#include "tlbmc/credentials/credential_manager_impl.h"

#include <filesystem>  // NOLINT
#include <memory>
#include <optional>
#include <string>
#include <string_view>
#include <system_error>  // NOLINT
#include <thread>        // NOLINT
#include <utility>

#include "owner_certificate/owner_verification_cert_configuration.pb.h"
#include "absl/functional/any_invocable.h"
#include "absl/log/log.h"
#include "absl/memory/memory.h"
#include "absl/status/status.h"
#include "absl/status/statusor.h"
#include "absl/strings/str_cat.h"
#include "absl/strings/str_format.h"
#include "absl/strings/substitute.h"
#include "absl/synchronization/mutex.h"
#include "absl/time/clock.h"
#include "absl/time/time.h"
#include "zatar/x509_certificate.h"
#include "g3/macros.h"
#include "tlbmc/credentials/credential_manager.h"
#include "tlbmc/redfish/routes/action_managers/file_manager.h"
#include "resource.pb.h"
#include "tlbmc/resource/syslog_config_utils.h"
#include "tlbmc/utils/shell_command_executor.h"
#include "zatar/cert_error_handling.h"
#include "zatar/generate_cert.h"
#include "openssl/asn1.h"
#include "zatar/g3_misc.h"
#include "openssl/bio.h"
#include "openssl/bn.h"
#include "openssl/buffer.h"
#include "openssl/evp.h"
#include "openssl/pem.h"
#include "openssl/rsa.h"
#include "openssl/stack.h"
#include "openssl/x509.h"
#include "google/protobuf/text_format.h"
#include "re2/re2.h"

namespace milotic_tlbmc {

using ::milotic::authn::GeneratePrivateKey;
using ::milotic::authn::GetSslErrorOnQueue;
using ::milotic::authn::ReturnErrorIfNotSuccess;
using ::milotic::authn::ReturnErrorIfNull;
using ::owner_certificate::OwnerVerificationCertConfiguration;
using ::owner_certificate::SerialConsoleAccessLevel;
using ::google::protobuf::TextFormat;

namespace {

absl::Status AddNameEntry(X509_NAME* name, std::string_view entry,
                          std::string_view value) {
  ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNotSuccess(
      X509_NAME_add_entry_by_txt(
          name, std::string(entry).c_str(), MBSTRING_ASC,
          reinterpret_cast<const unsigned char*>(value.data()), value.size(),
          /*loc=*/-1,
          /*set=*/0),
      absl::StrCat("Failed to add name entry: ", value, "",
                   GetSslErrorOnQueue())));
  return absl::OkStatus();
}

std::string GetSyslogOverrideContent(const SyslogTargetConfig& config) {
  std::string protocol_str = "tcp";
  auto protocol_yocto = GetYoctoStringFromSyslogProtocol(config.protocol());
  if (protocol_yocto.ok()) {
    protocol_str = *protocol_yocto;
  } else {
    LOG(ERROR) << "Failed to convert protocol enum to Yocto string: "
               << protocol_yocto.status();
  }

  std::string tls_mode_str = "tls";
  auto tls_mode_yocto = GetYoctoStringFromSyslogTlsMode(config.tls_mode());
  if (tls_mode_yocto.ok()) {
    tls_mode_str = *tls_mode_yocto;
  } else {
    LOG(ERROR) << "Failed to convert TLS mode enum to Yocto string: "
               << tls_mode_yocto.status();
  }

  return absl::StrFormat(
      "[Service]\n"
      "Environment=PROD_SYSLOG_IP=\"%s\"\n"
      "Environment=PROD_SYSLOG_PORT=\"%d\"\n"
      "Environment=PROD_SYSLOG_PROTO=\"%s\"\n"
      "Environment=PROD_SYSLOG_TLS_MODE=\"%s\"\n"
      "TimeoutStopSec=5\n",
      config.target_ip(), static_cast<int>(config.target_port()), protocol_str,
      tls_mode_str);
}

}  // namespace

absl::StatusOr<std::unique_ptr<CredentialManagerImpl>>
CredentialManagerImpl::Create(const CredentialManagerParams& params) {
  // Check that private key are non empty strings and are files in the same
  // folder
  if (params.private_key_path.empty()) {
    return absl::InvalidArgumentError("Private key path is empty");
  }
  if (params.cert_path.empty()) {
    return absl::InvalidArgumentError("Cert path is empty");
  }

  // Check that the private key and cert are in the same folder
  std::filesystem::path private_key_path_fs(params.private_key_path);
  std::filesystem::path cert_path_fs(params.cert_path);
  if (private_key_path_fs.parent_path() != cert_path_fs.parent_path()) {
    return absl::InvalidArgumentError(
        "Private key and cert are not in the same folder");
  }

  if (params.owner_verification_cert_path.empty()) {
    return absl::InvalidArgumentError("Owner verification cert path is empty");
  }

  if (params.owner_verification_config_path.empty()) {
    return absl::InvalidArgumentError(
        "Owner verification config path is empty");
  }

  if (params.bmc_ssh_trusted_user_ca_keys_path.empty()) {
    return absl::InvalidArgumentError(
        "BMC SSH trusted user CA keys path is empty");
  }

  if (params.trust_bundle_path.empty()) {
    return absl::InvalidArgumentError("Trust bundle path is empty");
  }

  if (params.trust_bundle_signature_path.empty()) {
    return absl::InvalidArgumentError("Trust bundle signature path is empty");
  }

  if (params.os_verification_cert_path.empty()) {
    return absl::InvalidArgumentError("OS verification cert path is empty");
  }

  if (params.os_verification_key_path.empty()) {
    return absl::InvalidArgumentError("OS verification key path is empty");
  }

  if (params.serial_console_trusted_user_ca_keys_path.empty()) {
    return absl::InvalidArgumentError(
        "Serial console trusted user CA keys path is empty");
  }

  if (params.serial_console_detatched_signature_path.empty()) {
    return absl::InvalidArgumentError(
        "Serial console detatched signature path is empty");
  }

  if (params.serial_console_access_level_dir.empty()) {
    return absl::InvalidArgumentError(
        "Serial console access level path is empty");
  }
  if (params.syslog_client_conf_override_path.empty()) {
    return absl::InvalidArgumentError(
        "Syslog client conf override path is empty");
  }
  if (params.syslog_root_cert_path.empty()) {
    return absl::InvalidArgumentError("Syslog root cert path is empty");
  }

  return absl::WrapUnique(new CredentialManagerImpl(params));
}

void CredentialManagerImpl::ParseOwnerVerificationCert() {
  // If the write path already exists, then we should read from there.
  absl::StatusOr<std::string> owner_verification_cert =
      FileManager::ReadFile(params_.owner_verification_cert_path);

  if (!owner_verification_cert.ok()) {
    LOG(ERROR) << "Failed to read owner verification certificate: "
               << owner_verification_cert.status()
               << ". All owner verification certificate validation will fail "
                  "as we will use an empty certificate.";
    return;
  }

  LOG(WARNING) << "Successfully read the owner verification certificate.";
  owner_verification_cert_ = std::move(*owner_verification_cert);
}

void CredentialManagerImpl::ParseOwnerVerificationConfiguration() {
  // Reading the Owner Verification Config file
  absl::StatusOr<std::string> owner_verification_config =
      FileManager::ReadFile(params_.owner_verification_config_path);
  if (!owner_verification_config.ok()) {
    LOG(ERROR) << "Failed to read owner verification config: "
               << owner_verification_config.status()
               << ". Using default config which allows firmware updates.";
    return;
  }
  // Parse the owner verification config file.
  OwnerVerificationCertConfiguration owner_verification_cert_configuration;
  TextFormat::Parser parser;
  parser.AllowUnknownField(true);
  if (!parser.ParseFromString(*owner_verification_config,
                              &owner_verification_cert_configuration)) {
    LOG(ERROR) << "Failed to parse owner verification config. Using default "
                  "config which allows firmware updates.";
    return;
  }
  owner_verification_cert_configuration_ =
      std::move(owner_verification_cert_configuration);

  SerialConsoleAccessLevel serial_console_access_level =
      owner_verification_cert_configuration_->serial_console_access_level();

  absl::Status status;
  switch (serial_console_access_level) {
    case SerialConsoleAccessLevel::ACCESS_FULL:
      break;
    case SerialConsoleAccessLevel::ACCESS_DISABLE:
      status = FileManager::WriteToFile(
          "", absl::StrCat(params_.serial_console_access_level_dir,
                           "/serial_console_disabled"));
      if (!status.ok()) {
        LOG(ERROR) << "Failed to write to serial console disabled file: "
                   << status;
      }
      break;
    case SerialConsoleAccessLevel::ACCESS_READONLY:
      status = FileManager::WriteToFile(
          "", absl::StrCat(params_.serial_console_access_level_dir,
                           "/serial_console_readonly"));
      if (!status.ok()) {
        LOG(ERROR) << "Failed to write to serial console readonly file: "
                   << status;
      }
      break;
    default:
      LOG(ERROR) << "Serial console access level is unknown.";
      break;
  }
}

void CredentialManagerImpl::ParseBmcSshTrustedUserCaKeys() {
  absl::StatusOr<std::string> bmc_ssh_trusted_user_ca_keys_signature =
      FileManager::ReadFile(params_.bmc_ssh_trusted_user_ca_keys_path);
  if (!bmc_ssh_trusted_user_ca_keys_signature.ok()) {
    LOG(ERROR) << "Failed to read BMC SSH trusted user CA keys signature: "
               << bmc_ssh_trusted_user_ca_keys_signature.status()
               << ". Assuming no BMC SSH trusted user CA keys signature.";
    return;
  }
  bmc_ssh_trusted_user_ca_keys_signature_ =
      std::move(*bmc_ssh_trusted_user_ca_keys_signature);
}

void CredentialManagerImpl::ParseTrustBundleFiles() {
  absl::StatusOr<std::string> trust_bundle =
      FileManager::ReadFile(params_.trust_bundle_path);
  if (!trust_bundle.ok()) {
    LOG(ERROR) << "Failed to read trust bundle: " << trust_bundle.status()
               << ". Assuming no trust bundle.";
    return;
  }
  trust_bundle_ = std::move(*trust_bundle);

  absl::StatusOr<std::string> trust_bundle_signature =
      FileManager::ReadFile(params_.trust_bundle_signature_path);
  if (!trust_bundle_signature.ok()) {
    LOG(ERROR) << "Failed to read trust bundle signature: "
               << trust_bundle_signature.status()
               << ". Assuming no trust bundle signature.";
    return;
  }
  trust_bundle_signature_ = std::move(*trust_bundle_signature);
}

void CredentialManagerImpl::ParseServerCert() {
  absl::StatusOr<std::string> server_cert =
      FileManager::ReadFile(params_.cert_path);
  if (!server_cert.ok()) {
    LOG(ERROR) << "Failed to read server certificate: " << server_cert.status()
               << ". Assuming no server certificate.";
    return;
  }
  server_cert_ = std::move(*server_cert);
}

void CredentialManagerImpl::ParseOsVerificationCert() {
  absl::StatusOr<std::string> os_verification_cert =
      FileManager::ReadFile(params_.os_verification_cert_path);
  if (!os_verification_cert.ok()) {
    LOG(ERROR) << "Failed to read OS verification certificate: "
               << os_verification_cert.status()
               << ". Assuming no OS verification certificate.";
    return;
  }
  os_verification_cert_ = std::move(*os_verification_cert);
}

void CredentialManagerImpl::ParseSerialConsoleTrustedUserCAKeys() {
  absl::StatusOr<std::string> serial_console_trusted_user_ca_keys =
      FileManager::ReadFile(params_.serial_console_trusted_user_ca_keys_path);
  if (!serial_console_trusted_user_ca_keys.ok()) {
    LOG(ERROR) << "Failed to read serial console trusted user CA keys: "
               << serial_console_trusted_user_ca_keys.status()
               << ". Assuming no serial console trusted user CA keys.";
  } else {
    serial_console_trusted_user_ca_keys_ =
        std::move(*serial_console_trusted_user_ca_keys);
  }

  absl::StatusOr<std::string> serial_console_detatched_signature =
      FileManager::ReadFile(params_.serial_console_detatched_signature_path);
  if (!serial_console_detatched_signature.ok()) {
    LOG(ERROR) << "Failed to read serial console detatched signature: "
               << serial_console_detatched_signature.status()
               << ". Assuming no serial console detatched signature.";
    return;
  }
  serial_console_detatched_signature_ =
      std::move(*serial_console_detatched_signature);
}

void CredentialManagerImpl::ParseSyslogTargetConfig() {
  absl::StatusOr<std::string> syslog_client_conf_override =
      FileManager::ReadFile(params_.syslog_client_conf_override_path);
  if (!syslog_client_conf_override.ok()) {
    LOG(ERROR) << "Failed to read syslog client conf override: "
               << syslog_client_conf_override.status()
               << ". Assuming no syslog client conf override.";
    return;
  }

  std::string target_ip;
  int64_t target_port;
  SyslogProtocol protocol = SYSLOG_PROTOCOL_TCP;
  SyslogTlsMode tls_mode = SYSLOG_TLS_MODE_TLS;
  if (RE2::PartialMatch(*syslog_client_conf_override,
                        "Environment=PROD_SYSLOG_IP=\"([^\"]+)\"",
                        &target_ip) &&
      RE2::PartialMatch(*syslog_client_conf_override,
                        "Environment=PROD_SYSLOG_PORT=\"(\\d+)\"",
                        &target_port)) {
    std::string proto_str;
    if (RE2::PartialMatch(*syslog_client_conf_override,
                          "Environment=PROD_SYSLOG_PROTO=\"([^\"]+)\"",
                          &proto_str)) {
      auto proto_enum = GetSyslogProtocolFromYoctoString(proto_str);
      if (proto_enum.ok()) {
        protocol = *proto_enum;
      } else {
        LOG(ERROR) << "Failed to parse protocol from Yocto config: "
                   << proto_enum.status();
      }
    }
    std::string tls_mode_str;
    if (RE2::PartialMatch(*syslog_client_conf_override,
                          "Environment=PROD_SYSLOG_TLS_MODE=\"([^\"]+)\"",
                          &tls_mode_str)) {
      auto tls_mode_enum = GetSyslogTlsModeFromYoctoString(tls_mode_str);
      if (tls_mode_enum.ok()) {
        tls_mode = *tls_mode_enum;
      } else {
        LOG(ERROR) << "Failed to parse TLS mode from Yocto config: "
                   << tls_mode_enum.status();
      }
    }
    SyslogTargetConfig config;
    config.set_target_ip(target_ip);
    config.set_target_port(target_port);
    config.set_protocol(protocol);
    config.set_tls_mode(tls_mode);
    syslog_cert_config_ = std::move(config);
  }
}

void CredentialManagerImpl::ParseSyslogRootCert() {
  absl::StatusOr<std::string> syslog_root_cert =
      FileManager::ReadFile(params_.syslog_root_cert_path);
  if (!syslog_root_cert.ok()) {
    LOG(ERROR) << "Failed to read syslog root cert: "
               << syslog_root_cert.status()
               << ". Assuming no syslog root cert.";
    return;
  }
  syslog_root_cert_ = std::move(*syslog_root_cert);
}

CredentialManagerImpl::CredentialManagerImpl(
    const CredentialManagerParams& params)
    : params_(params), command_executor_(std::make_unique<ShellExecutor>()) {
  ParseOwnerVerificationCert();
  ParseOwnerVerificationConfiguration();
  ParseBmcSshTrustedUserCaKeys();
  ParseTrustBundleFiles();
  ParseServerCert();
  ParseOsVerificationCert();
  ParseSerialConsoleTrustedUserCAKeys();
  ParseSyslogTargetConfig();
  ParseSyslogRootCert();
}

namespace {

absl::StatusOr<bssl::UniquePtr<X509_REQ>> CreateX509Req(
    const CredentialManagerImpl::CsrParams& csr_params) {
  bssl::UniquePtr<X509_REQ> x509(X509_REQ_new());
  ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNull(
      x509.get(), absl::StrCat("X509_REQ_new failed: ", GetSslErrorOnQueue())));

  X509_NAME* subject = X509_REQ_get_subject_name(x509.get());
  ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNull(
      subject, absl::StrCat("Failed to get subject name from X509_REQ: ",
                            GetSslErrorOnQueue())));
  ECCLESIA_RETURN_IF_ERROR(AddNameEntry(subject, "C", csr_params.country));
  ECCLESIA_RETURN_IF_ERROR(AddNameEntry(subject, "ST", csr_params.state));
  ECCLESIA_RETURN_IF_ERROR(AddNameEntry(subject, "L", csr_params.city));
  ECCLESIA_RETURN_IF_ERROR(AddNameEntry(subject, "O", csr_params.organization));
  ECCLESIA_RETURN_IF_ERROR(
      AddNameEntry(subject, "OU", csr_params.organizational_unit));
  ECCLESIA_RETURN_IF_ERROR(AddNameEntry(subject, "CN", csr_params.common_name));

  if (!csr_params.alternative_names.empty()) {
    std::string san_extension;
    for (int i = 0; i < csr_params.alternative_names.size(); ++i) {
      std::string_view san = csr_params.alternative_names[i];
      absl::StrAppend(&san_extension, "DNS:", san);
      if (i < csr_params.alternative_names.size() - 1) {
        absl::StrAppend(&san_extension, ",");
      }
    }

    bssl::UniquePtr<STACK_OF(X509_EXTENSION)> extensions(
        sk_X509_EXTENSION_new_null());
    bssl::UniquePtr<X509_EXTENSION> san_ext(X509V3_EXT_conf_nid(
        nullptr, nullptr, NID_subject_alt_name, san_extension.c_str()));
    ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNull(
        san_ext.get(), absl::StrCat("Failed to create SAN extension: ",
                                    GetSslErrorOnQueue())));
    ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNotSuccess(
        sk_X509_EXTENSION_push(extensions.get(), san_ext.release()),
        absl::StrCat("Failed to add SAN extension to CSR: ",
                     GetSslErrorOnQueue())));
    ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNotSuccess(
        X509_REQ_add_extensions(x509.get(), extensions.get()),
        absl::StrCat("Failed to add extensions to CSR: ",
                     GetSslErrorOnQueue())));
  }
  return x509;
}

absl::StatusOr<std::string> GenerateCsrWithPrivateKey(
    const CredentialManagerImpl::CsrParams& csr_params, EVP_PKEY* private_key) {
  ECCLESIA_ASSIGN_OR_RETURN(bssl::UniquePtr<X509_REQ> x509,
                            CreateX509Req(csr_params));

  ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNotSuccess(
      X509_REQ_set_pubkey(x509.get(), private_key),
      absl::StrCat("Failed to set public key in CSR: ", GetSslErrorOnQueue())));

  ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNotSuccess(
      X509_REQ_sign(x509.get(), private_key, EVP_sha256()),
      absl::StrCat("Failed to sign CSR: ", GetSslErrorOnQueue())));

  bssl::UniquePtr<BIO> bio_csr(BIO_new(BIO_s_mem()));
  ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNotSuccess(
      PEM_write_bio_X509_REQ(bio_csr.get(), x509.get()),
      absl::StrCat("Failed to write CSR to BIO: ", GetSslErrorOnQueue())));
  char* csr = nullptr;
  auto csr_len = BIO_get_mem_data(bio_csr.get(), &csr);
  return std::string(csr, csr_len);
}

}  // namespace

absl::StatusOr<std::string> CredentialManagerImpl::GenerateCsr(
    const CsrParams& csr_params) {
  ECCLESIA_ASSIGN_OR_RETURN(bssl::UniquePtr<EVP_PKEY> pkey,
                            GeneratePrivateKey());
  ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNull(
      pkey.get(),
      absl::StrCat("Failed to generate private key: ", GetSslErrorOnQueue())));

  ECCLESIA_ASSIGN_OR_RETURN(std::string csr,
                            GenerateCsrWithPrivateKey(csr_params, pkey.get()));

  {
    absl::MutexLock lock(mutex_);
    private_key_ = std::move(pkey);
  }
  return csr;
}

absl::Status CredentialManagerImpl::InstallServerCert(
    std::string_view certificate) {
  absl::MutexLock lock(mutex_);
  // If GenerateCSR has not been called, we cannot install the cert.
  if (private_key_ == nullptr) {
    return absl::InternalError(
        "GenerateCSR must be called before InstallServerCert");
  }

  // 1. Load the certificate from the PEM string
  bssl::UniquePtr<BIO> bio_cert(BIO_new_mem_buf(
      certificate.data(), static_cast<uint32_t>(certificate.length())));
  bssl::UniquePtr<X509> cert(
      PEM_read_bio_X509(bio_cert.get(), nullptr, nullptr, nullptr));
  ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNull(
      cert.get(),
      absl::StrCat("Failed to parse certificate PEM: ", GetSslErrorOnQueue())));

  ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNotSuccess(
      X509_check_private_key(cert.get(), private_key_.get()),
      "Certificate does not match the private key"));

  bssl::UniquePtr<BIO> bio_privkey(BIO_new(BIO_s_mem()));
  ECCLESIA_RETURN_IF_ERROR(ReturnErrorIfNotSuccess(
      PEM_write_bio_PrivateKey(bio_privkey.get(), private_key_.get(), nullptr,
                               nullptr, 0, nullptr, nullptr),
      absl::StrCat("PEM_write_bio_PrivateKey failed: ", GetSslErrorOnQueue())));

  char* private_key = nullptr;
  auto private_key_len = BIO_get_mem_data(bio_privkey.get(), &private_key);
  std::string private_key_pem(private_key, private_key_len);

  // Install the cert and key on the machine.
  // We must do directory name change here as the key and cert have to both be
  // changed atomically
  std::string credential_dir =
      std::filesystem::path(params_.cert_path).parent_path();
  std::string cert_filename =
      std::filesystem::path(params_.cert_path).filename();
  std::string private_key_filename =
      std::filesystem::path(params_.private_key_path).filename();

  // Write to a temp dir
  std::string temp_credential_dir = absl::StrCat(credential_dir, "-tmp");
  if (params_.cert_path == params_.private_key_path) {
    // After RestartBmcwebInASeparateThread is called below that bmcweb instance
    // will attempt to read the cert and key. Since the filepaths are the same,
    // we must write both the cert and key to the same file.
    ECCLESIA_RETURN_IF_ERROR(FileManager::WriteToFile(
        absl::StrCat(certificate, "\n", private_key_pem),
        absl::StrCat(temp_credential_dir, "/", cert_filename)));
  } else {
    ECCLESIA_RETURN_IF_ERROR(FileManager::WriteToFile(
        certificate, absl::StrCat(temp_credential_dir, "/", cert_filename)));
    ECCLESIA_RETURN_IF_ERROR(FileManager::WriteToFile(
        private_key_pem,
        absl::StrCat(temp_credential_dir, "/", private_key_filename)));
  }

  // Atomically change both key and cert
  ECCLESIA_RETURN_IF_ERROR(
      FileManager::RenamePath(temp_credential_dir, credential_dir, true));

  RestartBmcwebInASeparateThread();

  return absl::OkStatus();
}

void CredentialManagerImpl::RestartBmcwebInASeparateThread() {
  std::thread([this]() {
    absl::SleepFor(absl::Seconds(kServerRestartDelaySeconds));
    absl::StatusOr<std::string> status =
        command_executor_->Execute(std::string(kRestartBmcWebCommand), false);
    if (!status.ok()) {
      LOG(ERROR) << "Failed to restart bmcweb: " << status.status();
    }
    if (restart_bmcweb_callback_ != nullptr) {
      restart_bmcweb_callback_(status.status());
    }
  }).detach();
}

absl::Status CredentialManagerImpl::InstallTrustBundle(
    std::string_view trust_bundle, std::string_view signature) {
  absl::MutexLock lock(mutex_);
  if (last_install_time_ != absl::InfinitePast() &&
      absl::Now() - last_install_time_ <
          absl::Seconds(kTrustBundleRetryDelaySeconds)) {
    std::string error_message = absl::StrFormat(
        "A trust bundle, installed at %s, is pending to be applied at %s. "
        "Retry after %s.",
        absl::FormatTime(last_install_time_),
        absl::FormatTime(last_install_time_ +
                         absl::Seconds(kServerRestartDelaySeconds)),
        absl::FormatTime(last_install_time_ +
                         absl::Seconds(kTrustBundleRetryDelaySeconds)));
    LOG(ERROR) << error_message;
    return absl::UnavailableError(error_message);
  }

  ECCLESIA_ASSIGN_OR_RETURN(StagedTempFile staged_trust_bundle,
                            VerifyAndStageTrustBundle(trust_bundle, signature));

  last_install_time_ = absl::Now();

  ECCLESIA_RETURN_IF_ERROR(
      FileManager::WriteToFile(trust_bundle, params_.trust_bundle_path));

  ECCLESIA_RETURN_IF_ERROR(
      FileManager::WriteToFile(signature, params_.trust_bundle_signature_path));

  trust_bundle_ = std::string(trust_bundle);
  trust_bundle_signature_ = std::string(signature);

  RestartBmcwebInASeparateThread();

  return absl::OkStatus();
}

absl::StatusOr<StagedTempFile> CredentialManagerImpl::VerifyAndStageTrustBundle(
    std::string_view trust_bundle, std::string_view signature) {
  ECCLESIA_ASSIGN_OR_RETURN(
      StagedTempFile trust_bundle_file,
      StagedTempFile::Create(trust_bundle, kTempTrustBundlePath));
  absl::Status status =
      VerifyAndStageCertificate(trust_bundle_file.path(), signature);
  LOG(WARNING) << "Trust bundle verify result: " << status.message();
  if (!status.ok()) {
    return absl::Status(
        status.code(), absl::StrCat("Failed to verify trust bundle signature. ",
                                    status.message()));
  }
  return trust_bundle_file;
}

absl::Status CredentialManagerImpl::VerifyAndStageCertificate(
    std::string_view cert_path, std::string_view signature) {
  std::error_code ec;
  if (!std::filesystem::exists(params_.owner_verification_cert_path, ec)) {
    return absl::FailedPreconditionError(absl::Substitute(
        "Owner certificate file does not exist or can't be accessed: $0",
        ec.message()));
  }

  ECCLESIA_ASSIGN_OR_RETURN(
      StagedTempFile signature_file,
      StagedTempFile::Create(signature, kTempSignaturePath));
  std::string command =
      absl::StrFormat(kTrustBundleVerifyWithCaCommand, signature_file.path(),
                      cert_path, params_.owner_verification_cert_path);

  return command_executor_->Execute(command, false).status();
}

absl::Status CredentialManagerImpl::InstallOsVerificationCertificate(
    std::string_view cert_string) {
  // Verify the OS verification certificate
  ECCLESIA_RETURN_IF_ERROR(VerifyOsVerificationCertificate(cert_string));
  // Parse the public key
  ECCLESIA_ASSIGN_OR_RETURN(std::string public_key,
                            ecclesia::GetPublicKey(cert_string));

  // Write the cert itself to a file
  ECCLESIA_RETURN_IF_ERROR(
      FileManager::WriteToFile(cert_string, params_.os_verification_cert_path));

  // Write the public key to a file
  ECCLESIA_RETURN_IF_ERROR(
      FileManager::WriteToFile(public_key, params_.os_verification_key_path));

  os_verification_cert_ = std::string(cert_string);

  return absl::OkStatus();
}

absl::Status CredentialManagerImpl::VerifyOsVerificationCertificate(
    std::string_view cert_string) {
  absl::MutexLock lock(mutex_);
  std::error_code ec;
  if (!std::filesystem::exists(params_.owner_verification_cert_path, ec)) {
    return absl::FailedPreconditionError(absl::Substitute(
        "Owner certificate file does not exist or can't be accessed: $0",
        ec.message()));
  }
  ECCLESIA_ASSIGN_OR_RETURN(
      StagedTempFile os_cert_file,
      StagedTempFile::Create(cert_string, kTempOsCertPath));
  std::string command = absl::StrFormat(kOsCertVerifyCommand,
                                        params_.owner_verification_cert_path,
                                        os_cert_file.path());
  absl::Status status = command_executor_->Execute(command, false).status();

  if (!status.ok()) {
    return absl::Status(
        status.code(),
        absl::StrCat("Failed to verify OS verification certificate. ",
                     status.message()));
  }
  return absl::OkStatus();
}

absl::Status
CredentialManagerImpl::VerifyAndStageSerialConsoleTrustedUserCAKeys(
    std::string_view trusted_user_ca_keys, std::string_view signature) {
  ECCLESIA_ASSIGN_OR_RETURN(
      StagedTempFile trusted_user_ca_keys_file,
      StagedTempFile::Create(trusted_user_ca_keys, kTempTrustedUserCAKeysPath));
  absl::Status status =
      VerifyAndStageCertificate(trusted_user_ca_keys_file.path(), signature);
  LOG(WARNING) << "Trusted user CA keys verify result: " << status.message();
  if (!status.ok()) {
    return absl::Status(
        status.code(),
        absl::StrCat("Failed to verify trusted user CA keys signature. ",
                     status.message()));
  }
  return absl::OkStatus();
}

absl::Status CredentialManagerImpl::InstallSerialConsoleTrustedUserCAKeys(
    std::string_view trusted_user_ca_keys, std::string_view signature) {
  absl::MutexLock lock(mutex_);
  ECCLESIA_RETURN_IF_ERROR(VerifyAndStageSerialConsoleTrustedUserCAKeys(
      trusted_user_ca_keys, signature));
  ECCLESIA_RETURN_IF_ERROR(FileManager::WriteToFile(
      trusted_user_ca_keys, params_.serial_console_trusted_user_ca_keys_path));
  ECCLESIA_RETURN_IF_ERROR(FileManager::WriteToFile(
      signature, params_.serial_console_detatched_signature_path));
  serial_console_trusted_user_ca_keys_ = std::string(trusted_user_ca_keys);
  serial_console_detatched_signature_ = std::string(signature);
  return absl::OkStatus();
}

absl::Status CredentialManagerImpl::InstallSyslogCert(
    std::string_view cert_string, std::string_view target_ip,
    int64_t target_port, SyslogProtocol protocol, SyslogTlsMode tls_mode) {
  absl::MutexLock lock(mutex_);
  std::optional<SyslogTargetConfig> config_orig = syslog_cert_config_;

  if (target_ip.empty() && (target_port > 0) && (target_port <= 65535)) {
    return absl::InvalidArgumentError("Target IP is empty.");
  }
  if (!target_ip.empty() && ((target_port <= 0) || (target_port > 65535))) {
    return absl::InvalidArgumentError("Target port is empty.");
  }

  if (protocol == SYSLOG_PROTOCOL_UDP && tls_mode != SYSLOG_TLS_MODE_DISABLED) {
    return absl::InvalidArgumentError(
        "TLS is not supported when protocol is UDP.");
  }

  if (!target_ip.empty() && (target_port != 0)) {
    SyslogTargetConfig new_config;
    new_config.set_target_ip(target_ip);
    new_config.set_target_port(target_port);
    new_config.set_protocol(protocol);
    new_config.set_tls_mode(tls_mode);
    std::string override_content = GetSyslogOverrideContent(new_config);

    ECCLESIA_RETURN_IF_ERROR(FileManager::WriteToFile(
        override_content, params_.syslog_client_conf_override_path));
    syslog_cert_config_ = std::move(new_config);
  }

  absl::Status status =
      FileManager::WriteToFile(cert_string, params_.syslog_root_cert_path);
  if (!status.ok()) {
    // If cert file write fails, revert client conf override file.
    if (config_orig.has_value()) {
      absl::Status revert_status;
      revert_status =
          FileManager::WriteToFile(GetSyslogOverrideContent(*config_orig),
                                   params_.syslog_client_conf_override_path);
      if (!revert_status.ok()) {
        LOG(ERROR) << "Failed to revert client conf override file: "
                   << revert_status;
      }
      syslog_cert_config_ = std::move(config_orig);
    }
    return status;
  }
  syslog_root_cert_ = std::string(cert_string);
  return absl::OkStatus();
}

}  // namespace milotic_tlbmc