/*
 * Copyright (C) 2008-2020, Juick
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation, either version 3 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

package com.github.scribejava.apis;

import com.github.scribejava.core.builder.api.DefaultApi20;
import com.github.scribejava.core.oauth2.clientauthentication.ClientAuthentication;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.jwk.source.JWKSource;
import com.nimbusds.jose.jwk.source.RemoteJWKSet;
import com.nimbusds.jose.proc.BadJOSEException;
import com.nimbusds.jose.proc.JWSKeySelector;
import com.nimbusds.jose.proc.JWSVerificationKeySelector;
import com.nimbusds.jose.proc.SecurityContext;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.proc.ConfigurableJWTProcessor;
import com.nimbusds.jwt.proc.DefaultJWTClaimsVerifier;
import com.nimbusds.jwt.proc.DefaultJWTProcessor;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import java.net.MalformedURLException;
import java.net.URL;
import java.text.ParseException;
import java.util.Map;
import java.util.Optional;
import java.util.Set;

public class AppleSignInApi extends DefaultApi20 {

    private static final Logger logger = LoggerFactory.getLogger("JWT");
    private final AppleClientSecretGenerator clientSecretGenerator;
    private final String applicationId;

    public AppleSignInApi(AppleClientSecretGenerator clientSecretGenerator, String applicationId) {
        this.clientSecretGenerator = clientSecretGenerator;
        this.applicationId = applicationId;
    }

    @Override
    public String getAccessTokenEndpoint() {
        return "https://appleid.apple.com/auth/token";
    }

    @Override
    protected String getAuthorizationBaseUrl() {
        return "https://appleid.apple.com/auth/authorize?response_mode=form_post";
    }

    @Override
    public ClientAuthentication getClientAuthentication() {
        return new AppleClientAuthentication(clientSecretGenerator);
    }

    public Optional<String> validateToken(String idToken) {

// Create a JWT processor for the access tokens
        ConfigurableJWTProcessor<SecurityContext> jwtProcessor =
                new DefaultJWTProcessor<>();

// The public RSA keys to validate the signatures will be sourced from the
// OAuth 2.0 server's JWK set, published at a well-known URL. The RemoteJWKSet
// object caches the retrieved keys to speed up subsequent look-ups and can
// also handle key-rollover
        JWKSource<SecurityContext> keySource =
                null;
        try {
            keySource = new RemoteJWKSet<>(new URL("https://appleid.apple.com/auth/keys"));
        } catch (MalformedURLException e) {
            return Optional.empty();
        }

// The expected JWS algorithm of the access tokens (agreed out-of-band)
        JWSAlgorithm expectedJWSAlg = JWSAlgorithm.RS256;

// Configure the JWT processor with a key selector to feed matching public
// RSA keys sourced from the JWK set URL
        JWSKeySelector<SecurityContext> keySelector =
                new JWSVerificationKeySelector<>(expectedJWSAlg, keySource);

        jwtProcessor.setJWSKeySelector(keySelector);

// Set the required JWT claims for access tokens issued by the server
        jwtProcessor.setJWTClaimsSetVerifier(new DefaultJWTClaimsVerifier<>(
                new JWTClaimsSet.Builder()
                        .issuer("https://appleid.apple.com")
                        .audience(applicationId)
                        .build(),
                Set.of("exp", "iat", "aud", "email")
        ));

// Process the token
        Map<String, Object> claimsSet;
        try {
            claimsSet = jwtProcessor.process(idToken, null).toJSONObject();
        } catch (ParseException | BadJOSEException | JOSEException e) {
            logger.error(e.getMessage(), e);
            return Optional.empty();
        }

        String email = (String) claimsSet.get("email");
        boolean verified = claimsSet.get("email_verified").equals(true);
        logger.debug("Email {} verified: {}", email, verified);
        return verified ? Optional.of(email) : Optional.empty();
    }
}