#ifndef THIRD_PARTY_GBMCWEB_REDFISH_CORE_LIB_COMPONENT_INTEGRITY_H_
#define THIRD_PARTY_GBMCWEB_REDFISH_CORE_LIB_COMPONENT_INTEGRITY_H_

/*
// Copyright (c) 2024 Google
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
*/

#include <algorithm>
#include <array>
#include <ctime>
#include <cstdint>
#include <functional>
#include <memory>
#include <optional>
#include <regex>  // NOLINT
#include <string>
#include <string_view>
#include <tuple>
#include <utility>
#include <vector>

#include "boost/container/flat_map.hpp"  // NOLINT
#include "boost/system/error_code.hpp"  // NOLINT
#include "boost/url/format.hpp"  // NOLINT
#include "app.hpp"
#include "http_request.hpp"
#include "logging.hpp"
#include "parsing.hpp"
#include "utility.hpp"
#include "async_resp.hpp"
#include "dbus_utility.hpp"
#include "error_messages.hpp"
#include "query.hpp"
#include "registries/privilege_registry.hpp"
#include "chassis_utils.hpp"
#include "collection.hpp"
#include "dbus_utils.hpp"
#include "json_utils.hpp"
#include "system_utils.hpp"
#include <nlohmann/json.hpp>
#include "managed_store.hpp"
#include "managed_store_types.hpp"
#include "sdbusplus/message/native_types.hpp"
#include "sdbusplus/unpack_properties.hpp"

#ifdef UNIT_TEST_BUILD
#include "test/g3/mock_managed_store.hpp"  // NOLINT
#endif

namespace redfish {
// Interfaces which imply a D-Bus object represents a ComponentIntegrity
constexpr std::array<std::string_view, 3> componentIntegrityInterfaces = {
    "xyz.openbmc_project.Attestation.ComponentIntegrity",
    "xyz.openbmc_project.Attestation.MeasurementSet",
    "xyz.openbmc_project.Attestation.IdentityAuthentication"};
constexpr std::array<std::string_view, 1> networkAdapterInterfaces = {
    "xyz.openbmc_project.Inventory.Item.NetworkAdapter"};
constexpr std::array<std::string_view, 3> processorsInterfaces = {
    "xyz.openbmc_project.Inventory.Item.Cpu",
    "xyz.openbmc_project.Inventory.Item.Accelerator",
    "xyz.openbmc_project.Configuration.Processor"};

constexpr char const* spdmSecurityTechnologyType =
    "xyz.openbmc_project.Attestation.ComponentIntegrity.SecurityTechnologyType."
    "SPDM";
constexpr char const* tpmSecurityTechnologyType =
    "xyz.openbmc_project.Attestation.ComponentIntegrity.SecurityTechnologyType."
    "TPM";
constexpr char const* oemSecurityTechnologyType =
    "xyz.openbmc_project.Attestation.ComponentIntegrity.SecurityTechnologyType."
    "OEM";
constexpr char const* successVerificationStatus =
    "xyz.openbmc_project.Attestation.IdentityAuthentication.VerificationStatus."
    "Success";
constexpr char const* attestationComponentIntegrityIntf =
    "xyz.openbmc_project.Attestation.ComponentIntegrity";
constexpr char const* attestationIntegrityAuthIntf =
    "xyz.openbmc_project.Attestation.IdentityAuthentication";
constexpr char const* attestationMeasurementSetIntf =
    "xyz.openbmc_project.Attestation.MeasurementSet";

inline std::string getTrustedComponent(const std::string& dbusPath) {
  std::string chassis;
  std::string component;

  // Map D-Bus object path to the Redfish URI
  // Example targetComponentURI
  //     "/xyz/openbmc_project/Chassis/chassis01/TrustedComponent/tc01"
  // which should maps to
  //     "/redfish/v1/Chassis/chassis01/TrustedComponent/tc01"

  // These regexes derived on the rules here:
  // https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-names
  static const std::regex validPath(
      "/xyz/openbmc_project/Chassis/([A-Za-z0-9_]+)/TrustedComponents/"
      "([A-Za-z0-9_]+)");
  std::smatch matches;

  if (regex_match(dbusPath, matches, validPath)) {
    chassis = matches[1];
    component = matches[2];
  } else {
    BMCWEB_LOG_ERROR << "Can't parse TrustedComponent object path:" << dbusPath;
    return "";
  }

  boost::urls::url uri = crow::utility::urlFromPieces(
      "redfish", "v1", "Chassis", chassis, "TrustedComponents", component);
  std::string trustedComponent(uri.c_str());

  return trustedComponent;
}

inline std::optional<nlohmann::json> getChassisCert(
    const std::string& dbusPath) {
  nlohmann::json::object_t certObj;
  std::string chassis;
  std::string cert;

  // Map D-Bus object to Redfish URI
  // Example chassis cert object path:
  //     "/xyz/openbmc_project/certs/chassis/chassis01/cert01"
  // which should maps to:
  //     "/redfish/v1/Chassis/chassis01/Certificates/cert01"

  // These regexes derived on the rules here:
  // https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-names
  static const std::regex validPath(
      "/xyz/openbmc_project/certs/chassis/([A-Za-z0-9_]+)/([A-Za-z0-9_]+)");
  std::smatch matches;

  if (regex_match(dbusPath, matches, validPath)) {
    chassis = matches[1];
    cert = matches[2];
  } else {
    BMCWEB_LOG_ERROR << "Can't parse DBus certificate object path:" << dbusPath;
    return std::nullopt;
  }

  certObj["@odata.id"] = crow::utility::urlFromPieces(
      "redfish", "v1", "Chassis", chassis, "Certificates", cert);

  return {std::move(certObj)};
}

inline void getProtectedComponentsInfo(
    const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
    const std::string& currentObjPath, const boost::system::error_code& ec,
    const dbus::utility::MapperEndPoints& protectedComponentObjPaths) {
  if (ec) {
    if (ec.value() != EBADR) {
      BMCWEB_LOG_ERROR << "DBUS response error " << ec;
      messages::internalError(asyncResp->res);
    }
    return;
  }

  if (protectedComponentObjPaths.empty()) {
    return;
  }

  managedStore::ManagedObjectStoreContext requestContext(asyncResp);
  for (const auto& objpath : protectedComponentObjPaths) {
    sdbusplus::message::object_path protectedComponentObjPath(objpath);
    const std::string objName = protectedComponentObjPath.filename();
    if (objName.empty()) {
      BMCWEB_LOG_WARNING << "Malformed protected component object path "
                         << protectedComponentObjPath.str << " for "
                         << currentObjPath;
      continue;
    }
    managedStore::GetManagedObjectStore()->getDbusObject(
        objpath, {}, requestContext,
        [asyncResp, protectedComponentObjPath, currentObjPath, requestContext,
         objName](const boost::system::error_code& ec2,
                  const dbus::utility::MapperGetObject& object) {
          if (ec2) {
            BMCWEB_LOG_ERROR << "DBUS response error";
            messages::internalError(asyncResp->res);
            return;
          }

          nlohmann::json& jValue =
              asyncResp->res.jsonValue["Links"]["ComponentsProtected"];

          if (!jValue.is_array()) {
            // Create the array if it was empty
            jValue = nlohmann::json::array();
          }

          // Link can be Chassis or Board, Processor, and NetworkAdapters
          // handle Chassis or Board case
          if (redfish::dbus_utils::findInterfacesInServiceMap(
                  object, redfish::chassis_utils::chassisInterfaces)) {
            nlohmann::json link;
            link["@odata.id"] = crow::utility::urlFromPieces(
                "redfish", "v1", "Chassis", objName);
            jValue.push_back(std::move(link));
            return;
          }

          // handle NetworkAdaptors: parent resource can only be Chassis.
          if (redfish::dbus_utils::findInterfacesInServiceMap(
                  object, networkAdapterInterfaces)) {
            const std::string parentObj =
                protectedComponentObjPath.parent_path().filename();
            if (parentObj.empty()) {
              BMCWEB_LOG_WARNING << "Malformed protectedComponent object path "
                                 << protectedComponentObjPath.str << " for "
                                 << currentObjPath;
              return;
            }

            nlohmann::json link;
            link["@odata.id"] = crow::utility::urlFromPieces(
                "redfish", "v1", "Chassis", parentObj, "NetworkAdapters",
                objName);
            jValue.push_back(std::move(link));
            return;
          }

          if (redfish::dbus_utils::findInterfacesInServiceMap(
                  object, processorsInterfaces)) {
            std::string parentPath =
                protectedComponentObjPath.parent_path().str;
            std::string parentObj =
                protectedComponentObjPath.parent_path().filename();
            // e.g.,
            // /xyz/openbmc_project/inventory/system/board/BoardName/system1/chassis/motherboard/cpu0
            // filter out chassis|motherboard in object path.
            while (parentObj == "motherboard" || parentObj == "chassis") {
              sdbusplus::message::object_path tempObjPath(parentPath);
              parentPath = tempObjPath.parent_path().str;
              parentObj = tempObjPath.parent_path().filename();
            }
            if (parentObj.empty()) {
              BMCWEB_LOG_WARNING << "Malformed protectedComponentObjPath "
                                 << protectedComponentObjPath.str << " for "
                                 << currentObjPath;
              return;
            }
            managedStore::GetManagedObjectStore()->getDbusObject(
                parentPath, {}, requestContext,
                [asyncResp, objName, parentObj](
                    const boost::system::error_code& ec2,
                    const dbus::utility::MapperGetObject& object) {
                  if (ec2) {
                    BMCWEB_LOG_ERROR << "DBUS response error";
                    messages::internalError(asyncResp->res);
                    return;
                  }

                  nlohmann::json& jValue =
                      asyncResp->res.jsonValue["Links"]["ComponentsProtected"];
                  if (!jValue.is_array()) {
                    // Create the array if it was empty
                    jValue = nlohmann::json::array();
                  }

                  // handle Processor: parent resource has to be Systems as
                  // OpenBMC only search for Processor under Systems though
                  // Redfish SPEC allows Processors to be modeled under Chassis
                  // starting from DSP2046_2022.3.pdf.
                  std::string parentResourceType;
                  std::string parentResourceName;
                  if (redfish::dbus_utils::findInterfacesInServiceMap(
                          object, redfish::chassis_utils::chassisInterfaces)) {
                    parentResourceType = "Systems";
                    parentResourceName = "system";
                  } else if (redfish::dbus_utils::findInterfacesInServiceMap(
                                 object,
                                 redfish::system_utils::systemInterfaces)) {
                    parentResourceType = "Systems";
                    parentResourceName = parentObj;
                  } else {
                    BMCWEB_LOG_ERROR << "Parent resource type not "
                                        "supported for Processor resource";
                    messages::internalError(asyncResp->res);
                    return;
                  }

                  nlohmann::json link;
                  link["@odata.id"] = crow::utility::urlFromPieces(
                      "redfish", "v1", parentResourceType, parentResourceName,
                      "Processors", objName);
                  jValue.push_back(std::move(link));
                  return;
                });

            return;
          }  // end of Processor interfaces handling

          // Unsupported resource type
          BMCWEB_LOG_ERROR << "Unsupported ComponentsProtected resource for "
                           << protectedComponentObjPath.str;
          messages::internalError(asyncResp->res);
          return;
        });
  }
}

/**
 * @brief Fill out ComponentIntegrity related info by
 * requesting data from the given D-Bus object.
 *
 * @param[in,out]   aResp       Async HTTP response.
 * @param[in]       service     D-Bus service to query.
 * @param[in]       objPath     D-Bus object to query.
 */
inline void getComponentIntegrityData(
    const std::shared_ptr<bmcweb::AsyncResp>& aResp, const std::string& service,
    const std::string& objPath) {
  BMCWEB_LOG_DEBUG << "Get ComponentIntegrity Data";
  managedStore::ManagedObjectStoreContext context(aResp);
  managedStore::GetManagedObjectStore()->getAllProperties(
      service, objPath, attestationComponentIntegrityIntf, context,
      [objPath, aResp{aResp}, context](
          const boost::system::error_code& ec,
          const std::vector<std::pair<
              std::string, dbus::utility::DbusVariantType>>& properties) {
        if (ec) {
          BMCWEB_LOG_DEBUG << "DBUS response error";
          messages::internalError(aResp->res);
          return;
        }

        const bool* enabled = nullptr;
        const std::string* type = nullptr;
        const std::string* typeVersion = nullptr;
        const std::uint64_t* lastUpdated = nullptr;

        const bool success = sdbusplus::unpackPropertiesNoThrow(
            dbus_utils::UnpackErrorPrinter(), properties, "Enabled", enabled,
            "Type", type, "TypeVersion", typeVersion, "LastUpdated",
            lastUpdated);

        if (!success) {
          messages::internalError(aResp->res);
          return;
        }

        if (enabled != nullptr) {
          if (*enabled) {
            aResp->res.jsonValue["ComponentIntegrityEnabled"] = true;
          } else {
            aResp->res.jsonValue["ComponentIntegrityEnabled"] = false;
          }
        } else {
          messages::internalError(aResp->res);
          return;
        }

        if ((type != nullptr) && !type->empty()) {
          if (*type == spdmSecurityTechnologyType) {
            aResp->res.jsonValue["ComponentIntegrityType"] = "SPDM";
            aResp->res.jsonValue["Description"] =
                "SPDM-capable RoT physically attached to a device.";
          } else if (*type == tpmSecurityTechnologyType) {
            aResp->res.jsonValue["ComponentIntegrityType"] = "TPM";
            aResp->res.jsonValue["Description"] =
                "TPM physically attached to a device.";
          } else if (*type == oemSecurityTechnologyType) {
            aResp->res.jsonValue["ComponentIntegrityType"] = "OEM";
            aResp->res.jsonValue["Description"] =
                "OEM-specific RoT physically attached to a device.";
          } else {
            messages::internalError(aResp->res);
            return;
          }
        }

        if ((typeVersion != nullptr) && !typeVersion->empty()) {
          aResp->res.jsonValue["ComponentIntegrityTypeVersion"] = *typeVersion;
        }

        if ((lastUpdated != nullptr) && *lastUpdated != 0) {
          time_t ts = static_cast<time_t>(*lastUpdated);
          struct tm tminfo_r;
          const struct tm* tminfo = localtime_r(&ts, &tminfo_r);

          /**
           * The date of component update in ISO 8601 format as
           * YYYYMMDDThhmmssZ. Where 'T' is a literal character to separate
           * date fields from time and 'Z' is a literal character to indicate
           * UTC.
           */
          char iso8601[40];  // NOLINT
          std::strftime(static_cast<char*>(iso8601), sizeof(iso8601),
                        "%Y%m%dT%H%M%SZ", tminfo);
          aResp->res.jsonValue["LastUpdated"] =
              std::string(static_cast<char*>(iso8601));
        }

        // Get trusted components info from associations.
        std::string targetComponentPath = objPath + "/reporting";
        dbus_utils::getAssociationEndPoints(
            targetComponentPath, context,
            [aResp](const boost::system::error_code& e,
                    const dbus::utility::MapperEndPoints&
                        nodeTrustedComponentList) {
              if (e) {
                if (e.value() != EBADR) {
                  messages::internalError(aResp->res);
                  return;
                }
                // No resource found.
                return;
              }

              // One ComponentIntegrity object should be associated with one
              // TrustedComponent object
              if (nodeTrustedComponentList.size() == 1) {
                const std::string& componentURI =
                    nodeTrustedComponentList.at(0);

                std::string targetComponentURI =
                    getTrustedComponent(componentURI);

                if (!targetComponentURI.empty()) {
                  aResp->res.jsonValue["TargetComponentURI"] =
                      targetComponentURI;
                } else {
                  BMCWEB_LOG_ERROR << "Can't parse TargetComponentURI : "
                                   << componentURI;
                  messages::internalError(aResp->res);
                  return;
                }
              } else {
                BMCWEB_LOG_ERROR
                    << "Unexpected TargetComponent #objs (expecting 1): "
                    << nodeTrustedComponentList.size();
                messages::internalError(aResp->res);
                return;
              }
            });

        // Get protected components info from associations.
        std::string protectedComponentPath = objPath + "/authenticating";
        dbus_utils::getAssociationEndPoints(
            protectedComponentPath, context,
            std::bind_front(getProtectedComponentsInfo, aResp, objPath));
      });
}

/**
 * @brief Fill out {ComponentIntegrityId}#/SPDM/IdentityAuthentication
 * related info by requesting data from the given D-Bus object.
 *
 * @param[in,out]   aResp       Async HTTP response.
 * @param[in]       service     D-Bus service to query.
 * @param[in]       objPath     D-Bus object to query.
 */
inline void getSPDMAuthenticationData(
    const std::shared_ptr<bmcweb::AsyncResp>& aResp, const std::string& service,
    const std::string& objPath) {
  BMCWEB_LOG_DEBUG
      << "Get {ComponentIntegrityId}#/SPDM/IdentyAuthentication Data";
  managedStore::ManagedObjectStoreContext context(aResp);
  managedStore::GetManagedObjectStore()->getAllProperties(
      service, objPath, attestationIntegrityAuthIntf, context,
      [objPath, aResp{aResp}, context](
          const boost::system::error_code& ec,
          const std::vector<std::pair<
              std::string, dbus::utility::DbusVariantType>>& properties) {
        if (ec) {
          BMCWEB_LOG_ERROR << "DBUS response error!";
          messages::internalError(aResp->res);
          return;
        }

        const std::string* respStatus = nullptr;

        const bool success = sdbusplus::unpackPropertiesNoThrow(
            dbus_utils::UnpackErrorPrinter(), properties,
            "ResponderVerificationStatus", respStatus);

        if (!success) {
          messages::internalError(aResp->res);
          return;
        }

        if (respStatus != nullptr && !respStatus->empty()) {
          if (*respStatus == successVerificationStatus) {
            aResp->res
                .jsonValue["SPDM"]["IdentityAuthentication"]
                          ["ResponderAuthentication"]["VerificationStatus"] =
                "Success";
          } else {
            aResp->res
                .jsonValue["SPDM"]["IdentityAuthentication"]
                          ["ResponderAuthentication"]["VerificationStatus"] =
                "Failed";
          }
        }

        // Get associated certs objects.
        std::string reqCertPath = objPath + "/requester_identified_by";
        dbus_utils::getAssociationEndPoints(
            reqCertPath, context,
            [aResp](const boost::system::error_code& e,
                    const dbus::utility::MapperEndPoints& nodeReqCertList) {
              if (e) {
                if (e.value() != EBADR) {
                  messages::internalError(aResp->res);
                  return;
                }
                // No resource found.
                return;
              }

              nlohmann::json& json = aResp->res.jsonValue;

              // One ComponentIntegrity object should be associated with one
              // requester certificate object or none
              if (nodeReqCertList.empty()) {
                return;
              }

              if (nodeReqCertList.size() > 1) {
                BMCWEB_LOG_ERROR << "More than one requester cert provided!";
                messages::internalError(aResp->res);
                return;
              }

              // There is one valid cert, handle it
              const std::string& certPath = nodeReqCertList.at(0);

              std::optional<nlohmann::json> reqCertObj =
                  getChassisCert(certPath);

              if (reqCertObj != std::nullopt) {
                json["SPDM"]["IdentityAuthentication"]
                    ["RequesterAuthentication"]["ProvidedCertificate"] =
                        *reqCertObj;
              } else {
                // Requester Cert is not required, no need to report error.
                BMCWEB_LOG_DEBUG << "Unable to parse requester certPath: "
                                 << certPath;
              }
            });

        // Get associated response certs objects.
        std::string respCertPath = objPath + "/responder_identified_by";
        dbus_utils::getAssociationEndPoints(
            respCertPath, context,
            [aResp](const boost::system::error_code& e,
                    const dbus::utility::MapperEndPoints& nodeRespCertList) {
              if (e) {
                if (e.value() != EBADR) {
                  messages::internalError(aResp->res);
                  return;
                }
                // No resource found.
                return;
              }

              nlohmann::json& json = aResp->res.jsonValue;

              // One ComponentIntegrity object should be associated with one
              // responder certificate object
              if (nodeRespCertList.size() != 1) {
                BMCWEB_LOG_ERROR
                    << "Unexpected Responder Cert #objs (expecting 1): "
                    << nodeRespCertList.size();
                messages::internalError(aResp->res);
                return;
              }

              const std::string& certPath = nodeRespCertList.at(0);

              std::optional<nlohmann::json> respCertObj =
                  getChassisCert(certPath);

              if (respCertObj != std::nullopt) {
                json["SPDM"]["IdentityAuthentication"]
                    ["ResponderAuthentication"]["ComponentCertificate"] =
                        *respCertObj;
              } else {
                BMCWEB_LOG_ERROR << "Unable to parse responder certPath: "
                                 << certPath;
                messages::internalError(aResp->res);
                return;
              }
            });
      });
}

inline void getComponentData(
    const std::shared_ptr<bmcweb::AsyncResp>& aResp,
    const std::string& objectPath,
    const dbus::utility::MapperServiceMap& serviceMap) {
  for (const auto& [serviceName, interfaceList] : serviceMap) {
    for (const auto& interface : interfaceList) {
      if (interface == attestationComponentIntegrityIntf) {
        getComponentIntegrityData(aResp, serviceName, objectPath);
      } else if (interface == attestationIntegrityAuthIntf) {
        getSPDMAuthenticationData(aResp, serviceName, objectPath);
      }
    }
  }
}

inline void addSPDMGetSignedMeasurementsLinks(nlohmann::json& getMeasurement,
                                              const std::string& componentId) {
  getMeasurement["target"] = crow::utility::urlFromPieces(
      "redfish", "v1", "ComponentIntegrity", componentId, "Actions",
      "ComponentIntegrity.SPDMGetSignedMeasurements");
  getMeasurement["@Redfish.ActionInfo"] = crow::utility::urlFromPieces(
      "redfish", "v1", "ComponentIntegrity", componentId,
      "SPDMGetSignedMeasurementsActionInfo");
}

/**
 * Find the D-Bus object representing the requested ComponentIntegrity,
 * and call the handler with the results. If matching object is not
 * found, add 404 error to response and don't call the handler.
 *
 * @param[in,out]   resp            Async HTTP response.
 * @param[in]       processorId     Redfish Processor Id.
 * @param[in]       handler         Callback to continue processing request upon
 *                                  successfully finding object.
 */
template <typename Handler>
inline void getComponentObject(const std::shared_ptr<bmcweb::AsyncResp>& resp,
                               const std::string& componentId,
                               Handler&& handler) {
  BMCWEB_LOG_DEBUG << "Get available system component integrity resources.";

  // GetSubTree on all interfaces which provide info about a
  // component_integrity.
  managedStore::ManagedObjectStoreContext context(resp);
  managedStore::GetManagedObjectStore()->getSubTree(
      "/xyz/openbmc_project/ComponentIntegrity/", 0,
      componentIntegrityInterfaces, context,
      [resp, componentId, handler](
          const boost::system::error_code& ec,
          const dbus::utility::MapperGetSubTreeResponse& subtree) {
        if (ec) {
          BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
          messages::internalError(resp->res);
          return;
        }
        for (const auto& [objectPath, serviceMap] : subtree) {
          // Ignore any objects which don't end with our desired
          // componentintegrity name
          if (!objectPath.ends_with(componentId)) {
            continue;
          }

          bool found = false;
          // Filter out objects that don't have the
          // ComponentIntegrity-specific interfaces to make sure we can return
          // 404 on non-ComponentIntegrity
          for (const auto& [serviceName, interfaceList] : serviceMap) {
            if (std::find_first_of(interfaceList.begin(), interfaceList.end(),
                                   componentIntegrityInterfaces.begin(),
                                   componentIntegrityInterfaces.end()) !=
                interfaceList.end()) {
              found = true;
              break;
            }
          }

          if (!found) {
            continue;
          }

          // Matching component found
          resp->res.jsonValue["@odata.id"] = crow::utility::urlFromPieces(
              "redfish", "v1", "ComponentIntegrity", componentId);

          resp->res.jsonValue["Name"] = "Component Integrity";
          resp->res.jsonValue["Id"] = componentId;
          resp->res.jsonValue["SPDM"]["Requester"]["@odata.id"] =
              crow::utility::urlFromPieces("redfish", "v1", "Managers", "bmc");

          addSPDMGetSignedMeasurementsLinks(
              resp->res
                  .jsonValue["Actions"]
                            ["#ComponentIntegrity.SPDMGetSignedMeasurements"],
              componentId);

          handler(objectPath, serviceMap);
          return;
        }
        messages::resourceNotFound(resp->res, "ComponentIntegrity",
                                   componentId);
      });
}

inline void handleComponentIntegrityCollectionGet(
    crow::App& app, const crow::Request& req,
    const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) {
  if (!redfish::setUpRedfishRoute(app, req, asyncResp)) {
    return;
  }
  asyncResp->res.jsonValue["@odata.type"] =
      "#ComponentIntegrityCollection.ComponentIntegrityCollection";
  asyncResp->res.jsonValue["@odata.id"] = "/redfish/v1/ComponentIntegrity";
  asyncResp->res.jsonValue["Name"] = "Component Integrity Collection";
  asyncResp->res.jsonValue["Description"] = "Collection of Component Integrity";

  collection_util::getCollectionMembers(
      asyncResp, boost::urls::url("/redfish/v1/ComponentIntegrity"),
      componentIntegrityInterfaces, "/xyz/openbmc_project/ComponentIntegrity");
}

inline void handleComponentIntegrityGet(
    crow::App& app, const crow::Request& req,
    const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
    const std::string& componentId) {
  if (!redfish::setUpRedfishRoute(app, req, asyncResp)) {
    return;
  }
  asyncResp->res.addHeader(boost::beast::http::field::link,
                           "</redfish/v1/JsonSchemas/ComponentIntegrity/"
                           "ComponentIntegrity.json>; rel=describedby");
  asyncResp->res.jsonValue["@odata.type"] =
      "#ComponentIntegrity.v1_2_0.ComponentIntegrity";

  getComponentObject(asyncResp, componentId,
                     std::bind_front(getComponentData, asyncResp));
}

inline void handleSPDMGetSignedMeasurementsActionInfoGet(
    crow::App& app, const crow::Request& req,
    const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
    const std::string& componentId) {
  if (!redfish::setUpRedfishRoute(app, req, asyncResp)) {
    return;
  }

  asyncResp->res.jsonValue["@odata.type"] = "#ActionInfo.v1_3_0.ActionInfo";
  asyncResp->res.jsonValue["@odata.id"] = crow::utility::urlFromPieces(
      "redfish", "v1", "ComponentIntegrity", componentId,
      "SPDMGetSignedMeasurementsActionInfo");

  asyncResp->res.jsonValue["Name"] = "SPDMGetSignedMeasurements Action Info";
  asyncResp->res.jsonValue["Id"] = "SPDMGetSignedMeasurementsActionInfo";

  nlohmann::json::array_t parameters;
  nlohmann::json::object_t indices;
  nlohmann::json::object_t nonce;
  nlohmann::json::object_t slotId;

  indices["Name"] = "MeasurementIndices";
  indices["Required"] = false;
  indices["DataType"] = "NumberArray";

  nonce["Name"] = "Nonce";
  nonce["Required"] = false;
  nonce["DataType"] = "String";

  slotId["Name"] = "SlotId";
  slotId["Required"] = false;
  slotId["DataType"] = "Number";

  parameters.emplace_back(std::move(indices));
  parameters.emplace_back(std::move(nonce));
  parameters.emplace_back(std::move(slotId));
  asyncResp->res.jsonValue["Parameters"] = std::move(parameters);
}

inline void handleComponentIntegritySPDMGetSignedMeasurementsActionPost(
    App& app, const crow::Request& req,
    const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
    const std::string& componentId) {
  if (!redfish::setUpRedfishRoute(app, req, asyncResp)) {
    return;
  }
  BMCWEB_LOG_DEBUG << "Post ComponentIntegrity SPDMGetSignedMeasurements.";

  // GetSubTree on interfaces which provide info about certificate.
  constexpr std::array<std::string_view, 1> interfaces = {
      attestationMeasurementSetIntf};

  managedStore::ManagedObjectStoreContext context(asyncResp);
  managedStore::GetManagedObjectStore()->getSubTree(
      "/xyz/openbmc_project/ComponentIntegrity/", 0, interfaces, context,
      [asyncResp, req, componentId](
          const boost::system::error_code& ec,
          const dbus::utility::MapperGetSubTreeResponse& subtree) {
        if (ec) {
          BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
          messages::internalError(asyncResp->res);
          return;
        }

        std::string ciPath =
            std::string("/xyz/openbmc_project/ComponentIntegrity/") +
            componentId;

        nlohmann::json reqJson;
        JsonParseResult ret = parseRequestAsJson(req, reqJson);
        if (ret != JsonParseResult::Success) {
          // We did not receive JSON request, proceed as it is RAW data
          BMCWEB_LOG_ERROR << "Parse json request failed!";
          messages::internalError(asyncResp->res);
          return;
        }

        // All fields below are optional by DMTF DSP2046_2022.3.pdf
        // default nonce empty, libspdm will generate one.
        std::optional<std::string> optNonce = "";
        // default 0 indicates using slot 0.
        std::optional<size_t> optSlotId = 0;
        // default 255(0xff) indicates requesting all measurement blocks.
        std::optional<std::vector<size_t>> optMeasurementIndices =
            std::vector<size_t>{255};

        // readJsonPatch will move on when some fields are missing, we only
        // use default value for missing fields.
        if (!json_util::readJsonPatch(
                req, asyncResp->res, "SlotId", optSlotId, "MeasurementIndices",
                optMeasurementIndices, "Nonce", optNonce)) {
          BMCWEB_LOG_DEBUG << "Using default only for missing params!";
        }

        for (const auto& [objectPath, serviceMap] : subtree) {
          // Ignore any objects which don't match component integrity
          if (objectPath.find(ciPath) == std::string::npos) {
            continue;
          }

          // Should only match one service and one object
          for (const auto& [serviceName, interfaceList] : serviceMap) {
            // SPDMGetSignedMeasurements Response
            managedStore::GetManagedObjectStore()
                ->PostDbusCallToIoContextThreadSafe(
                    asyncResp->strand_,
                    [asyncResp](const boost::system::error_code& e,
                                const sdbusplus::message::object_path& certPath,
                                const std::string& hashAlg,
                                const std::string& pubkey,
                                const std::string& signedMeasurements,
                                const std::string& signAlg,
                                const std::string& version) {
                      if (e) {
                        BMCWEB_LOG_ERROR << "DBUS response error: "
                                         << e.message();
                        messages::internalError(asyncResp->res);
                        return;
                      }

                      asyncResp->res.jsonValue["@odata.type"] =
                          "#ComponentIntegrity.v1_0_0."
                          "SPDMGetSignedMeasurementsResponse";
                      asyncResp->res.jsonValue["Version"] = version;
                      asyncResp->res.jsonValue["HashingAlgorithm"] = hashAlg;
                      asyncResp->res.jsonValue["SigningAlgorithm"] = signAlg;
                      asyncResp->res.jsonValue["SignedMeasurements"] =
                          signedMeasurements;
                      asyncResp->res.jsonValue["PublicKey"] = pubkey;

                      // handle Device Certificate
                      std::optional<nlohmann::json> certObj =
                          getChassisCert(certPath);

                      if (certObj != std::nullopt) {
                        asyncResp->res.jsonValue["Certificate"] = *certObj;
                      } else {
                        BMCWEB_LOG_ERROR << "Unable to parse certPath: "
                                         << std::string(certPath);
                        messages::internalError(asyncResp->res);
                        return;
                      }
                    },
                    serviceName, ciPath,
                    "xyz.openbmc_project.Attestation.MeasurementSet",
                    "SPDMGetSignedMeasurements", *optMeasurementIndices,
                    *optNonce, *optSlotId);
          }
        }
      });
}

inline void requestRoutesComponentIntegrityCollection(App& app) {
  BMCWEB_ROUTE(app, "/redfish/v1/ComponentIntegrity/")
      .privileges(redfish::privileges::getComponentIntegrityCollection)
      .methods(boost::beast::http::verb::get)(std::bind_front(
          handleComponentIntegrityCollectionGet, std::ref(app)));
}

inline void requestRoutesComponentIntegrity(App& app) {
  BMCWEB_ROUTE(app, "/redfish/v1/ComponentIntegrity/<str>/")
      .privileges(redfish::privileges::getComponentIntegrity)
      .methods(boost::beast::http::verb::get)(
          std::bind_front(handleComponentIntegrityGet, std::ref(app)));
}

inline void requestRoutesComponentIntegritySPDMGetSignedMeasurementsActionInfo(
    App& app) {
  BMCWEB_ROUTE(app,
               "/redfish/v1/ComponentIntegrity/<str>/"
               "SPDMGetSignedMeasurementsActionInfo")
      .privileges(redfish::privileges::getActionInfo)
      .methods(boost::beast::http::verb::get)(std::bind_front(
          handleSPDMGetSignedMeasurementsActionInfoGet, std::ref(app)));
}

inline void requestRoutesComponentIntegritySPDMGetSignedMeasurementsAction(
    App& app) {
  BMCWEB_ROUTE(app,
               "/redfish/v1/ComponentIntegrity/<str>/Actions/"
               "ComponentIntegrity.SPDMGetSignedMeasurements/")
      .privileges(redfish::privileges::getComponentIntegrity)
      .methods(boost::beast::http::verb::post)(std::bind_front(
          handleComponentIntegritySPDMGetSignedMeasurementsActionPost,
          std::ref(app)));
}

}  // namespace redfish

#endif  // THIRD_PARTY_GBMCWEB_REDFISH_CORE_LIB_COMPONENT_INTEGRITY_H_