/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

package org.apache.guacamole.auth.totp.form;

import com.google.common.io.BaseEncoding;
import com.google.inject.Inject;
import com.google.zxing.BarcodeFormat;
import com.google.zxing.WriterException;
import com.google.zxing.client.j2se.MatrixToImageWriter;
import com.google.zxing.common.BitMatrix;
import com.google.zxing.qrcode.QRCodeWriter;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.net.URI;
import javax.ws.rs.core.UriBuilder;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.auth.totp.user.UserTOTPKey;
import org.apache.guacamole.auth.totp.conf.ConfigurationService;
import org.apache.guacamole.form.Field;
import org.apache.guacamole.totp.TOTPGenerator;
import org.codehaus.jackson.annotate.JsonProperty;

/**
 * Field which prompts the user for an authentication code generated via TOTP.
 */
public class AuthenticationCodeField extends Field {

    /**
     * The name of the HTTP parameter which will contain the TOTP code provided
     * by the user to verify their identity.
     */
    public static final String PARAMETER_NAME = "guac-totp";

    /**
     * The unique name associated with this field type.
     */
    private static final String FIELD_TYPE_NAME = "GUAC_TOTP_CODE";

    /**
     * The width of QR codes to generate, in pixels.
     */
    private static final int QR_CODE_WIDTH = 256;

    /**
     * The height of QR codes to generate, in pixels.
     */
    private static final int QR_CODE_HEIGHT = 256;

    /**
     * BaseEncoding which encodes/decodes base32.
     */
    private static final BaseEncoding BASE32 = BaseEncoding.base32();

    /**
     * Service for retrieving configuration information.
     */
    @Inject
    private ConfigurationService confService;

    /**
     * The TOTP key to expose to the user for the sake of enrollment, if any.
     * If no such key should be exposed to the user, this will be null.
     */
    private UserTOTPKey key;

    /**
     * Creates a new field which prompts the user for an authentication code
     * generated via TOTP. The user's TOTP key is not exposed for enrollment.
     */
    public AuthenticationCodeField() {
        super(PARAMETER_NAME, FIELD_TYPE_NAME);
    }

    /**
     * Exposes the given key to facilitate enrollment.
     *
     * @param key
     *     The TOTP key to expose to the user for the sake of enrollment.
     */
    public void exposeKey(UserTOTPKey key) {
        this.key = key;
    }

    /**
     * Returns the username of the user associated with the key being used to
     * generate TOTP codes. If the user's key is not being exposed to facilitate
     * enrollment, this value will not be exposed either.
     *
     * @return
     *     The username of the user associated with the key being used to
     *     generate TOTP codes, or null if the user's key is not being exposed
     *     to facilitate enrollment.
     */
    public String getUsername() {

        // Do not reveal TOTP mode unless enrollment is in progress
        if (key == null)
            return null;

        return key.getUsername();

    }

    /**
     * Returns the base32-encoded secret key that is being used to generate TOTP
     * codes for the authenticating user. If the user's key is not being exposed
     * to facilitate enrollment, this value will not be exposed either.
     *
     * @return
     *     The base32-encoded secret key that is being used to generate TOTP
     *     codes for the authenticating user, or null if the user's key is not
     *     being exposed to facilitate enrollment.
     */
    public String getSecret() {

        // Do not reveal TOTP mode unless enrollment is in progress
        if (key == null)
            return null;

        return BASE32.encode(key.getSecret());

    }

    /**
     * Returns the number of digits used for each TOTP code. If the user's key
     * is not being exposed to facilitate enrollment, this value will not be
     * exposed either.
     *
     * @return
     *     The number of digits used for each TOTP code, or null if the user's
     *     key is not being exposed to facilitate enrollment.
     *
     * @throws GuacamoleException
     *     If the number of digits cannot be read from guacamole.properties.
     */
    public Integer getDigits() throws GuacamoleException {

        // Do not reveal code size unless enrollment is in progress
        if (key == null)
            return null;

        return confService.getDigits();
        
    }

    /**
     * Returns the human-readable name of the entity issuing user accounts. If
     * the user's key is not being exposed to facilitate enrollment, this value
     * will not be exposed either.
     *
     * @return
     *     The human-readable name of the entity issuing user accounts, or null
     *     if the user's key is not being exposed to facilitate enrollment.
     *
     * @throws GuacamoleException
     *     If the issuer cannot be read from guacamole.properties.
     */
    public String getIssuer() throws GuacamoleException {

        // Do not reveal code issuer unless enrollment is in progress
        if (key == null)
            return null;

        return confService.getIssuer();

    }

    /**
     * Returns the mode that TOTP code generation is operating in. This value
     * will be one of "SHA1", "SHA256", or "SHA512". If the user's key is not
     * being exposed to facilitate enrollment, this value will not be exposed
     * either.
     *
     * @return
     *     The mode that TOTP code generation is operating in, such as "SHA1",
     *     "SHA256", or "SHA512", or null if the user's key is not being
     *     exposed to facilitate enrollment.
     *
     * @throws GuacamoleException
     *     If the TOTP mode cannot be read from guacamole.properties.
     */
    public TOTPGenerator.Mode getMode() throws GuacamoleException {

        // Do not reveal TOTP mode unless enrollment is in progress
        if (key == null)
            return null;

        return confService.getMode();

    }

    /**
     * Returns the number of seconds that each TOTP code remains valid. If the
     * user's key is not being exposed to facilitate enrollment, this value will
     * not be exposed either.
     *
     * @return
     *     The number of seconds that each TOTP code remains valid, or null if
     *     the user's key is not being exposed to facilitate enrollment.
     *
     * @throws GuacamoleException
     *     If the period cannot be read from guacamole.properties.
     */
    public Integer getPeriod() throws GuacamoleException {

        // Do not reveal code period unless enrollment is in progress
        if (key == null)
            return null;

        return confService.getPeriod();

    }

    /**
     * Returns the "otpauth" URI for the secret key used to generate TOTP codes
     * for the current user. If the secret key is not being exposed to
     * facilitate enrollment, null is returned.
     *
     * @return
     *     The "otpauth" URI for the secret key used to generate TOTP codes
     *     for the current user, or null is the secret ket is not being exposed
     *     to facilitate enrollment.
     *
     * @throws GuacamoleException
     *     If the configuration information required for generating the key URI
     *     cannot be read from guacamole.properties.
     */
    @JsonProperty("keyUri")
    public URI getKeyURI() throws GuacamoleException {

        // Do not generate a key URI if no key is being exposed
        if (key == null)
            return null;

        // Format "otpauth" URL (see https://github.com/google/google-authenticator/wiki/Key-Uri-Format)
        String issuer = confService.getIssuer();
        return UriBuilder.fromUri("otpauth://totp/")
                .path(issuer + ":" + key.getUsername())
                .queryParam("secret", BASE32.encode(key.getSecret()))
                .queryParam("issuer", issuer)
                .queryParam("algorithm", confService.getMode())
                .queryParam("digits", confService.getDigits())
                .queryParam("period", confService.getPeriod())
                .build();

    }

    /**
     * Returns the URL of a QR code describing the user's TOTP key and
     * configuration. If the key is not being exposed for enrollment, null is
     * returned.
     *
     * @return 
     *     The URL of a QR code describing the user's TOTP key and
     *     configuration, or null if the key is not being exposed for
     *     enrollment.
     *
     * @throws GuacamoleException
     *     If the configuration information required for generating the QR code
     *     cannot be read from guacamole.properties.
     */
    @JsonProperty("qrCode")
    public String getQRCode() throws GuacamoleException {

        // Do not generate a QR code if no key is being exposed
        URI keyURI = getKeyURI();
        if (keyURI == null)
            return null;

        ByteArrayOutputStream stream = new ByteArrayOutputStream();

        try {

            // Create QR code writer
            QRCodeWriter writer = new QRCodeWriter();
            BitMatrix matrix = writer.encode(keyURI.toString(),
                    BarcodeFormat.QR_CODE, QR_CODE_WIDTH, QR_CODE_HEIGHT);

            // Produce PNG image of TOTP key text
            MatrixToImageWriter.writeToStream(matrix, "PNG", stream);

        }
        catch (WriterException e) {
            throw new IllegalArgumentException("QR code could not be "
                    + "generated for TOTP key.", e);
        }
        catch (IOException e) {
            throw new IllegalStateException("Image stream of QR code could "
                    + "not be written.", e);
        }

        // Return data URI for generated image
        return "data:image/png;base64,"
                + BaseEncoding.base64().encode(stream.toByteArray());

    }

}