/*
    * Copyright 2008 Web Cohesion
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *   https://www.apache.org/licenses/LICENSE-2.0
    *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  package org.springframework.security.oauth.provider.filter;
  
  import org.apache.commons.logging.Log;
  import org.apache.commons.logging.LogFactory;
  import org.springframework.beans.factory.InitializingBean;
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.context.MessageSource;
  import org.springframework.context.MessageSourceAware;
  import org.springframework.context.support.MessageSourceAccessor;
  import org.springframework.security.core.Authentication;
  import org.springframework.security.core.AuthenticationException;
  import org.springframework.security.core.SpringSecurityMessageSource;
  import org.springframework.security.core.context.SecurityContextHolder;
  import org.springframework.security.oauth.common.OAuthConsumerParameter;
  import org.springframework.security.oauth.common.OAuthException;
  import org.springframework.security.oauth.common.signature.*;
  import org.springframework.security.oauth.provider.ConsumerAuthentication;
  import org.springframework.security.oauth.provider.ConsumerCredentials;
  import org.springframework.security.oauth.provider.ConsumerDetails;
  import org.springframework.security.oauth.provider.ConsumerDetailsService;
  import org.springframework.security.oauth.provider.InvalidOAuthParametersException;
  import org.springframework.security.oauth.provider.OAuthAuthenticationDetails;
  import org.springframework.security.oauth.provider.OAuthProcessingFilterEntryPoint;
  import org.springframework.security.oauth.provider.OAuthProviderSupport;
  import org.springframework.security.oauth.provider.OAuthVersionUnsupportedException;
  import org.springframework.security.oauth.provider.nonce.ExpiringTimestampNonceServices;
  import org.springframework.security.oauth.provider.nonce.OAuthNonceServices;
  import org.springframework.security.oauth.provider.token.OAuthProviderToken;
  import org.springframework.security.oauth.provider.token.OAuthProviderTokenServices;
  import org.springframework.util.Assert;
  
  import javax.servlet.*;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  import java.io.IOException;
  import java.util.ArrayList;
  import java.util.Arrays;
  import java.util.List;
  import java.util.Map;
  
  /**
   * OAuth processing filter. This filter should be applied to requests for OAuth protected resources (see OAuth Core 1.0).
   *
   * @author Ryan Heaton
   */
  public abstract class OAuthProviderProcessingFilter implements Filter, InitializingBean, MessageSourceAware {
  
    /**
     * Attribute for indicating that OAuth processing has already occurred.
     */
    public static final String OAUTH_PROCESSING_HANDLED = "org.springframework.security.oauth.provider.OAuthProviderProcessingFilter#SKIP_PROCESSING";
  
    private final Log log = LogFactory.getLog(getClass());
    private final List<String> allowedMethods = new ArrayList<String>(Arrays.asList("GET", "POST"));
    private OAuthProcessingFilterEntryPointEntryPoint.html#OAuthProcessingFilterEntryPoint">OAuthProcessingFilterEntryPoint authenticationEntryPoint = new OAuthProcessingFilterEntryPoint();
    protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
    private String filterProcessesUrl = "/oauth_filter";
    private OAuthProviderSupport providerSupport = new CoreOAuthProviderSupport();
    private OAuthSignatureMethodFactory signatureMethodFactory = new CoreOAuthSignatureMethodFactory();
    private OAuthNonceServices nonceServices = new ExpiringTimestampNonceServices();
    private boolean ignoreMissingCredentials = false;
    private OAuthProviderTokenServices tokenServices;
  
    private ConsumerDetailsService consumerDetailsService;
  
    public void afterPropertiesSet() throws Exception {
      Assert.notNull(consumerDetailsService, "A consumer details service is required.");
      Assert.notNull(tokenServices, "Token services are required.");
    }
  
    public void init(FilterConfig ignored) throws ServletException {
    }
  
    public void destroy() {
    }
  
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException {
      HttpServletRequest request = (HttpServletRequest) servletRequest;
      HttpServletResponse response = (HttpServletResponse) servletResponse;
  
      if (!skipProcessing(request)) {
        if (requiresAuthentication(request, response, chain)) {
          if (!allowMethod(request.getMethod().toUpperCase())) {
           if (log.isDebugEnabled()) {
             log.debug("Method " + request.getMethod() + " not supported.");
           }
 
           response.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
           return;
         }
 
         try {
           Map<String, String> oauthParams = getProviderSupport().parseParameters(request);
 
           if (parametersAreAdequate(oauthParams)) {
 
             if (log.isDebugEnabled()) {
               StringBuilder builder = new StringBuilder("OAuth parameters parsed: ");
               for (String param : oauthParams.keySet()) {
                 builder.append(param).append('=').append(oauthParams.get(param)).append(' ');
               }
               log.debug(builder.toString());
             }
 
             String consumerKey = oauthParams.get(OAuthConsumerParameter.oauth_consumer_key.toString());
             if (consumerKey == null) {
               throw new InvalidOAuthParametersException(messages.getMessage("OAuthProcessingFilter.missingConsumerKey", "Missing consumer key."));
             }
 
             //load the consumer details.
             ConsumerDetails consumerDetails = getConsumerDetailsService().loadConsumerByConsumerKey(consumerKey);
             if (log.isDebugEnabled()) {
               log.debug("Consumer details loaded for " + consumerKey + ": " + consumerDetails);
             }
 
             //validate the parameters for the consumer.
             validateOAuthParams(consumerDetails, oauthParams);
             if (log.isDebugEnabled()) {
               log.debug("Parameters validated.");
             }
 
             //extract the credentials.
             String token = oauthParams.get(OAuthConsumerParameter.oauth_token.toString());
             String signatureMethod = oauthParams.get(OAuthConsumerParameter.oauth_signature_method.toString());
             String signature = oauthParams.get(OAuthConsumerParameter.oauth_signature.toString());
             String signatureBaseString = getProviderSupport().getSignatureBaseString(request);
             ConsumerCredentialsder/ConsumerCredentials.html#ConsumerCredentials">ConsumerCredentials credentials = new ConsumerCredentials(consumerKey, signature, signatureMethod, signatureBaseString, token);
 
             //create an authentication request.
             ConsumerAuthenticationnsumerAuthentication.html#ConsumerAuthentication">ConsumerAuthentication authentication = new ConsumerAuthentication(consumerDetails, credentials, oauthParams);
             authentication.setDetails(createDetails(request, consumerDetails));
 
             Authentication previousAuthentication = SecurityContextHolder.getContext().getAuthentication();
             try {
               //set the authentication request (unauthenticated) into the context.
               SecurityContextHolder.getContext().setAuthentication(authentication);
 
               //validate the signature.
               validateSignature(authentication);
 
               //mark the authentication request as validated.
               authentication.setSignatureValidated(true);
 
               //mark that processing has been handled.
               request.setAttribute(OAUTH_PROCESSING_HANDLED, Boolean.TRUE);
 
               if (log.isDebugEnabled()) {
                 log.debug("Signature validated.");
               }
 
               //go.
               onValidSignature(request, response, chain);
             }
             finally {
               //clear out the consumer authentication to make sure it doesn't get cached.
               resetPreviousAuthentication(previousAuthentication);
             }
           }
           else if (!isIgnoreInadequateCredentials()) {
             throw new InvalidOAuthParametersException(messages.getMessage("OAuthProcessingFilter.missingCredentials", "Inadequate OAuth consumer credentials."));
           }
           else {
             if (log.isDebugEnabled()) {
               log.debug("Supplied OAuth parameters are inadequate. Ignoring.");
             }
             chain.doFilter(request, response);
           }
         }
         catch (AuthenticationException ae) {
           fail(request, response, ae);
         }
         catch (ServletException e) {
           if (e.getRootCause() instanceof AuthenticationException) {
             fail(request, response, (AuthenticationException) e.getRootCause());
           }
           else {
             throw e;
           }
         }
       }
       else {
         if (log.isDebugEnabled()) {
           log.debug("Request does not require authentication.  OAuth processing skipped.");
         }
 
         chain.doFilter(servletRequest, servletResponse);
       }
     }
     else {
       if (log.isDebugEnabled()) {
         log.debug("Processing explicitly skipped.");
       }
 
       chain.doFilter(servletRequest, servletResponse);
     }
   }
 
   /**
    * By default, OAuth parameters are adequate if a consumer key is present.
    *
    * @param oauthParams The oauth params.
    * @return Whether the parsed parameters are adequate.
    */
   protected boolean parametersAreAdequate(Map<String, String> oauthParams) {
     return oauthParams.containsKey(OAuthConsumerParameter.oauth_consumer_key.toString());
   }
 
   protected void resetPreviousAuthentication(Authentication previousAuthentication) {
     SecurityContextHolder.getContext().setAuthentication(previousAuthentication);
   }
 
   /**
    * Create the details for the authentication request.
    *
    * @param request The request.
    * @param consumerDetails The consumer details.
    * @return The authentication details.
    */
   protected Object createDetails(HttpServletRequest request, ConsumerDetails consumerDetails) {
     return new OAuthAuthenticationDetails(request, consumerDetails);
   }
 
   /**
    * Whether to allow the specified HTTP method.
    *
    * @param method The HTTP method to check for allowing.
    * @return Whether to allow the specified method.
    */
   protected boolean allowMethod(String method) {
     return allowedMethods.contains(method);
   }
 
   /**
    * Validate the signature of the request given the authentication request.
    *
    * @param authentication The authentication request.
    */
   protected void validateSignature(ConsumerAuthentication authentication) throws AuthenticationException {
     SignatureSecret secret = authentication.getConsumerDetails().getSignatureSecret();
     String token = authentication.getConsumerCredentials().getToken();
     OAuthProviderToken authToken = null;
     if (token != null && !"".equals(token)) {
       authToken = getTokenServices().getToken(token);
     }
 
     String signatureMethod = authentication.getConsumerCredentials().getSignatureMethod();
     OAuthSignatureMethod method;
     try {
       method = getSignatureMethodFactory().getSignatureMethod(signatureMethod, secret, authToken != null ? authToken.getSecret() : null);
     }
     catch (UnsupportedSignatureMethodException e) {
       throw new OAuthException(e.getMessage(), e);
     }
 
     String signatureBaseString = authentication.getConsumerCredentials().getSignatureBaseString();
     String signature = authentication.getConsumerCredentials().getSignature();
     if (log.isDebugEnabled()) {
       log.debug("Verifying signature " + signature + " for signature base string " + signatureBaseString + " with method " + method.getName() + ".");
     }
     method.verify(signatureBaseString, signature);
   }
 
   /**
    * Logic executed on valid signature. The security context can be assumed to hold a verified, authenticated
    * {@link org.springframework.security.oauth.provider.ConsumerAuthentication}
    *
    * Default implementation continues the chain.
    *
    * @param request  The request.
    * @param response The response
    * @param chain    The filter chain.
    */
   protected abstract void onValidSignature(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException;
 
   /**
    * Validates the OAuth parameters for the given consumer. Base implementation validates only those parameters
    * that are required for all OAuth requests. This includes the nonce and timestamp, but not the signature.
    *
    * @param consumerDetails The consumer details.
    * @param oauthParams     The OAuth parameters to validate.
    * @throws InvalidOAuthParametersException If the OAuth parameters are invalid.
    */
   protected void validateOAuthParams(ConsumerDetails consumerDetails, Map<String, String> oauthParams) throws InvalidOAuthParametersException {
     String version = oauthParams.get(OAuthConsumerParameter.oauth_version.toString());
     if ((version != null) && (!"1.0".equals(version))) {
       throw new OAuthVersionUnsupportedException("Unsupported OAuth version: " + version);
     }
 
     String realm = oauthParams.get("realm");
     realm = realm == null || "".equals(realm) ? null : realm;
     if ((realm != null) && (!realm.equals(this.authenticationEntryPoint.getRealmName()))) {
       throw new InvalidOAuthParametersException(messages.getMessage("OAuthProcessingFilter.incorrectRealm",
                                                                     new Object[]{realm, this.getAuthenticationEntryPoint().getRealmName()},
                                                                     "Response realm name '{0}' does not match system realm name of '{1}'"));
     }
 
     String signatureMethod = oauthParams.get(OAuthConsumerParameter.oauth_signature_method.toString());
     if (signatureMethod == null) {
       throw new InvalidOAuthParametersException(messages.getMessage("OAuthProcessingFilter.missingSignatureMethod", "Missing signature method."));
     }
 
     String signature = oauthParams.get(OAuthConsumerParameter.oauth_signature.toString());
     if (signature == null) {
       throw new InvalidOAuthParametersException(messages.getMessage("OAuthProcessingFilter.missingSignature", "Missing signature."));
     }
 
     String timestamp = oauthParams.get(OAuthConsumerParameter.oauth_timestamp.toString());
     if (timestamp == null) {
       throw new InvalidOAuthParametersException(messages.getMessage("OAuthProcessingFilter.missingTimestamp", "Missing timestamp."));
     }
 
     String nonce = oauthParams.get(OAuthConsumerParameter.oauth_nonce.toString());
     if (nonce == null) {
       throw new InvalidOAuthParametersException(messages.getMessage("OAuthProcessingFilter.missingNonce", "Missing nonce."));
     }
 
     try {
       getNonceServices().validateNonce(consumerDetails, Long.parseLong(timestamp), nonce);
     }
     catch (NumberFormatException e) {
       throw new InvalidOAuthParametersException(messages.getMessage("OAuthProcessingFilter.invalidTimestamp", new Object[]{timestamp}, "Timestamp must be a positive integer. Invalid value: {0}"));
     }
 
     validateAdditionalParameters(consumerDetails, oauthParams);
   }
 
   /**
    * Do any additional validation checks for the specified oauth params.  Default implementation is a no-op.
    *
    * @param consumerDetails The consumer details.
    * @param oauthParams The params.
    */
   protected void validateAdditionalParameters(ConsumerDetails consumerDetails, Map<String, String> oauthParams) {
   }
 
   /**
    * Logic to be performed on a new timestamp.  The default behavior expects that the timestamp should not be new.
    *
    * @throws org.springframework.security.core.AuthenticationException
    *          If the timestamp shouldn't be new.
    */
   protected void onNewTimestamp() throws AuthenticationException {
     throw new InvalidOAuthParametersException(messages.getMessage("OAuthProcessingFilter.timestampNotNew", "A new timestamp should not be used in a request for an access token."));
   }
 
   /**
    * Common logic for OAuth failed.
    *
    * @param request  The request.
    * @param response The response.
    * @param failure  The failure.
    * @throws IOException thrown when there's an underlying IO exception
    * @throws ServletException thrown in the case of an underlying Servlet exception 
    */
   protected void fail(HttpServletRequest request, HttpServletResponse response, AuthenticationException failure) throws IOException, ServletException {
     SecurityContextHolder.getContext().setAuthentication(null);
 
     if (log.isDebugEnabled()) {
       log.debug(failure);
     }
 
     authenticationEntryPoint.commence(request, response, failure);
   }
 
   /**
    * Whether this filter is configured to process the specified request.
    *
    * @param request     The request.
    * @param response    The response
    * @param filterChain The filter chain
    * @return Whether this filter is configured to process the specified request.
    */
   protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) {
     //copied from org.springframework.security.ui.AbstractProcessingFilter.requiresAuthentication
     String uri = request.getRequestURI();
     int pathParamIndex = uri.indexOf(';');
 
     if (pathParamIndex > 0) {
       // strip everything after the first semi-colon
       uri = uri.substring(0, pathParamIndex);
     }
 
     if ("".equals(request.getContextPath())) {
       return uri.endsWith(filterProcessesUrl);
     }
 
     boolean match = uri.endsWith(request.getContextPath() + filterProcessesUrl);
     if (log.isDebugEnabled()) {
       log.debug(uri + (match ? " matches " : " does not match ") + filterProcessesUrl);
     }
     return match;
   }
 
   /**
    * Whether to skip processing for the specified request.
    *
    * @param request The request.
    * @return Whether to skip processing.
    */
   protected boolean skipProcessing(HttpServletRequest request) {
     return ((request.getAttribute(OAUTH_PROCESSING_HANDLED) != null) && (Boolean.TRUE.equals(request.getAttribute(OAUTH_PROCESSING_HANDLED))));
   }
 
   /**
    * The authentication entry point.
    *
    * @return The authentication entry point.
    */
   public OAuthProcessingFilterEntryPoint getAuthenticationEntryPoint() {
     return authenticationEntryPoint;
   }
 
   /**
    * The authentication entry point.
    *
    * @param authenticationEntryPoint The authentication entry point.
    */
   @Autowired (required = false)
   public void setAuthenticationEntryPoint(OAuthProcessingFilterEntryPoint authenticationEntryPoint) {
     this.authenticationEntryPoint = authenticationEntryPoint;
   }
 
   /**
    * The consumer details service.
    *
    * @return The consumer details service.
    */
   public ConsumerDetailsService getConsumerDetailsService() {
     return consumerDetailsService;
   }
 
   /**
    * The consumer details service.
    *
    * @param consumerDetailsService The consumer details service.
    */
   @Autowired
   public void setConsumerDetailsService(ConsumerDetailsService consumerDetailsService) {
     this.consumerDetailsService = consumerDetailsService;
   }
 
   /**
    * The nonce services.
    *
    * @return The nonce services.
    */
   public OAuthNonceServices getNonceServices() {
     return nonceServices;
   }
 
   /**
    * The nonce services.
    *
    * @param nonceServices The nonce services.
    */
   @Autowired (required = false)
   public void setNonceServices(OAuthNonceServices nonceServices) {
     this.nonceServices = nonceServices;
   }
 
   /**
    * Get the OAuth token services.
    *
    * @return The OAuth token services.
    */
   public OAuthProviderTokenServices getTokenServices() {
     return tokenServices;
   }
 
   /**
    * The OAuth token services.
    *
    * @param tokenServices The OAuth token services.
    */
   @Autowired
   public void setTokenServices(OAuthProviderTokenServices tokenServices) {
     this.tokenServices = tokenServices;
   }
 
   /**
    * The URL for which this filter will be applied.
    *
    * @return The URL for which this filter will be applied.
    */
   public String getFilterProcessesUrl() {
     return filterProcessesUrl;
   }
 
   /**
    * The URL for which this filter will be applied.
    *
    * @param filterProcessesUrl The URL for which this filter will be applied.
    */
   public void setFilterProcessesUrl(String filterProcessesUrl) {
     this.filterProcessesUrl = filterProcessesUrl;
   }
 
   /**
    * Set the message source.
    *
    * @param messageSource The message source.
    */
   public void setMessageSource(MessageSource messageSource) {
     this.messages = new MessageSourceAccessor(messageSource);
   }
 
   /**
    * The OAuth provider support.
    *
    * @return The OAuth provider support.
    */
   public OAuthProviderSupport getProviderSupport() {
     return providerSupport;
   }
 
   /**
    * The OAuth provider support.
    *
    * @param providerSupport The OAuth provider support.
    */
   @Autowired (required = false)
   public void setProviderSupport(OAuthProviderSupport providerSupport) {
     this.providerSupport = providerSupport;
   }
 
   /**
    * The OAuth signature method factory.
    *
    * @return The OAuth signature method factory.
    */
   public OAuthSignatureMethodFactory getSignatureMethodFactory() {
     return signatureMethodFactory;
   }
 
   /**
    * The OAuth signature method factory.
    *
    * @param signatureMethodFactory The OAuth signature method factory.
    */
   @Autowired (required = false)
   public void setSignatureMethodFactory(OAuthSignatureMethodFactory signatureMethodFactory) {
     this.signatureMethodFactory = signatureMethodFactory;
   }
 
   /**
    * Whether to ignore missing OAuth credentials.
    *
    * @return Whether to ignore missing OAuth credentials.
    */
   public boolean isIgnoreInadequateCredentials() {
     return ignoreMissingCredentials;
   }
 
   /**
    * Whether to ignore missing OAuth credentials.
    *
    * @param ignoreMissingCredentials Whether to ignore missing OAuth credentials.
    */
   public void setIgnoreMissingCredentials(boolean ignoreMissingCredentials) {
     this.ignoreMissingCredentials = ignoreMissingCredentials;
   }
 
   /**
    * The allowed set of HTTP methods.
    *
    * @param allowedMethods The allowed set of methods.
    */
   public void setAllowedMethods(List<String> allowedMethods) {
     this.allowedMethods.clear();
     if (allowedMethods != null) {
       for (String allowedMethod : allowedMethods) {
         this.allowedMethods.add(allowedMethod.toUpperCase());
       }
     }
   }
 }