/*
    * Copyright 2008-2009 Web Cohesion
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *   https://www.apache.org/licenses/LICENSE-2.0
    *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  package org.springframework.security.oauth.common.signature;
  
  import org.springframework.security.authentication.encoding.PasswordEncoder;
  import org.springframework.security.core.Authentication;
  import org.springframework.security.core.context.SecurityContextHolder;
  import static org.springframework.security.oauth.common.OAuthCodec.oauthEncode;
  
  import javax.crypto.spec.SecretKeySpec;
  import java.io.UnsupportedEncodingException;
  import java.security.PrivateKey;
  import java.security.PublicKey;
  import java.security.cert.X509Certificate;
  
  /**
   * Implements the signatures defined in OAuth Core 1.0. By default, PLAINTEXT signatures are not supported
   *
   * @author Ryan Heaton
   */
  public class CoreOAuthSignatureMethodFactory implements OAuthSignatureMethodFactory {
  
    private boolean supportPlainText = false;
    private boolean supportHMAC_SHA1 = true;
    private boolean supportRSA_SHA1 = true;
    private PasswordEncoder plainTextPasswordEncoder;
  
    public OAuthSignatureMethod getSignatureMethod(String methodName, SignatureSecret signatureSecret, String tokenSecret) throws UnsupportedSignatureMethodException {
      if (supportPlainText && PlainTextSignatureMethod.SIGNATURE_NAME.equals(methodName)) {
        if (!(signatureSecret instanceof SharedConsumerSecret)) {
          throw new IllegalArgumentException("Invalid secret for signature method " + methodName + ". Expected a " +
            SharedConsumerSecret.class.getName() + ", got " + (signatureSecret == null ? "null" : signatureSecret.getClass().getName()) + ".");
        }
  
        String consumerSecret = ((SharedConsumerSecret) signatureSecret).getConsumerSecret();
        if (consumerSecret == null) {
          consumerSecret = "";
        }
        if (tokenSecret == null) {
          tokenSecret = "";
        }
  
        consumerSecret = oauthEncode(consumerSecret);
        tokenSecret = oauthEncode(tokenSecret);
  
        Object salt = null;
        if (signatureSecret instanceof SaltedConsumerSecret) {
          salt = ((SaltedConsumerSecret) signatureSecret).getSalt();
        }
  
        return new PlainTextSignatureMethod(oauthEncode(new StringBuilder(consumerSecret).append('&').append(tokenSecret).toString()), this.plainTextPasswordEncoder, salt);
      }
      else if (supportHMAC_SHA1 && HMAC_SHA1SignatureMethod.SIGNATURE_NAME.equals(methodName)) {
        if (!(signatureSecret instanceof SharedConsumerSecret)) {
          throw new IllegalArgumentException("Invalid secret for signature method " + methodName + ". Expected a " +
            SharedConsumerSecret.class.getName() + ", got " + (signatureSecret == null ? "null" : signatureSecret.getClass().getName()) + ".");
        }
  
        String consumerSecret = ((SharedConsumerSecret) signatureSecret).getConsumerSecret();
  
        if (consumerSecret == null) {
          consumerSecret = "";
        }
        if (tokenSecret == null) {
          tokenSecret = "";
        }
  
        consumerSecret = oauthEncode(consumerSecret);
        tokenSecret = oauthEncode(tokenSecret);
  
        byte[] keyBytes;
        try {
          keyBytes = new StringBuilder(consumerSecret).append('&').append(tokenSecret).toString().getBytes("UTF-8");
        }
        catch (UnsupportedEncodingException e) {
          throw new RuntimeException(e.getMessage());
        }
        SecretKeySpec spec = new SecretKeySpec(keyBytes, HMAC_SHA1SignatureMethod.MAC_NAME);
        return new HMAC_SHA1SignatureMethod(spec);
      }
      else if (supportRSA_SHA1 && RSA_SHA1SignatureMethod.SIGNATURE_NAME.equals(methodName)) {
        if (signatureSecret instanceof RSAKeySecret) {
          PublicKey publicKey = ((RSAKeySecret) signatureSecret).getPublicKey();
          PrivateKey privateKey = ((RSAKeySecret) signatureSecret).getPrivateKey();
          return new RSA_SHA1SignatureMethod(privateKey, publicKey);
       }
       else {
         Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
         if (authentication.getCredentials() instanceof X509Certificate) {
           X509Certificate certificate = (X509Certificate) authentication.getCredentials();
           if (certificate != null) {
             return new RSA_SHA1SignatureMethod(certificate.getPublicKey());
           }
         }
       }
     }
 
     throw new UnsupportedSignatureMethodException("Unsupported signature method: " + methodName);    
   }
 
   /**
    * Whether to support the plain text signature method.
    *
    * @return Whether to support the plain text signature method.
    */
   public boolean isSupportPlainText() {
     return supportPlainText;
   }
 
   /**
    * Whether to support the plain text signature method.
    *
    * @param supportPlainText Whether to support the plain text signature method.
    */
   public void setSupportPlainText(boolean supportPlainText) {
     this.supportPlainText = supportPlainText;
   }
 
   /**
    * Whether to support HMAC-SHA1 signature method.
    *
    * @return Whether to support HMAC-SHA1 signature method.
    */
   public boolean isSupportHMAC_SHA1() {
     return supportHMAC_SHA1;
   }
 
   /**
    * Whether to support HMAC-SHA1 signature method.
    *
    * @param supportHMAC_SHA1 Whether to support HMAC-SHA1 signature method.
    */
   public void setSupportHMAC_SHA1(boolean supportHMAC_SHA1) {
     this.supportHMAC_SHA1 = supportHMAC_SHA1;
   }
 
   /**
    * Whether to support RSA-SHA1 signature method.
    *
    * @return Whether to support RSA-SHA1 signature method.
    */
   public boolean isSupportRSA_SHA1() {
     return supportRSA_SHA1;
   }
 
   /**
    * Whether to support RSA-SHA1 signature method.
    *
    * @param supportRSA_SHA1 Whether to support RSA-SHA1 signature method.
    */
   public void setSupportRSA_SHA1(boolean supportRSA_SHA1) {
     this.supportRSA_SHA1 = supportRSA_SHA1;
   }
 
   /**
    * The password encoder to use for the plain-text password signature method.
    *
    * @return The password encoder to use for the plain-text password signature method.
    */
   public PasswordEncoder getPlainTextPasswordEncoder() {
     return plainTextPasswordEncoder;
   }
 
   /**
    * The password encoder to use for the plain-text password signature method.
    *
    * @param plainTextPasswordEncoder The password encoder to use for the plain-text password signature method.
    */
   public void setPlainTextPasswordEncoder(PasswordEncoder plainTextPasswordEncoder) {
     this.plainTextPasswordEncoder = plainTextPasswordEncoder;
   }
 }