/*
// Copyright (c) 2024 Google
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
*/
#pragma once

#include "app.hpp"
#include "dbus_utility.hpp"
#include "managed_store.hpp"
#include "managed_store_types.hpp"
#include "parsing.hpp"
#include "query.hpp"
#include "registries/privilege_registry.hpp"
#include "utils/chassis_utils.hpp"
#include "utils/collection.hpp"
#include "utils/dbus_utils.hpp"
#include "utils/json_utils.hpp"
#include "utils/system_utils.hpp"
#include "http/parsing.hpp"

#include <boost/container/flat_map.hpp>
#include <boost/system/error_code.hpp>
#include <boost/url/format.hpp>
#include <sdbusplus/asio/property.hpp>
#include <sdbusplus/message/native_types.hpp>
#include <sdbusplus/unpack_properties.hpp>
#include <sdbusplus/utility/dedup_variant.hpp>

#include <array>
#include <ctime>
#include <limits>
#include <regex>
#include <string_view>
#include <tuple>
#include <variant>
#include <vector>

#ifdef UNIT_TEST_BUILD
#include "test/g3/mock_managed_store.hpp" // NOLINT
#endif

namespace redfish
{
// Interfaces which imply a D-Bus object represents a ComponentIntegrity
constexpr std::array<std::string_view, 3> componentIntegrityInterfaces = {
    "xyz.openbmc_project.Attestation.ComponentIntegrity",
    "xyz.openbmc_project.Attestation.MeasurementSet",
    "xyz.openbmc_project.Attestation.IdentityAuthentication"};
constexpr std::array<std::string_view, 1> networkAdapterInterfaces = {
    "xyz.openbmc_project.Inventory.Item.NetworkAdapter"};
constexpr std::array<std::string_view, 2> processorsInterfaces = {
    "xyz.openbmc_project.Inventory.Item.Cpu",
    "xyz.openbmc_project.Inventory.Item.Accelerator"};

constexpr char const* spdmSecurityTechnologyType =
    "xyz.openbmc_project.Attestation.ComponentIntegrity.SecurityTechnologyType.SPDM";
constexpr char const* tpmSecurityTechnologyType =
    "xyz.openbmc_project.Attestation.ComponentIntegrity.SecurityTechnologyType.TPM";
constexpr char const* oemSecurityTechnologyType =
    "xyz.openbmc_project.Attestation.ComponentIntegrity.SecurityTechnologyType.OEM";
constexpr char const* successVerificationStatus =
    "xyz.openbmc_project.Attestation.IdentityAuthentication.VerificationStatus.Success";
constexpr char const* attestationComponentIntegrityIntf =
    "xyz.openbmc_project.Attestation.ComponentIntegrity";
constexpr char const* attestationIntegrityAuthIntf =
    "xyz.openbmc_project.Attestation.IdentityAuthentication";
constexpr char const* attestationMeasurementSetIntf =
    "xyz.openbmc_project.Attestation.MeasurementSet";

inline std::string getTrustedComponent(const std::string& dbusPath)
{
    std::string chassis;
    std::string component;

    // Map D-Bus object path to the Redfish URI
    // Example targetComponentURI
    //     "/xyz/openbmc_project/Chassis/chassis01/TrustedComponent/tc01"
    // which should maps to
    //     "/redfish/v1/Chassis/chassis01/TrustedComponent/tc01"

    // These regexes derived on the rules here:
    // https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-names
    const static std::regex validPath(
        "/xyz/openbmc_project/Chassis/([A-Za-z0-9_]+)/TrustedComponents/([A-Za-z0-9_]+)");
    std::smatch matches;

    if (regex_match(dbusPath, matches, validPath))
    {
        chassis = matches[1];
        component = matches[2];
    }
    else
    {
        BMCWEB_LOG_ERROR << "Can't parse TrustedComponent object path:"
                         << dbusPath;
        return "";
    }

    boost::urls::url uri = crow::utility::urlFromPieces(
        "redfish", "v1", "Chassis", chassis, "TrustedComponents", component);
    std::string trustedComponent(uri.c_str());

    return trustedComponent;
}

inline std::optional<nlohmann::json> getChassisCert(const std::string& dbusPath)
{
    nlohmann::json::object_t certObj;
    std::string chassis;
    std::string cert;

    // Map D-Bus object to Redfish URI
    // Example chassis cert object path:
    //     "/xyz/openbmc_project/certs/chassis/chassis01/cert01"
    // which should maps to:
    //     "/redfish/v1/Chassis/chassis01/Certificates/cert01"

    // These regexes derived on the rules here:
    // https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-names
    const static std::regex validPath("/xyz/openbmc_project/certs/chassis/([A-Za-z0-9_]+)/([A-Za-z0-9_]+)");
    std::smatch matches;

    if (regex_match(dbusPath, matches, validPath))
    {
        chassis = matches[1];
        cert = matches[2];
    }
    else
    {
        BMCWEB_LOG_ERROR << "Can't parse DBus certificate object path:"
                         << dbusPath;
        return std::nullopt;
    }

    certObj["@odata.id"] = crow::utility::urlFromPieces(
        "redfish", "v1", "Chassis", chassis, "Certificates", cert);

    return {std::move(certObj)};
}

inline void getProtectedComponentsInfo(
    const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
    const std::string& currentObjPath,
    const boost::system::error_code& ec,
    const dbus::utility::MapperEndPoints& protectedComponentObjPaths)
{
    if (ec)
    {
        if (ec.value() != EBADR)
        {
            BMCWEB_LOG_ERROR << "DBUS response error " << ec;
            messages::internalError(asyncResp->res);
        }
        return;
    }

    if (protectedComponentObjPaths.empty())
    {
        return;
    }

    managedStore::ManagedObjectStoreContext requestContext(asyncResp);
    for (const auto& objpath: protectedComponentObjPaths)
    {
        sdbusplus::message::object_path protectedComponentObjPath(objpath);
        const std::string objName = protectedComponentObjPath.filename();
        if (objName.empty())
        {
            BMCWEB_LOG_WARNING << "Malformed protected component object path "
                               << protectedComponentObjPath.str << " for "
                               << currentObjPath;
            continue;
        }
        managedStore::GetManagedObjectStore()->getDbusObject(
            objpath, {}, requestContext,
            [asyncResp, protectedComponentObjPath, currentObjPath,
             requestContext, objName](const boost::system::error_code& ec2,
                                const dbus::utility::MapperGetObject& object) {
            if (ec2)
            {
                BMCWEB_LOG_ERROR << "DBUS response error";
                messages::internalError(asyncResp->res);
                return;
            }

            nlohmann::json& jValue =
                asyncResp->res.jsonValue["Links"]["ComponentsProtected"];

            if (!jValue.is_array())
            {
                // Create the array if it was empty
                jValue = nlohmann::json::array();
            }

            // Link can be Chassis or Board, Processor, and NetworkAdapters
            // handle Chassis or Board case
            if (redfish::dbus_utils::findInterfacesInServiceMap(
                    object, redfish::chassis_utils::chassisInterfaces))
            {
                nlohmann::json link;
                link["@odata.id"] = crow::utility::urlFromPieces(
                    "redfish", "v1", "Chassis", objName);
                jValue.push_back(std::move(link));
                return;
            }

            // handle NetworkAdaptors: parent resource can only be Chassis.
            if (redfish::dbus_utils::findInterfacesInServiceMap(
                    object, networkAdapterInterfaces))
            {
                const std::string parentObj =
                    protectedComponentObjPath.parent_path().filename();
                if (parentObj.empty())
                {
                    BMCWEB_LOG_WARNING << "Malformed protectedComponent object path "
                                       << protectedComponentObjPath.str << " for "
                                       << currentObjPath;
                    return;
                }

                nlohmann::json link;
                link["@odata.id"] = crow::utility::urlFromPieces(
                    "redfish", "v1", "Chassis", parentObj, "NetworkAdapters", objName);
                jValue.push_back(std::move(link));
                return;
            }

            // handle Processor: parent resource can be Systems or Chassis.
            if (redfish::dbus_utils::findInterfacesInServiceMap(
                    object, processorsInterfaces))
            {
                std::string parentPath =
                    protectedComponentObjPath.parent_path().str;
                std::string parentObj =
                    protectedComponentObjPath.parent_path().filename();
                // e.g., /xyz/openbmc_project/inventory/system/board/BoardName/system1/chassis/motherboard/cpu0
                // filter out chassis|motherboard in object path.
                while (parentObj == "motherboard" || parentObj == "chassis") {
                    sdbusplus::message::object_path tempObjPath(parentPath);
                    parentPath = tempObjPath.parent_path().str;
                    parentObj = tempObjPath.parent_path().filename();
                }
                if (parentObj.empty())
                {
                    BMCWEB_LOG_WARNING << "Malformed protectedComponentObjPath "
                                       << protectedComponentObjPath.str << " for "
                                       << currentObjPath;
                    return;
                }
                managedStore::GetManagedObjectStore()->getDbusObject(
                    parentPath, {}, requestContext,
                    [asyncResp, objName,
                     parentObj](const boost::system::error_code& ec2,
                                        const dbus::utility::MapperGetObject& object) {
                    if (ec2)
                    {
                        BMCWEB_LOG_ERROR << "DBUS response error";
                        messages::internalError(asyncResp->res);
                        return;
                    }

                    nlohmann::json& jValue =
                        asyncResp->res.jsonValue["Links"]["ComponentsProtected"];
                    if (!jValue.is_array())
                    {
                        // Create the array if it was empty
                        jValue = nlohmann::json::array();
                    }

                    std::string parentResourceType;
                    if (redfish::dbus_utils::findInterfacesInServiceMap(
                            object, redfish::chassis_utils::chassisInterfaces))
                    {
                        parentResourceType = "Chassis";
                    } else if (redfish::dbus_utils::findInterfacesInServiceMap(
                            object, redfish::system_utils::systemInterfaces))
                    {
                        parentResourceType = "Systems";
                    } else {
                        BMCWEB_LOG_ERROR << "Parent resource type not "
                                            "supported for Processor resource";
                        messages::internalError(asyncResp->res);
                        return;
                    }

                    nlohmann::json link;
                    link["@odata.id"] = crow::utility::urlFromPieces(
                        "redfish", "v1", parentResourceType, parentObj,
                        "Processors", objName);
                    jValue.push_back(std::move(link));
                    return;
                });

                return;
            } // end of Processor interfaces handling

            // Unsupported resource type
            BMCWEB_LOG_ERROR << "Unsupported ComponentsProtected resource for "
                             << protectedComponentObjPath.str;
            messages::internalError(asyncResp->res);
            return;
        });
    }
}


/**
 * @brief Fill out ComponentIntegrity related info by
 * requesting data from the given D-Bus object.
 *
 * @param[in,out]   aResp       Async HTTP response.
 * @param[in]       service     D-Bus service to query.
 * @param[in]       objPath     D-Bus object to query.
 */
inline void getComponentIntegrityData(const std::shared_ptr<bmcweb::AsyncResp>& aResp,
                                      const std::string& service,
                                      const std::string& objPath)
{
    BMCWEB_LOG_DEBUG << "Get ComponentIntegrity Data";
    managedStore::ManagedObjectStoreContext context(aResp);
    managedStore::GetManagedObjectStore()->getAllProperties(
        service, objPath,
        attestationComponentIntegrityIntf,
        context,
        [objPath, aResp{aResp}, context](
            const boost::system::error_code& ec,
            const std::vector<std::pair<
                std::string, dbus::utility::DbusVariantType>>& properties) {
        if (ec)
        {
            BMCWEB_LOG_DEBUG << "DBUS response error";
            messages::internalError(aResp->res);
            return;
        }

        const bool* enabled = nullptr;
        const std::string* type = nullptr;
        const std::string* typeVersion = nullptr;
        const std::uint64_t* lastUpdated = nullptr;

        const bool success = sdbusplus::unpackPropertiesNoThrow(
            dbus_utils::UnpackErrorPrinter(), properties, "Enabled", enabled,
            "Type", type, "TypeVersion", typeVersion, "LastUpdated",
            lastUpdated);

        if (!success)
        {
            messages::internalError(aResp->res);
            return;
        }

        if (enabled != nullptr)
        {
            if (*enabled)
            {
                aResp->res.jsonValue["ComponentIntegrityEnabled"] = true;
            } else
            {
                aResp->res.jsonValue["ComponentIntegrityEnabled"] = false;
            }
        } else {
            messages::internalError(aResp->res);
            return;
        }

        if ((type != nullptr) && !type->empty())
        {
            if (*type == spdmSecurityTechnologyType)
            {
                aResp->res.jsonValue["ComponentIntegrityType"] = "SPDM";
                aResp->res.jsonValue["Description"] =
                    "SPDM-capable RoT physically attached to a device.";
            } else if (*type == tpmSecurityTechnologyType)
            {
                aResp->res.jsonValue["ComponentIntegrityType"] = "TPM";
                aResp->res.jsonValue["Description"] =
                    "TPM physically attached to a device.";
            } else if (*type == oemSecurityTechnologyType)
            {
                aResp->res.jsonValue["ComponentIntegrityType"] = "OEM";
                aResp->res.jsonValue["Description"] =
                    "OEM-specific RoT physically attached to a device.";
            } else
            {
                messages::internalError(aResp->res);
                return;
            }
        }

        if ((typeVersion != nullptr) && !typeVersion->empty())
        {
            aResp->res.jsonValue["ComponentIntegrityTypeVersion"] =
                *typeVersion;
        }

        if ((lastUpdated != nullptr) && *lastUpdated != 0)
        {
            time_t ts = static_cast<time_t>(*lastUpdated);
            const struct tm* tminfo = localtime(&ts);

            /**
             * The date of component update in ISO 8601 format as
             * YYYYMMDDThhmmssZ. Where 'T' is a literal character to separate
             * date fields from time and 'Z' is a literal character to indicate
             * UTC.
             */
            char iso8601[40]; // NOLINT
            std::strftime(static_cast<char *>(iso8601), sizeof(iso8601), "%Y%m%dT%H%M%SZ", tminfo);
            aResp->res.jsonValue["LastUpdated"] = std::string(static_cast<char *>(iso8601));
        }

        // Get trusted components info from associations.
        std::string targetComponentPath = objPath + "/reporting";
        dbus_utils::getAssociationEndPoints(
            targetComponentPath, context,
            [aResp](const boost::system::error_code& e,
                    const dbus::utility::MapperEndPoints&
                        nodeTrustedComponentList) {
            if (e)
            {
                if (e.value() != EBADR)
                {
                    messages::internalError(aResp->res);
                    return;
                }
                // No resource found.
                return;
            }

            // One ComponentIntegrity object should be associated with one
            // TrustedComponent object
            if (nodeTrustedComponentList.size() == 1)
            {
                const std::string& componentURI =
                    nodeTrustedComponentList.at(0);

                std::string targetComponentURI = getTrustedComponent(componentURI);

                if (!targetComponentURI.empty())
                {
                    aResp->res.jsonValue["TargetComponentURI"] =
                        targetComponentURI;
                } else {
                    BMCWEB_LOG_ERROR
                        << "Can't parse TargetComponentURI : "
                        << componentURI;
                    messages::internalError(aResp->res);
                    return;
                }
            } else {
                BMCWEB_LOG_ERROR
                    << "Unexpected TargetComponent #objs (expecting 1): "
                    << nodeTrustedComponentList.size();
                messages::internalError(aResp->res);
                return;
            }
        });

        // Get protected components info from associations.
        std::string protectedComponentPath = objPath + "/authenticating";
        dbus_utils::getAssociationEndPoints(
            protectedComponentPath, context,
            std::bind_front(getProtectedComponentsInfo, aResp,
            objPath));
    });
}

/**
 * @brief Fill out {ComponentIntegrityId}#/SPDM/IdentityAuthentication
 * related info by requesting data from the given D-Bus object.
 *
 * @param[in,out]   aResp       Async HTTP response.
 * @param[in]       service     D-Bus service to query.
 * @param[in]       objPath     D-Bus object to query.
 */
inline void getSPDMAuthenticationData(const std::shared_ptr<bmcweb::AsyncResp>& aResp,
                                      const std::string& service,
                                      const std::string& objPath)
{
    BMCWEB_LOG_DEBUG << "Get {ComponentIntegrityId}#/SPDM/IdentyAuthentication Data";
    managedStore::ManagedObjectStoreContext context(aResp);
    managedStore::GetManagedObjectStore()->getAllProperties(
        service, objPath, attestationIntegrityAuthIntf, context,
        [objPath, aResp{aResp}, context](
            const boost::system::error_code& ec,
            const std::vector<std::pair<
                std::string, dbus::utility::DbusVariantType>>& properties) {
        if (ec)
        {
            BMCWEB_LOG_ERROR << "DBUS response error!";
            messages::internalError(aResp->res);
            return;
        }

        const std::string* respStatus = nullptr;

        const bool success = sdbusplus::unpackPropertiesNoThrow(
            dbus_utils::UnpackErrorPrinter(), properties,
            "ResponderVerificationStatus", respStatus);

        if (!success)
        {
            messages::internalError(aResp->res);
            return;
        }

        if (respStatus != nullptr && !respStatus->empty())
        {
            if (*respStatus == successVerificationStatus)
            {
                aResp->res.jsonValue["SPDM"]["IdentityAuthentication"]["ResponderAuthentication"]["VerificationStatus"] = "Success";
            } else
            {
                aResp->res.jsonValue["SPDM"]["IdentityAuthentication"]["ResponderAuthentication"]["VerificationStatus"] = "Failed";
            }
        }

        // Get associated certs objects.
        std::string reqCertPath = objPath + "/requester_identified_by";
        dbus_utils::getAssociationEndPoints(
            reqCertPath, context,
            [aResp](const boost::system::error_code& e,
                    const dbus::utility::MapperEndPoints& nodeReqCertList) {
            if (e)
            {
                if (e.value() != EBADR)
                {
                    messages::internalError(aResp->res);
                    return;
                }
                // No resource found.
                return;
            }

            nlohmann::json& json = aResp->res.jsonValue;

            // One ComponentIntegrity object should be associated with one
            // requester certificate object or none
            if (nodeReqCertList.empty())
            {
                return;
            }

            if (nodeReqCertList.size() > 1)
            {
                BMCWEB_LOG_ERROR << "More than one requester cert provided!";
                messages::internalError(aResp->res);
                return;
            }

            // There is one valid cert, handle it
            const std::string& certPath = nodeReqCertList.at(0);

            std::optional<nlohmann::json> reqCertObj =
                getChassisCert(certPath);

            if (reqCertObj != std::nullopt)
            {
                json["SPDM"]["IdentityAuthentication"]["RequesterAuthentication"]["ProvidedCertificate"] = *reqCertObj;
            } else
            {
                // Requester Cert is not required, no need to report error.
                BMCWEB_LOG_DEBUG << "Unable to parse requester certPath: "
                                 << certPath;
            }
        });

        // Get associated response certs objects.
        std::string respCertPath = objPath + "/responder_identified_by";
        dbus_utils::getAssociationEndPoints(
            respCertPath, context,
            [aResp](const boost::system::error_code& e,
                    const dbus::utility::MapperEndPoints& nodeRespCertList) {
            if (e)
            {
                if (e.value() != EBADR)
                {
                    messages::internalError(aResp->res);
                    return;
                }
                // No resource found.
                return;
            }

            nlohmann::json& json = aResp->res.jsonValue;

            // One ComponentIntegrity object should be associated with one
            // responder certificate object
            if (nodeRespCertList.size() != 1)
            {
                BMCWEB_LOG_ERROR
                    << "Unexpected Responder Cert #objs (expecting 1): "
                    << nodeRespCertList.size();
                messages::internalError(aResp->res);
                return;
            }

            const std::string& certPath = nodeRespCertList.at(0);

            std::optional<nlohmann::json> respCertObj =
                getChassisCert(certPath);

            if (respCertObj != std::nullopt)
            {
                json["SPDM"]["IdentityAuthentication"]["ResponderAuthentication"]["ComponentCertificate"] = *respCertObj;
            } else
            {
                BMCWEB_LOG_ERROR << "Unable to parse responder certPath: "
                                 << certPath;
                messages::internalError(aResp->res);
                return;
            }
        });
    });
}

inline void getComponentData(const std::shared_ptr<bmcweb::AsyncResp>& aResp,
                             const std::string& objectPath,
                             const dbus::utility::MapperServiceMap& serviceMap)
{
    for (const auto& [serviceName, interfaceList] : serviceMap)
    {
        for (const auto& interface : interfaceList)
        {
            if (interface == attestationComponentIntegrityIntf)
            {
                getComponentIntegrityData(aResp, serviceName, objectPath);
            }
            else if (interface == attestationIntegrityAuthIntf)
            {
                getSPDMAuthenticationData(aResp, serviceName, objectPath);
            }
        }
    }
}

inline void addSPDMGetSignedMeasurementsLinks(nlohmann::json& getMeasurement,
                                              const std::string& componentId)
{
    getMeasurement["target"] = crow::utility::urlFromPieces(
        "redfish", "v1", "ComponentIntegrity", componentId, "Actions",
        "ComponentIntegrity.SPDMGetSignedMeasurements");
    getMeasurement["@Redfish.ActionInfo"] = crow::utility::urlFromPieces(
        "redfish", "v1", "ComponentIntegrity", componentId,
        "SPDMGetSignedMeasurementsActionInfo");
}

/**
 * Find the D-Bus object representing the requested ComponentIntegrity,
 * and call the handler with the results. If matching object is not
 * found, add 404 error to response and don't call the handler.
 *
 * @param[in,out]   resp            Async HTTP response.
 * @param[in]       processorId     Redfish Processor Id.
 * @param[in]       handler         Callback to continue processing request upon
 *                                  successfully finding object.
 */
template <typename Handler>
inline void getComponentObject(const std::shared_ptr<bmcweb::AsyncResp>& resp,
                               const std::string& componentId,
                               Handler&& handler)
{
    BMCWEB_LOG_DEBUG << "Get available system component integrity resources.";

    // GetSubTree on all interfaces which provide info about a
    // component_integrity.
    managedStore::ManagedObjectStoreContext context(resp);
    managedStore::GetManagedObjectStore()->getSubTree(
        "/xyz/openbmc_project/ComponentIntegrity/", 0,
        componentIntegrityInterfaces, context,
        [resp, componentId, handler](
            const boost::system::error_code& ec,
            const dbus::utility::MapperGetSubTreeResponse& subtree) {
        if (ec)
        {
            BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
            messages::internalError(resp->res);
            return;
        }
        for (const auto& [objectPath, serviceMap] : subtree)
        {
            // Ignore any objects which don't end with our desired
            // componentintegrity name
            if (!objectPath.ends_with(componentId))
            {
                continue;
            }

            bool found = false;
            // Filter out objects that don't have the
            // ComponentIntegrity-specific interfaces to make sure we can return
            // 404 on non-ComponentIntegrity
            for (const auto& [serviceName, interfaceList] : serviceMap)
            {
                if (std::find_first_of(interfaceList.begin(),
                                       interfaceList.end(),
                                       componentIntegrityInterfaces.begin(),
                                       componentIntegrityInterfaces.end()) !=
                    interfaceList.end())
                {
                    found = true;
                    break;
                }
            }

            if (!found)
            {
                continue;
            }

            // Matching component found
            resp->res.jsonValue["@odata.id"] = crow::utility::urlFromPieces(
                "redfish", "v1", "ComponentIntegrity", componentId);

            resp->res.jsonValue["Name"] = "Component Integrity";
            resp->res.jsonValue["Id"] = componentId;
            resp->res.jsonValue["SPDM"]["Requester"]["@odata.id"] =
                crow::utility::urlFromPieces("redfish", "v1", "Managers", "bmc");

            addSPDMGetSignedMeasurementsLinks(
                resp->res.jsonValue["Actions"]["#ComponentIntegrity.SPDMGetSignedMeasurements"],
                componentId);

            handler(objectPath, serviceMap);
            return;
        }
        messages::resourceNotFound(resp->res, "ComponentIntegrity",
                                   componentId);
    });
}

inline void handleComponentIntegrityCollectionGet(
    crow::App& app, const crow::Request& req,
    const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
{
    if (!redfish::setUpRedfishRoute(app, req, asyncResp))
    {
        return;
    }
    asyncResp->res.jsonValue["@odata.type"] =
        "#ComponentIntegrityCollection.ComponentIntegrityCollection";
    asyncResp->res.jsonValue["@odata.id"] = "/redfish/v1/ComponentIntegrity";
    asyncResp->res.jsonValue["Name"] = "Component Integrity Collection";
    asyncResp->res.jsonValue["Description"] =
        "Collection of Component Integrity";

    collection_util::getCollectionMembers(
        asyncResp, boost::urls::url("/redfish/v1/ComponentIntegrity"),
        componentIntegrityInterfaces,
        "/xyz/openbmc_project/ComponentIntegrity");
}

inline void handleComponentIntegrityGet(
    crow::App& app, const crow::Request& req,
    const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
    const std::string& componentId)
{
    if (!redfish::setUpRedfishRoute(app, req, asyncResp))
    {
        return;
    }
    asyncResp->res.addHeader(
        boost::beast::http::field::link,
        "</redfish/v1/JsonSchemas/ComponentIntegrity/ComponentIntegrity.json>; rel=describedby");
    asyncResp->res.jsonValue["@odata.type"] =
        "#ComponentIntegrity.v1_2_0.ComponentIntegrity";

    getComponentObject(asyncResp, componentId,
                       std::bind_front(getComponentData, asyncResp));
}

inline void handleSPDMGetSignedMeasurementsActionInfoGet(
    crow::App& app, const crow::Request& req,
    const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
    const std::string& componentId)
{
    if (!redfish::setUpRedfishRoute(app, req, asyncResp))
    {
        return;
    }

    asyncResp->res.jsonValue["@odata.type"] =
        "#ActionInfo.v1_3_0.ActionInfo";
    asyncResp->res.jsonValue["@odata.id"] = crow::utility::urlFromPieces(
        "redfish", "v1", "ComponentIntegrity", componentId,
        "SPDMGetSignedMeasurementsActionInfo");

    asyncResp->res.jsonValue["Name"] = "SPDMGetSignedMeasurements Action Info";
    asyncResp->res.jsonValue["Id"] =
        "SPDMGetSignedMeasurementsActionInfo";

    nlohmann::json::array_t parameters;
    nlohmann::json::object_t indices;
    nlohmann::json::object_t nonce;
    nlohmann::json::object_t slotId;

    indices["Name"] = "MeasurementIndices";
    indices["Required"] = false;
    indices["DataType"] = "NumberArray";

    nonce["Name"] = "Nonce";
    nonce["Required"] = false;
    nonce["DataType"] = "String";

    slotId["Name"] = "SlotId";
    slotId["Required"] = false;
    slotId["DataType"] = "Number";

    parameters.emplace_back(std::move(indices));
    parameters.emplace_back(std::move(nonce));
    parameters.emplace_back(std::move(slotId));
    asyncResp->res.jsonValue["Parameters"] = std::move(parameters);
}

inline void handleComponentIntegritySPDMGetSignedMeasurementsActionPost(
    App& app, const crow::Request& req,
    const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
    const std::string& componentId)
{
    if (!redfish::setUpRedfishRoute(app, req, asyncResp))
    {
        return;
    }
    BMCWEB_LOG_DEBUG << "Post ComponentIntegrity SPDMGetSignedMeasurements.";

    // GetSubTree on interfaces which provide info about certificate.
    constexpr std::array<std::string_view, 1> interfaces = {
        attestationMeasurementSetIntf};

    managedStore::ManagedObjectStoreContext context(asyncResp);
    managedStore::GetManagedObjectStore()->getSubTree(
        "/xyz/openbmc_project/ComponentIntegrity/", 0, interfaces, context,
        [asyncResp, req, componentId](const boost::system::error_code& ec,
                      const dbus::utility::MapperGetSubTreeResponse& subtree) {
        if (ec)
        {
            BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
            messages::internalError(asyncResp->res);
            return;
        }

        std::string ciPath =
            std::string("/xyz/openbmc_project/ComponentIntegrity/") +
            componentId;

        nlohmann::json reqJson;
        JsonParseResult ret = parseRequestAsJson(req, reqJson);
        if (ret != JsonParseResult::Success)
        {
            // We did not receive JSON request, proceed as it is RAW data
            BMCWEB_LOG_ERROR << "Parse json request failed!";
            messages::internalError(asyncResp->res);
            return;
        }

        // All fields below are optional by DMTF DSP2046_2022.3.pdf
        // default nonce empty, libspdm will generate one.
        std::optional<std::string> optNonce = "";
        // default 0 indicates using slot 0.
        std::optional<size_t> optSlotId = 0;
        // default 255(0xff) indicates requesting all measurement blocks.
        std::optional<std::vector<size_t>> optMeasurementIndices =
            std::vector<size_t>{255};

        // readJsonPatch will move on when some fields are missing, we only
        // use default value for missing fields.
        if (!json_util::readJsonPatch(req, asyncResp->res, "SlotId", optSlotId,
                                      "MeasurementIndices",
                                      optMeasurementIndices, "Nonce", optNonce))
        {
            BMCWEB_LOG_DEBUG << "Using default only for missing params!";
        }

        for (const auto& [objectPath, serviceMap] : subtree)
        {
            // Ignore any objects which don't match component integrity
            if (objectPath.find(ciPath) == std::string::npos)
            {
                continue;
            }

            // Should only match one service and one object
            for (const auto& [serviceName, interfaceList] : serviceMap)
            {
                // SPDMGetSignedMeasurements Response
                managedStore::GetManagedObjectStore()->PostDbusCallToIoContextThreadSafe(
                    asyncResp->strand_,
                    [asyncResp](const boost::system::error_code& e,
                    const sdbusplus::message::object_path& certPath,
                    const std::string& hashAlg,
                    const std::string& pubkey,
                    const std::string& signedMeasurements,
                    const std::string& signAlg,
                    const std::string& version) {
                    if (e)
                    {
                        BMCWEB_LOG_ERROR << "DBUS response error: "
                                         << e.message();
                        messages::internalError(asyncResp->res);
                        return;
                    }

                    asyncResp->res.jsonValue["@odata.type"] =
                        "#ComponentIntegrity.v1_0_0.SPDMGetSignedMeasurementsResponse";
                    asyncResp->res.jsonValue["Version"] = version;
                    asyncResp->res.jsonValue["HashingAlgorithm"] = hashAlg;
                    asyncResp->res.jsonValue["SigningAlgorithm"] = signAlg;
                    asyncResp->res.jsonValue["SignedMeasurements"] =
                        signedMeasurements;
                    asyncResp->res.jsonValue["PublicKey"] = pubkey;

                    // handle Device Certificate
                    std::optional<nlohmann::json> certObj =
                        getChassisCert(certPath);

                    if (certObj != std::nullopt)
                    {
                        asyncResp->res.jsonValue["Certificate"] = *certObj;
                    } else
                    {
                        BMCWEB_LOG_ERROR << "Unable to parse certPath: "
                                         << std::string(certPath);
                        messages::internalError(asyncResp->res);
                        return;
                    }
                },
                    serviceName, ciPath,
                    "xyz.openbmc_project.Attestation.MeasurementSet",
                    "SPDMGetSignedMeasurements", *optMeasurementIndices,
                    *optNonce, *optSlotId);
            }
        }
    });
}

inline void requestRoutesComponentIntegrityCollection(App& app)
{
    BMCWEB_ROUTE(app, "/redfish/v1/ComponentIntegrity/")
        .privileges(redfish::privileges::getComponentIntegrityCollection)
        .methods(boost::beast::http::verb::get)(std::bind_front(
            handleComponentIntegrityCollectionGet, std::ref(app)));
}

inline void requestRoutesComponentIntegrity(App& app)
{
    BMCWEB_ROUTE(app, "/redfish/v1/ComponentIntegrity/<str>/")
        .privileges(redfish::privileges::getComponentIntegrity)
        .methods(boost::beast::http::verb::get)(
            std::bind_front(handleComponentIntegrityGet, std::ref(app)));
}

inline void requestRoutesComponentIntegritySPDMGetSignedMeasurementsActionInfo(App& app)
{
    BMCWEB_ROUTE(app,
        "/redfish/v1/ComponentIntegrity/<str>/SPDMGetSignedMeasurementsActionInfo")
        .privileges(redfish::privileges::getActionInfo)
        .methods(boost::beast::http::verb::get)(
            std::bind_front(handleSPDMGetSignedMeasurementsActionInfoGet, std::ref(app)));
}

inline void
    requestRoutesComponentIntegritySPDMGetSignedMeasurementsAction(App& app)
{
    BMCWEB_ROUTE(
        app,
        "/redfish/v1/ComponentIntegrity/<str>/Actions/ComponentIntegrity.SPDMGetSignedMeasurements/")
        .privileges(redfish::privileges::getComponentIntegrity)
        .methods(boost::beast::http::verb::post)(std::bind_front(
            handleComponentIntegritySPDMGetSignedMeasurementsActionPost,
            std::ref(app)));
}

} // namespace redfish