#include "authz_server.h"

#include <chrono>
#include <cstddef>
#include <cstdint>
#include <cstdio>
#include <cstdlib>
#include <format>
#include <fstream>
#include <iostream>
#include <iterator>
#include <memory>
#include <string>
#include <string_view>
#include <utility>

#include "absl/log/log.h"
#include "absl/status/status.h"
#include "absl/status/statusor.h"
#include "absl/strings/str_cat.h"
#include "absl/synchronization/mutex.h"
#include "grpc/grpc_security_constants.h"
#include "grpcpp/ext/proto_server_reflection_plugin.h"
#include "grpcpp/security/auth_context.h"
#include "grpcpp/security/server_credentials.h"
#include "grpcpp/security/tls_certificate_provider.h"
#include "grpcpp/security/tls_credentials_options.h"
#include "grpcpp/server_builder.h"
#include "grpcpp/server_context.h"
#include "grpcpp/support/status.h"
#include "nlohmann/json.hpp"
#include "nlohmann/json_fwd.hpp"
#include "jwt-cpp/jwt.h"
#include "jwt-cpp/traits/nlohmann-json/defaults.h"
#include "config_parser.h"
#include "oauth_utils.h"
#include "oauth.pb.h"
#include "zatar/generate_self_signed_cert.h"
#include "bmcweb_authorizer_singleton.h"

namespace milotic::authz {
namespace {

using ::milotic::authn::GenerateRandomRsaKey;
using ::oauth::ExchangeRequest;
using ::oauth::ExchangeResponse;
using ::oauth::HiscTokenRequest;
using ::oauth::HiscTokenResponse;
using ::oauth::MintTokenRequest;
using ::oauth::MintTokenResponse;
using ::oauth::SignatureAlgorithm;
using ::oauth::TokenType;

std::shared_ptr<grpc::ServerCredentials> GetCredentials(
    const ServerConfiguration& config) {
  constexpr unsigned int kFileWatcherRefreshIntervalSec = 30;
  grpc::experimental::TlsServerCredentialsOptions options(
      std::make_shared<grpc::experimental::FileWatcherCertificateProvider>(
          config.server_key_path, config.server_certificate_path,
          config.trust_bundle_path, kFileWatcherRefreshIntervalSec));

  options.set_cert_request_type(
      GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY);
  options.watch_identity_key_cert_pairs();
  options.watch_root_certs();
  options.set_crl_directory(config.crl_directory);

  return grpc::experimental::TlsServerCredentials(options);
}

class HiscCert {
 public:
  explicit HiscCert(uint32_t port_id, uint32_t life_time_in_seconds,
                    std::string_view public_key,
                    HiscTokenSystemDependency& hisc_token_system_dependency) {
    // save public key to /tmp/hiscXXXXXX file
    char tmpname[] = "/tmp/hiscXXXXXX";
    int fd = hisc_token_system_dependency.LibcMkstemp(tmpname);
    if (fd == -1) {
      status_ = absl::InternalError("Failed save key to tmp file");
      return;
    }
    public_key_file_name_ = tmpname;
    std::ofstream public_key_file(public_key_file_name_.c_str());
    public_key_file << public_key;
    public_key_file.close();
    close(fd);
    // sign the public key
    std::string cmd = std::format(kHiscCertGenCmd, port_id,
                                  life_time_in_seconds, public_key_file_name_);
    int ret_code =
        hisc_token_system_dependency.RunSshKeyGen(cmd, public_key_file_name_);
    LOG(INFO) << "Execute Command:\n" << cmd << "\n";
    if (ret_code != 0) {
      status_ =
          absl::InternalError(absl::StrCat("Failed execute command:\n", cmd));
      return;
    }

    cert_file_name_ = std::format("{}-cert.pub", public_key_file_name_);
    // Read the certificate
    std::ifstream cert_file(cert_file_name_);
    if (!cert_file.is_open()) {
      status_ = absl::InternalError(
          absl::StrCat("Failed opening cert file: ", cert_file_name_));
      return;
    }

    cert_.append((std::istreambuf_iterator<char>(cert_file)),
                 std::istreambuf_iterator<char>());
    cert_file.close();
    status_ = absl::OkStatus();
  }
  virtual ~HiscCert() {
    if (!public_key_file_name_.empty()) {
      std::remove(public_key_file_name_.c_str());
    }
    if (!cert_file_name_.empty()) {
      std::remove(cert_file_name_.c_str());
    }
  }
  absl::Status status_;
  std::string cert_;

 private:
  std::string public_key_file_name_;
  std::string cert_file_name_;
};

}  // namespace

namespace impl {

AuthorizationServiceImpl::AuthorizationServiceImpl(
    const ServerConfiguration& server_config)
    : authz_config_(std::make_unique<AuthzConfiguration>(
          nlohmann::json(), server_config.offline_node_entities_path,
          server_config.google_machine_identity_path)),
      token_count_(0),
      server_config_(server_config) {
  // Load Authz Config
  LoadAuthzConfig();

  // Generate Private Key
  absl::StatusOr<std::string> rsa_private_key =
      GenerateRandomRsaKey(server_config.rsa_public_key_path);
  if (!rsa_private_key.ok()) {
    LOG(ERROR) << "Failed GenerateRandomRsaKey: " << rsa_private_key.status();
    return;
  }
  rsa_private_key_ = std::move(*rsa_private_key);
}

void AuthorizationServiceImpl::LoadAuthzConfig() {
  std::ifstream authz_policy_file(server_config_.authz_configuration_path);
  if (!authz_policy_file.is_open()) {
    LOG(WARNING) << "Authz policy file at '"
                 << server_config_.authz_configuration_path << "' is missing.";
    return;
  }
  std::string authz_policy_buffer =
      std::string(std::istreambuf_iterator<char>(authz_policy_file),
                  std::istreambuf_iterator<char>());
  nlohmann::json authz_policy_json = nlohmann::json::parse(
      authz_policy_buffer, nullptr, /*allow_exceptions*/ false);
  if (authz_policy_json.is_discarded()) {
    LOG(WARNING) << "Authz policy file at '"
                 << server_config_.authz_configuration_path << "' is invalid."
                 << std::endl
                 << "|authz_policy_buffer|=" << authz_policy_buffer;
  }
  authz_config_->ReloadConfig(authz_policy_json,
                              /*platform_config=*/nlohmann::json());
}

grpc::Status AuthorizationServiceImpl::Exchange(
    grpc::ServerContext* /*context*/, const ExchangeRequest* /*request*/,
    ExchangeResponse* /*response*/) {
  return grpc::Status(grpc::StatusCode::UNIMPLEMENTED,
                      "Exchange RPC is not implemented yet");
}

grpc::Status AuthorizationServiceImpl::MintToken(
    grpc::ServerContext* context, const MintTokenRequest* request,
    MintTokenResponse* response) {
  if (GetServerFqdn().empty()) {
    LOG(WARNING) << "Server fqdn is empty";
    return grpc::Status(grpc::StatusCode::INTERNAL,
                        "Internal Server fqdn is empty.");
  }
  if (grpc::Status status = AuthorizeMintTokenRpc(*context->auth_context());
      !status.ok()) {
    LOG(WARNING) << "Peer is not authorized: " << status.error_message();
    return status;
  }
  if (grpc::Status status = CheckMintTokenRequest(*request); !status.ok()) {
    LOG(WARNING) << "Request is invalid: " << status.error_message();
    return status;
  }
  PeerSpiffeIdentity peer_identity;
  if (grpc::Status status =
          BmcWebAuthorizerSingleton::GetPeerIdentityFromAuthContext(
              *context->auth_context(), peer_identity);
      !status.ok()) {
    return status;
  }
  std::string subject = GenerateOAuthSubject(peer_identity);

  auto token_builder =
      jwt::create()
          .set_type("JWT")
          .set_issuer("BMC Local Authorization Server")
          .set_subject(subject)
          .set_audience(GetServerFqdn())
          .set_id(GetAndIncreaseTokenCount())
          .set_issued_at(std::chrono::system_clock::now())
          .set_expires_at(std::chrono::system_clock::now() +
                          std::chrono::seconds{request->valid_for().seconds()})
          .set_payload_claim("scope",
                             "Redfish.Role." + request->redfish_role());
  try {
    std::string token =
        token_builder.sign(jwt::algorithm::rs256("", rsa_private_key_));
    response->set_token(token);
  } catch (const jwt::error::signature_generation_exception& e) {
    return grpc::Status(
        grpc::StatusCode::INTERNAL,
        absl::StrCat("signature_generation_exception: ", e.what()));
  } catch (const jwt::error::rsa_exception& e) {
    return grpc::Status(grpc::StatusCode::INTERNAL,
                        absl::StrCat("rsa_exception: ", e.what()));
  } catch (...) {
    LOG(ERROR) << "Unexpected exception was caught.";
    return grpc::Status(grpc::StatusCode::INTERNAL,
                        absl::StrCat("unexpected exception was caught"));
  }
  LOG(INFO) << "Created token for " << subject << "; redfish role is "
            << request->redfish_role();
  return grpc::Status::OK;
}

grpc::Status AuthorizationServiceImpl::AuthorizeMintTokenRpc(
    const ::grpc::AuthContext& context) {
  PeerSpiffeIdentity identity;
  if (grpc::Status status =
          BmcWebAuthorizerSingleton::GetPeerIdentityFromAuthContext(context,
                                                                    identity);
      !status.ok()) {
    return status;
  }

  if (!authz_config_->IsPeerResourceOwner(identity)) {
    return grpc::Status(
        grpc::StatusCode::PERMISSION_DENIED,
        absl::StrCat("Peer is not a resource owner! |identity|=",
                     identity.DebugString()));
  }

  return grpc::Status::OK;
}

grpc::Status AuthorizationServiceImpl::CheckMintTokenRequest(
    const MintTokenRequest& request) {
  if (request.token_type() != TokenType::TOKEN_JWT) {
    return grpc::Status(grpc::StatusCode::UNIMPLEMENTED,
                        "Only TokenType::TOKEN_JWT is supported.");
  }
  if (request.alg() != SignatureAlgorithm::ALG_RS256) {
    return grpc::Status(grpc::StatusCode::UNIMPLEMENTED,
                        "Only SignatureAlgorithm::ALG_RS256 is supported.");
  }
  if (request.valid_for().nanos() != 0) {
    return grpc::Status(grpc::StatusCode::UNIMPLEMENTED,
                        "Nanos in |valid_for| is not supported.");
  }
  // 1 hour
  constexpr std::int64_t kMinimumDurationSeconds = 60 * 60;
  // 30 days
  constexpr std::int64_t kMaximumDurationSeconds = 30 * 24 * 60 * 60;

  if (request.valid_for().seconds() > kMaximumDurationSeconds ||
      request.valid_for().seconds() < kMinimumDurationSeconds) {
    return grpc::Status(grpc::StatusCode::UNIMPLEMENTED,
                        "|valid_for| must be between 1 hour and 30 days.");
  }

  if (request.has_redfish_privileges()) {
    return grpc::Status(grpc::StatusCode::UNIMPLEMENTED,
                        "Setting |RedfishPrivileges| in |redfish_scope| is "
                        "not supported yet.");
  }

  return grpc::Status::OK;
}

std::string AuthorizationServiceImpl::GetServerFqdn() {
  absl::MutexLock lock(&mutex_);
  return server_config_.server_fqdn;
}

void AuthorizationServiceImpl::SetServerFqdn(const std::string& fqdn) {
  absl::MutexLock lock(&mutex_);
  server_config_.server_fqdn = fqdn;
}

std::string AuthorizationServiceImpl::GetAndIncreaseTokenCount() {
  absl::MutexLock lock(&mutex_);
  std::size_t token_count = token_count_;
  token_count_++;
  return std::to_string(token_count);
}

grpc::Status AuthorizationServiceImpl::HiscToken(
    grpc::ServerContext* context, const HiscTokenRequest* request,
    HiscTokenResponse* response) {
  if (grpc::Status status = AuthorizeHiscTokenRpc(*context->auth_context());
      !status.ok()) {
    LOG(WARNING) << "Peer is not authorized: " << status.error_message();
    return status;
  }
  return HiscToken(request, response, bmc_hisc_token_system_dependency_);
}

grpc::Status AuthorizationServiceImpl::HiscToken(
    const HiscTokenRequest* request, HiscTokenResponse* response,
    HiscTokenSystemDependency& hisc_token_system_dependency) {
  if (request->token_lifetime_seconds() > kMaxHiscCertLifeTimeInSeconds) {
    return grpc::Status(
        grpc::StatusCode::INVALID_ARGUMENT,
        absl::StrCat("Request certificate lifetime in seconds is ",
                     request->token_lifetime_seconds(), ", longer than ",
                     kMaxHiscCertLifeTimeInSeconds));
  }
  HiscCert hisc_cert(request->hisc_port_id(), request->token_lifetime_seconds(),
                     request->public_key(), hisc_token_system_dependency);

  if (!hisc_cert.status_.ok()) {
    return grpc::Status(grpc::StatusCode::INTERNAL,
                        hisc_cert.status_.ToString());
  }

  response->set_token(hisc_cert.cert_);
  return grpc::Status::OK;
}

grpc::Status AuthorizationServiceImpl::AuthorizeHiscTokenRpc(
    const ::grpc::AuthContext& context) {
  PeerSpiffeIdentity identity;
  if (grpc::Status status =
          BmcWebAuthorizerSingleton::GetPeerIdentityFromAuthContext(context,
                                                                    identity);
      !status.ok()) {
    return status;
  }

  if (!authz_config_->IsPeerResourceOwner(identity)) {
    return grpc::Status(
        grpc::StatusCode::PERMISSION_DENIED,
        absl::StrCat("Peer is not a resource owner! |identity|=",
                     identity.DebugString()));
  }

  return grpc::Status::OK;
}

}  // namespace impl

AuthorizationServer::~AuthorizationServer() {
  if (server_ != nullptr) {
    LOG(INFO) << "Server shutting down..";
    server_->Shutdown();
  }
}

AuthorizationServer::AuthorizationServer(const ServerConfiguration& config)
    : server_config_(config) {}

void AuthorizationServer::StartServer() {
  std::string server_address(absl::StrCat("[::]:", server_config_.port));
  service_ = std::make_unique<impl::AuthorizationServiceImpl>(server_config_);
  grpc::reflection::InitProtoReflectionServerBuilderPlugin();

  grpc::ServerBuilder builder;
  builder.AddListeningPort(server_address, GetCredentials(server_config_));
  builder.RegisterService(service_.get());

  // Set up the server to start accepting requests.
  server_ = builder.BuildAndStart();
  LOG(INFO) << "Server listening on " << server_address;
}

void AuthorizationServer::ReloadAuthzConfig(const std::string& server_fqdn) {
  LOG(INFO) << "Reloading Server";
  service_->LoadAuthzConfig();
  service_->SetServerFqdn(server_fqdn);
}

void AuthorizationServer::Wait() { server_->Wait(); }

}  // namespace milotic::authz