = new HashMap<String, MetadataProvider>();
		
		List<OnlineApplication> oaList = ConfigurationDBRead
				.getAllActiveOnlineApplications();
		
		if (oaList.size() == 0)
			Logger.info("No Online-Application configuration found. PVP 2.1 metadata provider initialization failed!");
		
		Iterator<OnlineApplication> oaIt = oaList.iterator();
		while (oaIt.hasNext()) {
			HTTPMetadataProvider httpProvider = null;
			
			try {
				OnlineApplication oa = oaIt.next();
				Logger.info("Loading metadata for: " + oa.getFriendlyName());
				OAPVP2 pvp2Config = oa.getAuthComponentOA().getOAPVP2();
				if (pvp2Config != null && MiscUtil.isNotEmpty(pvp2Config.getMetadataURL())) {
					String metadataURL = pvp2Config.getMetadataURL();
					
					if (!providersinuse.containsKey(metadataURL)) {
					
						httpProvider = createNewHTTPMetaDataProvider(
								metadataURL, 
								pvp2Config.getCertificate(),
								oa.getFriendlyName(),
								buildMetadataFilterChain(oa, metadataURL, 
										pvp2Config.getCertificate()));
					
						if (httpProvider != null)
							providersinuse.put(metadataURL, httpProvider);
						
					} else {
						Logger.info(metadataURL + " are already added.");
					}
					
				} else {
					Logger.info(oa.getFriendlyName()
							+ " is not a PVP2 Application skipping");
				}
			} catch (Throwable e) {
				Logger.error(
						"Failed to add Metadata (unhandled reason: "
								+ e.getMessage(), e);
				
				if (httpProvider != null) {
					Logger.debug("Destroy failed Metadata provider");
					httpProvider.destroy();
				}
			}			
		}
		
		
		try {
			chainProvider.setProviders(new ArrayList<MetadataProvider>(providersinuse.values()));
			
		} catch (MetadataProviderException e) {
			Logger.error(
					"Failed to add Metadata (unhandled reason: "
							+ e.getMessage(), e);
		}
		
		internalProvider = chainProvider;
		timestamp = new Date();
	}
	
	private MetadataFilterChain buildMetadataFilterChain(OnlineApplication oa, String metadataURL, byte[] certificate) throws CertificateException {
		MetadataFilterChain filterChain = new MetadataFilterChain(metadataURL, certificate);
		filterChain.getFilters().add(new SchemaValidationFilter());
		
		if (oa.isIsInterfederationIDP() != null && oa.isIsInterfederationIDP()) {
			Logger.info("Online-Application is an interfederated IDP. Add addional Metadata policies");
			filterChain.getFilters().add(new InterfederatedIDPPublicServiceFilter(metadataURL, oa.getType()));
			
		}
		
		return filterChain;		
	}
	
	private HTTPMetadataProvider createNewHTTPMetaDataProvider(String metadataURL, byte[] certificate, String oaName, MetadataFilterChain filter) {
		HTTPMetadataProvider httpProvider = null;
		Timer timer= null;
		MOAHttpClient httpClient = null;
		try {			
			httpClient = new MOAHttpClient();
			
			if (metadataURL.startsWith("https:")) {
				try {
					MOAHttpProtocolSocketFactory protoSocketFactory = new MOAHttpProtocolSocketFactory(
							PVPConstants.SSLSOCKETFACTORYNAME, 
							AuthConfigurationProvider.getInstance().getCertstoreDirectory(), 
							AuthConfigurationProvider.getInstance().getTrustedCACertificates(),
							null,
							ChainingModeType.fromValue(AuthConfigurationProvider.getInstance().getDefaultChainingMode()), 
							AuthConfigurationProvider.getInstance().isTrustmanagerrevoationchecking());
					
					httpClient.setCustomSSLTrustStore(metadataURL, protoSocketFactory);

				} catch (MOAHttpProtocolSocketFactoryException e) {
					Logger.warn("MOA SSL-TrustStore can not initialized. Use default Java TrustStore.");
					
				}
			}
			
			timer = new Timer();
			httpProvider = new HTTPMetadataProvider(timer, httpClient, 
					metadataURL);
			httpProvider.setParserPool(new BasicParserPool());
			httpProvider.setRequireValidMetadata(true);
			httpProvider.setMinRefreshDelay(1000*60*15); //15 minutes
			httpProvider.setMaxRefreshDelay(1000*60*60*24); //24 hours
			//httpProvider.setRefreshDelayFactor(0.1F);
			
			if (filter == null) {			
				filter = new MetadataFilterChain(metadataURL, certificate);
			}
			httpProvider.setMetadataFilter(filter);
			httpProvider.initialize();
			
			httpProvider.setRequireValidMetadata(true);
			
			return httpProvider;
						
		} catch (Throwable e) {			
			if (e.getCause() != null && e.getCause().getCause() instanceof SSLHandshakeException) {
				Logger.warn("SSL-Server certificate for metadata " 
						+ metadataURL + " not trusted.", e);
				
			} if (e.getCause() != null && e.getCause().getCause() instanceof SignatureValidationException) {				
				Logger.warn("Signature verification for metadata" 
						+ metadataURL + " FAILED.", e);
			
			} if (e.getCause() != null && e.getCause().getCause() instanceof SchemaValidationException) {
				Logger.warn("Schema validation for metadata " 
						+ metadataURL + " FAILED.", e);								
			}
			
			Logger.error(
					"Failed to add Metadata file for "
							+ oaName + "[ "
							+ e.getMessage() + " ]", e);
						
			if (httpProvider != null) {
				Logger.debug("Destroy failed Metadata provider");
				httpProvider.destroy();
			}
			
			if (timer != null) {
				Logger.debug("Destroy Timer.");
				timer.cancel();
			}

			
		}
		
		return null;	
	}
	
	public boolean requireValidMetadata() {
		return internalProvider.requireValidMetadata();
	}

	public void setRequireValidMetadata(boolean requireValidMetadata) {
		internalProvider.setRequireValidMetadata(requireValidMetadata);
	}

	public MetadataFilter getMetadataFilter() {
		return internalProvider.getMetadataFilter();
	}

	public void setMetadataFilter(MetadataFilter newFilter)
			throws MetadataProviderException {
		internalProvider.setMetadataFilter(newFilter);
	}

	public XMLObject getMetadata() throws MetadataProviderException {
		return internalProvider.getMetadata();
	}

	public EntitiesDescriptor getEntitiesDescriptor(String name)
			throws MetadataProviderException {
		return internalProvider.getEntitiesDescriptor(name);
	}

	public EntityDescriptor getEntityDescriptor(String entityID)
			throws MetadataProviderException {
		return internalProvider.getEntityDescriptor(entityID);
	}

	public List<RoleDescriptor> getRole(String entityID, QName roleName)
			throws MetadataProviderException {
		return internalProvider.getRole(entityID, roleName);
	}

	public RoleDescriptor getRole(String entityID, QName roleName,
			String supportedProtocol) throws MetadataProviderException {
		return internalProvider.getRole(entityID, roleName, supportedProtocol);
	}

}