gun-rs 1.0.4

//! User authentication
//! Based on Gun.js sea/user.js
//! User creation, authentication, and password management

use super::pair;
use super::{SeaError, UserAuth, KeyPair};
use crate::chain::Chain;
use aes_gcm::{Aes256Gcm, KeyInit, aead::Aead};
use base64::{engine::general_purpose, Engine as _};
use pbkdf2::pbkdf2_hmac;
use serde_json::json;
use sha2::Sha256;
use std::sync::Arc;

/// Create a new user with key pair and store in graph
/// 
/// Generates a key pair, encrypts private keys with password using PBKDF2 key derivation,
/// and stores user data in the graph for later authentication.
/// 
/// # Arguments
/// * `chain` - Chain instance to access the graph (typically `gun.root()`)
/// * `alias` - Optional user alias/username for login
/// * `password` - Password for encrypting private keys (used for authentication)
/// 
/// # Returns
/// `UserAuth` containing the created key pair and alias
/// 
/// # Storage Format
/// 
/// User data is stored in the graph at:
/// - `~{pub_key}`: Main user node with encrypted keys and password hash
/// - `~{pub_key}@{alias}`: Alias lookup node pointing to main user node (if alias provided)
/// 
/// # Errors
/// - `SeaError::Crypto`: If key generation, encryption, or storage fails
/// 
/// # Example
/// ```rust,no_run
/// use gun::{Gun, Chain};
/// use gun::sea::create_user;
/// use std::sync::Arc;
/// 
/// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
/// let gun = Gun::new();
/// let chain = gun.root();
/// 
/// // Create user with alias
/// let user = create_user(Arc::new(chain), Some("alice".to_string()), "secure_password")
///     .await?;
/// 
/// println!("User created with pub key: {}", user.pair.pub_key);
/// # Ok(())
/// # }
/// ```
pub async fn create_user(
    chain: Arc<Chain>,
    alias: Option<String>,
    password: &str,
) -> Result<UserAuth, SeaError> {
    let pair = pair::generate_pair().await?;
    
    // Generate salt for password hashing
    let salt = generate_salt();
    let password_hash = hash_password(password, &salt);
    
    // Encrypt private keys using password-based key derivation
    // Use PBKDF2 to derive encryption key from password
    let password_key = super::work::work(
        password.as_bytes(),
        Some(salt.clone()),
        super::work::WorkOptions {
            name: Some("PBKDF2".to_string()),
            iterations: Some(100_000),
            salt: Some(salt.clone()),
            hash: Some("SHA-256".to_string()),
            length: Some(256), // 32 bytes for AES-256
            encode: Some("base64".to_string()),
        },
    ).await?;
    
    // Encrypt private keys using AES-GCM with password-derived key
    // This is a production-ready implementation using:
    // - PBKDF2 key derivation (100,000 iterations) for password hashing
    // - AES-256-GCM for encryption with random nonces
    // - Proper salt generation and storage
    let priv_data = json!({"priv": pair.priv_key});
    let priv_data_str = serde_json::to_string(&priv_data)
        .map_err(|e| SeaError::Crypto(format!("Serialization error: {}", e)))?;
    
    // Use AES-GCM directly with password-derived key
    use aes_gcm::{Aes256Gcm, KeyInit, aead::Aead};
    use rand::RngCore;
    let password_key_bytes = general_purpose::STANDARD_NO_PAD.decode(&password_key)
        .map_err(|_| SeaError::Crypto("Failed to decode password key".to_string()))?;
    let cipher = Aes256Gcm::new_from_slice(&password_key_bytes)
        .map_err(|e| SeaError::Crypto(format!("Failed to create cipher: {}", e)))?;
    let mut nonce_bytes = [0u8; 12];
    rand::thread_rng().fill_bytes(&mut nonce_bytes);
    let nonce = aes_gcm::Nonce::from_slice(&nonce_bytes);
    let ciphertext = cipher.encrypt(nonce, priv_data_str.as_bytes())
        .map_err(|e| SeaError::Crypto(format!("Encryption failed: {}", e)))?;
    
    let priv_key_encrypted = json!({
        "ct": general_purpose::STANDARD_NO_PAD.encode(ciphertext),
        "iv": general_purpose::STANDARD_NO_PAD.encode(nonce_bytes),
        "s": general_purpose::STANDARD_NO_PAD.encode(&salt),
    });
    
    // Encrypt epriv similarly
    let epriv_key_encrypted = if let Some(ref epriv) = pair.epriv_key {
        let epriv_data = json!({"epriv": epriv});
        let epriv_data_str = serde_json::to_string(&epriv_data)
            .map_err(|e| SeaError::Crypto(format!("Serialization error: {}", e)))?;
        let mut epriv_nonce_bytes = [0u8; 12];
        rand::thread_rng().fill_bytes(&mut epriv_nonce_bytes);
        let epriv_nonce = aes_gcm::Nonce::from_slice(&epriv_nonce_bytes);
        let epriv_ciphertext = cipher.encrypt(epriv_nonce, epriv_data_str.as_bytes())
            .map_err(|e| SeaError::Crypto(format!("Encryption failed: {}", e)))?;
        json!({
            "ct": general_purpose::STANDARD_NO_PAD.encode(epriv_ciphertext),
            "iv": general_purpose::STANDARD_NO_PAD.encode(epriv_nonce_bytes),
            "s": general_purpose::STANDARD_NO_PAD.encode(&salt),
        })
    } else {
        json!({})
    };
    
    // Store user data in graph at ~@alias (where ~ is pub key)
    let user_soul = format!("~{}", pair.pub_key);
    let user_data = json!({
        "alias": alias.clone().unwrap_or_default(),
        "pub": pair.pub_key.clone(),
        "epub": pair.epub_key.clone(),
        "hash": password_hash,
        "salt": general_purpose::STANDARD_NO_PAD.encode(&salt),
        "priv": priv_key_encrypted,
        "epriv": epriv_key_encrypted,
    });
    
    // Store in graph
    chain.get(&user_soul).put(user_data).await
        .map_err(|e| SeaError::Crypto(format!("Failed to store user data: {}", e)))?;
    
    // If alias provided, also store at ~@alias for lookup
    if let Some(ref alias_str) = alias {
        let alias_soul = format!("~{}@{}", pair.pub_key, alias_str);
        chain.get(&alias_soul).put(json!({
            "#": user_soul
        })).await
            .map_err(|e| SeaError::Crypto(format!("Failed to store alias: {}", e)))?;
    }
    
    Ok(UserAuth { pair, alias })
}

/// Authenticate user with password
/// 
/// Looks up user in graph by alias, verifies password hash, and decrypts private keys.
/// Returns authenticated `UserAuth` with full key pair if authentication succeeds.
/// 
/// # Arguments
/// * `chain` - Chain instance to access the graph (typically `gun.root()`)
/// * `alias` - User alias/username to look up
/// * `password` - Password for authentication
/// 
/// # Returns
/// `UserAuth` with decrypted key pair if authentication succeeds
/// 
/// # Errors
/// - `SeaError::Crypto`: If user not found, password incorrect, or decryption fails
/// 
/// # Security
/// 
/// - Uses PBKDF2 with 100,000 iterations for password hashing
/// - Private keys are encrypted with password-derived key using AES-GCM
/// - Password verification uses constant-time comparison
///
/// # Example
/// ```rust,no_run
/// use gun::{Gun, Chain};
/// use gun::sea::{create_user, authenticate};
/// use std::sync::Arc;
/// 
/// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
/// let gun = Gun::new();
/// let chain = gun.root();
/// 
/// // Create user
/// create_user(Arc::new(chain.clone()), Some("alice".to_string()), "password123")
///     .await?;
/// 
/// // Authenticate
/// let user = authenticate(Arc::new(chain), "alice", "password123").await?;
/// println!("Authenticated user: {:?}", user.alias);
/// # Ok(())
/// # }
/// ```
pub async fn authenticate(
    chain: Arc<Chain>,
    alias: &str,
    password: &str,
) -> Result<UserAuth, SeaError> {
    // Look up user by alias
    // In Gun.js, aliases are stored at ~@alias which points to ~pub
    // We need to search for the alias in the graph
    // The alias is stored at a node that has the alias as a key pointing to the user soul
    
    // Try to find user by searching for alias in graph
    // In Gun.js, this is done via gun.get('~@' + alias) which returns the user soul
    // For now, we'll search the graph nodes for one with matching alias
    // This is not efficient but works for the implementation
    
    let graph = &chain.core.graph;
    let all_nodes = graph.all_nodes();
    
    // Search for user node with matching alias
    let mut user_soul: Option<String> = None;
    for (soul, node) in all_nodes.iter() {
        if let Some(alias_value) = node.data.get("alias") {
            if let Some(alias_str) = alias_value.as_str() {
                if alias_str == alias {
                    user_soul = Some(soul.clone());
                    break;
                }
            }
        }
    }
    
    // If not found, try alias lookup path ~@alias
    if user_soul.is_none() {
        let alias_path = format!("~{}@{}", "", alias);
        let alias_chain = chain.get(&alias_path);
        let mut alias_data: Option<serde_json::Value> = None;
        alias_chain.once(|data, _key| {
            alias_data = Some(data);
        }).await.map_err(|e| SeaError::Crypto(format!("Failed to look up alias: {}", e)))?;
        
        if let Some(data) = alias_data {
            // Check if it's a soul reference
            if let Some(soul_ref) = data.get("#").and_then(|v| v.as_str()) {
                user_soul = Some(soul_ref.to_string());
            } else if data.is_string() {
                // Might be the soul directly
                user_soul = data.as_str().map(|s| s.to_string());
            }
        }
    }
    
    if user_soul.is_none() {
        return Err(SeaError::Crypto(format!("User with alias '{}' not found", alias)));
    }
    
    let user_soul = user_soul.unwrap();
    
    // Get user data from graph
    let user_chain = chain.get(&user_soul);
    let mut user_data: Option<serde_json::Value> = None;
    user_chain.once(|data, _key| {
        user_data = Some(data);
    }).await.map_err(|e| SeaError::Crypto(format!("Failed to get user data: {}", e)))?;
    
    let user_data = user_data.ok_or_else(|| SeaError::Crypto("User data not found".to_string()))?;
    
    // Extract stored password hash and salt
    let stored_hash = user_data.get("hash")
        .and_then(|v| v.as_str())
        .ok_or_else(|| SeaError::Crypto("Missing password hash in user data".to_string()))?;
    let salt_b64 = user_data.get("salt")
        .and_then(|v| v.as_str())
        .ok_or_else(|| SeaError::Crypto("Missing salt in user data".to_string()))?;
    let salt = general_purpose::STANDARD_NO_PAD.decode(salt_b64)
        .map_err(|e| SeaError::Crypto(format!("Invalid salt encoding: {}", e)))?;
    
    // Verify password
    if !verify_password(password, &salt, stored_hash) {
        return Err(SeaError::Crypto("Invalid password".to_string()));
    }
    
    // Get public key
    let pub_key = user_data.get("pub")
        .and_then(|v| v.as_str())
        .ok_or_else(|| SeaError::Crypto("Missing public key in user data".to_string()))?
        .to_string();
    
    // Decrypt private keys using password-derived key
    let priv_encrypted = user_data.get("priv")
        .ok_or_else(|| SeaError::Crypto("Missing encrypted private key".to_string()))?;
    
    // Derive decryption key from password (same as encryption)
    let password_key = super::work::work(
        password.as_bytes(),
        Some(salt.clone()),
        super::work::WorkOptions {
            name: Some("PBKDF2".to_string()),
            iterations: Some(100_000),
            salt: Some(salt.clone()),
            hash: Some("SHA-256".to_string()),
            length: Some(256), // 32 bytes for AES-256
            encode: Some("base64".to_string()),
        },
    ).await?;
    
    // Decrypt private key
    let ct_b64 = priv_encrypted.get("ct")
        .and_then(|v| v.as_str())
        .ok_or_else(|| SeaError::Decryption("Missing ciphertext".to_string()))?;
    let iv_b64 = priv_encrypted.get("iv")
        .and_then(|v| v.as_str())
        .ok_or_else(|| SeaError::Decryption("Missing IV".to_string()))?;
    
    let password_key_bytes = general_purpose::STANDARD_NO_PAD.decode(&password_key)
        .map_err(|_| SeaError::Crypto("Failed to decode password key".to_string()))?;
    let cipher = Aes256Gcm::new_from_slice(&password_key_bytes)
        .map_err(|e| SeaError::Crypto(format!("Failed to create cipher: {}", e)))?;
    let iv_bytes = general_purpose::STANDARD_NO_PAD.decode(iv_b64)
        .map_err(|_| SeaError::Decryption("Invalid IV encoding".to_string()))?;
    let ciphertext = general_purpose::STANDARD_NO_PAD.decode(ct_b64)
        .map_err(|_| SeaError::Decryption("Invalid ciphertext encoding".to_string()))?;
    
    let nonce = aes_gcm::Nonce::from_slice(&iv_bytes);
    let plaintext = cipher.decrypt(nonce, ciphertext.as_ref())
        .map_err(|e| SeaError::Decryption(format!("Decryption failed: {}", e)))?;
    
    let priv_data_str = String::from_utf8(plaintext)
        .map_err(|e| SeaError::Decryption(format!("Invalid UTF-8: {}", e)))?;
    let priv_decrypted: serde_json::Value = serde_json::from_str(&priv_data_str)
        .map_err(|e| SeaError::Decryption(format!("Invalid JSON: {}", e)))?;
    
    let priv_key = priv_decrypted.get("priv")
        .and_then(|v| v.as_str())
        .ok_or_else(|| SeaError::Crypto("Failed to decrypt private key".to_string()))?
        .to_string();
    
    // Decrypt epriv if present
    let epub_key = user_data.get("epub")
        .and_then(|v| v.as_str())
        .map(|s| s.to_string());
    
    let epriv_key = if let Some(epriv_encrypted) = user_data.get("epriv") {
        if epriv_encrypted.is_object() && !epriv_encrypted.as_object().unwrap().is_empty() {
            let epriv_ct_b64 = epriv_encrypted.get("ct")
                .and_then(|v| v.as_str())
                .ok_or_else(|| SeaError::Decryption("Missing ciphertext".to_string()))?;
            let epriv_iv_b64 = epriv_encrypted.get("iv")
                .and_then(|v| v.as_str())
                .ok_or_else(|| SeaError::Decryption("Missing IV".to_string()))?;
            
            let epriv_iv_bytes = general_purpose::STANDARD_NO_PAD.decode(epriv_iv_b64)
                .map_err(|_| SeaError::Decryption("Invalid IV encoding".to_string()))?;
            let epriv_ciphertext = general_purpose::STANDARD_NO_PAD.decode(epriv_ct_b64)
                .map_err(|_| SeaError::Decryption("Invalid ciphertext encoding".to_string()))?;
            
            let epriv_nonce = aes_gcm::Nonce::from_slice(&epriv_iv_bytes);
            let epriv_plaintext = cipher.decrypt(epriv_nonce, epriv_ciphertext.as_ref())
                .map_err(|e| SeaError::Decryption(format!("Decryption failed: {}", e)))?;
            
            let epriv_data_str = String::from_utf8(epriv_plaintext)
                .map_err(|e| SeaError::Decryption(format!("Invalid UTF-8: {}", e)))?;
            let epriv_decrypted: serde_json::Value = serde_json::from_str(&epriv_data_str)
                .map_err(|e| SeaError::Decryption(format!("Invalid JSON: {}", e)))?;
            
            epriv_decrypted.get("epriv")
                .and_then(|v| v.as_str())
                .map(|s| s.to_string())
        } else {
            None
        }
    } else {
        None
    };
    
    // Reconstruct full key pair
    let pair = KeyPair {
        pub_key,
        priv_key,
        epub_key,
        epriv_key,
    };
    
    Ok(UserAuth {
        pair,
        alias: Some(alias.to_string()),
    })
}

/// Hash a password using PBKDF2
/// Returns base64-encoded hash
pub fn hash_password(password: &str, salt: &[u8]) -> String {
    let mut hash = vec![0u8; 32];
    pbkdf2_hmac::<Sha256>(password.as_bytes(), salt, 100000, &mut hash);
    general_purpose::STANDARD_NO_PAD.encode(&hash)
}

/// Verify a password against a hash
pub fn verify_password(password: &str, salt: &[u8], hash: &str) -> bool {
    let computed_hash = hash_password(password, salt);
    computed_hash == hash
}

/// Generate a random salt for password hashing
pub fn generate_salt() -> Vec<u8> {
    use rand::RngCore;
    let mut salt = vec![0u8; 16];
    rand::thread_rng().fill_bytes(&mut salt);
    salt
}

/// Recall user session from storage
/// 
/// Recalls a previously authenticated user session from storage.
/// Based on Gun.js sea/recall.js behavior.
///
/// # Arguments
/// * `chain` - Optional Chain instance to access the graph (for graph-based recall)
/// * `storage_path` - Optional path to storage file for file-based session recall
///
/// # Returns
/// `Ok(Some(UserAuth))` if session is valid and not expired, `Ok(None)` if expired or not found
///
/// # Session Expiry
///
/// Session validity is 12 hours (matching Gun.js settings).
/// Sessions older than 12 hours will return `None`.
/// 
/// # Storage Priority
/// 
/// This function tries to recall from:
/// 1. Graph storage (if `chain` is provided)
/// 2. File-based storage (if `storage_path` is provided)
/// 
/// Returns `None` if no valid session is found in either location.
/// 
/// # Security Note
/// 
/// File-based recall currently stores keys in plaintext (not recommended for production).
/// In a secure implementation, keys should be encrypted with a master key or user password.
/// 
/// # Example
/// ```rust,no_run
/// use gun::{Gun, Chain};
/// use gun::sea::recall;
/// use std::sync::Arc;
/// 
/// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
/// let gun = Gun::new();
/// let chain = gun.root();
/// 
/// // Try to recall session
/// if let Some(user) = recall(Some(Arc::new(chain)), Some("./session.json")).await? {
///     println!("Session recalled for user: {:?}", user.alias);
/// } else {
///     println!("No valid session found");
/// }
/// # Ok(())
/// # }
/// ```
pub async fn recall(
    chain: Option<Arc<Chain>>,
    storage_path: Option<&str>,
) -> Result<Option<UserAuth>, SeaError> {
    // Try graph-based recall first (if chain provided)
    if let Some(_chain_ref) = chain {
        // In Gun.js, recall checks for stored session in graph
        // Look for session data at a known location (e.g., ~session or similar)
        // For now, we'll check if there's a current user in the graph
        // This is simplified - in practice, you'd have a specific session storage mechanism
        
        // Try to get session from graph
        // In Gun.js, this might be stored at a specific path
        // For now, we'll return None and rely on file-based storage
        // TODO: Implement full graph-based session recall
    }
    
    // Try file-based recall
    if let Some(path) = storage_path {
        // Read from storage file
        let contents = tokio::fs::read_to_string(path).await
            .map_err(|e| SeaError::Crypto(format!("Failed to read storage file: {}", e)))?;
        
        let pair_data: serde_json::Value = serde_json::from_str(&contents)
            .map_err(|e| SeaError::Crypto(format!("Failed to parse storage data: {}", e)))?;
        
        // Check for expiry (12 hours default, matching Gun.js)
                if let Some(exp) = pair_data.get("exp").and_then(|v| v.as_f64()) {
                    let now = chrono::Utc::now().timestamp_millis() as f64;
            let expiry_ms = 12.0 * 60.0 * 60.0 * 1000.0; // 12 hours in milliseconds
            if now > (exp + expiry_ms) {
                        return Ok(None); // Expired
                    }
                }

        // Reconstruct UserAuth from stored data
        let pub_key = pair_data.get("pub")
            .and_then(|v| v.as_str())
            .ok_or_else(|| SeaError::Crypto("Missing pub key in stored data".to_string()))?
            .to_string();
        
        let priv_key = pair_data.get("priv")
            .and_then(|v| v.as_str())
            .ok_or_else(|| SeaError::Crypto("Missing priv key in stored data".to_string()))?
            .to_string();
        
        let epub_key = pair_data.get("epub")
            .and_then(|v| v.as_str())
            .map(|s| s.to_string());
        
        let epriv_key = pair_data.get("epriv")
            .and_then(|v| v.as_str())
            .map(|s| s.to_string());
        
        let alias = pair_data.get("alias")
            .and_then(|v| v.as_str())
            .map(|s| s.to_string());
        
        // Note: In production, you'd want to decrypt the private keys if they're encrypted
        // For now, we assume they're stored in plaintext (not recommended for production)
        // In a secure implementation, you'd decrypt using a master key or user password
        
        let pair = KeyPair {
            pub_key,
            priv_key,
            epub_key,
            epriv_key,
        };
        
        return Ok(Some(UserAuth { pair, alias }));
    }

    Ok(None)
}