portalis-core 0.1.0

// SSO (Single Sign-On) Module
// Phase 5 Week 41-42 - Enterprise SSO authentication
//
// Supports:
// - SAML 2.0
// - OAuth 2.0
// - OpenID Connect (OIDC)

use serde::{Deserialize, Serialize};
use uuid::Uuid;
use chrono::{DateTime, Utc};
use std::collections::HashMap;

/// SSO provider type
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "lowercase")]
pub enum SsoProvider {
    /// SAML 2.0 (e.g., Okta, OneLogin, Azure AD)
    Saml,
    /// OAuth 2.0 (e.g., Google, GitHub)
    OAuth2,
    /// OpenID Connect (e.g., Auth0, Keycloak)
    Oidc,
    /// LDAP/Active Directory
    Ldap,
}

impl std::fmt::Display for SsoProvider {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            SsoProvider::Saml => write!(f, "saml"),
            SsoProvider::OAuth2 => write!(f, "oauth2"),
            SsoProvider::Oidc => write!(f, "oidc"),
            SsoProvider::Ldap => write!(f, "ldap"),
        }
    }
}

/// SSO connection configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SsoConnection {
    pub id: Uuid,
    pub organization_id: Uuid,
    pub provider: SsoProvider,
    pub name: String,
    pub config: SsoConfig,
    pub is_enabled: bool,
    pub created_at: DateTime<Utc>,
    pub updated_at: DateTime<Utc>,
}

/// Provider-specific configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(tag = "type", rename_all = "lowercase")]
pub enum SsoConfig {
    Saml(SamlConfig),
    OAuth2(OAuth2Config),
    Oidc(OidcConfig),
    Ldap(LdapConfig),
}

/// SAML 2.0 configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SamlConfig {
    /// Identity Provider metadata URL
    pub idp_metadata_url: String,
    /// Service Provider entity ID
    pub sp_entity_id: String,
    /// Assertion Consumer Service URL (callback)
    pub acs_url: String,
    /// Single Logout URL (optional)
    pub slo_url: Option<String>,
    /// Signing certificate (PEM format)
    pub signing_cert: Option<String>,
    /// Attribute mappings (IdP → Portalis)
    pub attribute_mapping: HashMap<String, String>,
    /// Want assertions signed
    pub want_assertions_signed: bool,
    /// Want response signed
    pub want_response_signed: bool,
}

impl Default for SamlConfig {
    fn default() -> Self {
        let mut attribute_mapping = HashMap::new();
        attribute_mapping.insert("email".to_string(), "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress".to_string());
        attribute_mapping.insert("name".to_string(), "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name".to_string());

        Self {
            idp_metadata_url: String::new(),
            sp_entity_id: "https://portalis.dev/saml/metadata".to_string(),
            acs_url: "https://portalis.dev/saml/acs".to_string(),
            slo_url: Some("https://portalis.dev/saml/slo".to_string()),
            signing_cert: None,
            attribute_mapping,
            want_assertions_signed: true,
            want_response_signed: true,
        }
    }
}

/// OAuth 2.0 configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct OAuth2Config {
    /// Client ID
    pub client_id: String,
    /// Client secret (encrypted)
    pub client_secret: String,
    /// Authorization endpoint
    pub authorization_url: String,
    /// Token endpoint
    pub token_url: String,
    /// User info endpoint
    pub userinfo_url: String,
    /// Scopes to request
    pub scopes: Vec<String>,
    /// Redirect URI (callback)
    pub redirect_uri: String,
}

impl Default for OAuth2Config {
    fn default() -> Self {
        Self {
            client_id: String::new(),
            client_secret: String::new(),
            authorization_url: String::new(),
            token_url: String::new(),
            userinfo_url: String::new(),
            scopes: vec!["openid".to_string(), "email".to_string(), "profile".to_string()],
            redirect_uri: "https://portalis.dev/oauth2/callback".to_string(),
        }
    }
}

/// OpenID Connect configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct OidcConfig {
    /// Client ID
    pub client_id: String,
    /// Client secret (encrypted)
    pub client_secret: String,
    /// Discovery URL (.well-known/openid-configuration)
    pub discovery_url: String,
    /// Scopes to request
    pub scopes: Vec<String>,
    /// Redirect URI (callback)
    pub redirect_uri: String,
    /// Use PKCE (Proof Key for Code Exchange)
    pub use_pkce: bool,
}

impl Default for OidcConfig {
    fn default() -> Self {
        Self {
            client_id: String::new(),
            client_secret: String::new(),
            discovery_url: String::new(),
            scopes: vec!["openid".to_string(), "email".to_string(), "profile".to_string()],
            redirect_uri: "https://portalis.dev/oidc/callback".to_string(),
            use_pkce: true,
        }
    }
}

/// LDAP configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct LdapConfig {
    /// LDAP server URL (ldap:// or ldaps://)
    pub server_url: String,
    /// Bind DN (e.g., "cn=admin,dc=example,dc=com")
    pub bind_dn: String,
    /// Bind password (encrypted)
    pub bind_password: String,
    /// Base DN for user search (e.g., "ou=users,dc=example,dc=com")
    pub user_base_dn: String,
    /// User search filter (e.g., "(uid={username})")
    pub user_search_filter: String,
    /// Attribute mappings
    pub attribute_mapping: HashMap<String, String>,
    /// Use TLS/SSL
    pub use_tls: bool,
}

impl Default for LdapConfig {
    fn default() -> Self {
        let mut attribute_mapping = HashMap::new();
        attribute_mapping.insert("email".to_string(), "mail".to_string());
        attribute_mapping.insert("name".to_string(), "cn".to_string());

        Self {
            server_url: "ldap://localhost:389".to_string(),
            bind_dn: String::new(),
            bind_password: String::new(),
            user_base_dn: "ou=users,dc=example,dc=com".to_string(),
            user_search_filter: "(uid={username})".to_string(),
            attribute_mapping,
            use_tls: true,
        }
    }
}

/// SSO authentication request
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SsoAuthRequest {
    pub connection_id: Uuid,
    pub return_url: Option<String>,
    pub state: String, // CSRF protection
}

/// SSO authentication response (after callback)
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SsoAuthResponse {
    pub user_id: Uuid,
    pub email: String,
    pub name: Option<String>,
    pub provider: SsoProvider,
    pub external_id: String,
    pub attributes: HashMap<String, String>,
}

/// SSO service for handling authentication flows
pub struct SsoService {
    // In production, this would use libraries like:
    // - samael (SAML)
    // - oauth2 crate (OAuth 2.0)
    // - openidconnect crate (OIDC)
    // - ldap3 (LDAP)
}

impl SsoService {
    pub fn new() -> Self {
        Self {}
    }

    /// Generate authorization URL for SSO provider
    pub fn get_authorization_url(
        &self,
        connection: &SsoConnection,
        state: &str,
    ) -> Result<String, SsoError> {
        match &connection.config {
            SsoConfig::Saml(config) => {
                // Generate SAML AuthnRequest
                Ok(format!(
                    "{}?SAMLRequest=<encoded>&RelayState={}",
                    config.idp_metadata_url, state
                ))
            }
            SsoConfig::OAuth2(config) => {
                // Generate OAuth2 authorization URL
                let scope = config.scopes.join(" ");
                // Note: In production, use proper URL encoding
                Ok(format!(
                    "{}?client_id={}&redirect_uri={}&scope={}&state={}&response_type=code",
                    config.authorization_url,
                    config.client_id, // TODO: URL encode
                    config.redirect_uri, // TODO: URL encode
                    scope, // TODO: URL encode
                    state
                ))
            }
            SsoConfig::Oidc(config) => {
                // Generate OIDC authorization URL
                let scope = config.scopes.join(" ");
                let mut url = format!(
                    "{}?client_id={}&redirect_uri={}&scope={}&state={}&response_type=code",
                    config.discovery_url.replace("/.well-known/openid-configuration", "/authorize"),
                    config.client_id, // TODO: URL encode
                    config.redirect_uri, // TODO: URL encode
                    scope, // TODO: URL encode
                    state
                );

                if config.use_pkce {
                    // TODO: Generate PKCE challenge
                    url.push_str("&code_challenge=<challenge>&code_challenge_method=S256");
                }

                Ok(url)
            }
            SsoConfig::Ldap(_) => {
                Err(SsoError::UnsupportedProvider("LDAP does not use authorization URLs".to_string()))
            }
        }
    }

    /// Validate SSO callback and extract user information
    pub async fn handle_callback(
        &self,
        connection: &SsoConnection,
        code: &str,
        state: &str,
    ) -> Result<SsoAuthResponse, SsoError> {
        // This would be implemented with actual SSO library integrations
        // For now, returning a placeholder error
        Err(SsoError::NotImplemented("SSO callback handling not yet implemented".to_string()))
    }

    /// Authenticate user via LDAP
    pub async fn authenticate_ldap(
        &self,
        connection: &SsoConnection,
        username: &str,
        password: &str,
    ) -> Result<SsoAuthResponse, SsoError> {
        // This would be implemented with ldap3 crate
        Err(SsoError::NotImplemented("LDAP authentication not yet implemented".to_string()))
    }
}

impl Default for SsoService {
    fn default() -> Self {
        Self::new()
    }
}

/// SSO errors
#[derive(Debug, thiserror::Error)]
pub enum SsoError {
    #[error("SSO provider not supported: {0}")]
    UnsupportedProvider(String),

    #[error("Invalid SSO configuration: {0}")]
    InvalidConfig(String),

    #[error("SSO authentication failed: {0}")]
    AuthenticationFailed(String),

    #[error("Not implemented: {0}")]
    NotImplemented(String),

    #[error("Invalid state parameter (CSRF check failed)")]
    InvalidState,

    #[error("Token exchange failed: {0}")]
    TokenExchangeFailed(String),
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_sso_provider_display() {
        assert_eq!(SsoProvider::Saml.to_string(), "saml");
        assert_eq!(SsoProvider::OAuth2.to_string(), "oauth2");
        assert_eq!(SsoProvider::Oidc.to_string(), "oidc");
        assert_eq!(SsoProvider::Ldap.to_string(), "ldap");
    }

    #[test]
    fn test_saml_config_default() {
        let config = SamlConfig::default();
        assert_eq!(config.sp_entity_id, "https://portalis.dev/saml/metadata");
        assert!(config.want_assertions_signed);
        assert!(config.attribute_mapping.contains_key("email"));
    }

    #[test]
    fn test_oauth2_config_default() {
        let config = OAuth2Config::default();
        assert!(config.scopes.contains(&"openid".to_string()));
        assert!(config.scopes.contains(&"email".to_string()));
        assert_eq!(config.redirect_uri, "https://portalis.dev/oauth2/callback");
    }

    #[test]
    fn test_oidc_config_default() {
        let config = OidcConfig::default();
        assert!(config.use_pkce);
        assert!(config.scopes.contains(&"profile".to_string()));
    }

    #[test]
    fn test_ldap_config_default() {
        let config = LdapConfig::default();
        assert_eq!(config.server_url, "ldap://localhost:389");
        assert!(config.use_tls);
        assert!(config.attribute_mapping.contains_key("email"));
    }

    #[test]
    fn test_sso_service_new() {
        let service = SsoService::new();
        // Service should initialize without errors
    }

    #[test]
    fn test_get_authorization_url_oauth2() {
        let service = SsoService::new();
        let connection = SsoConnection {
            id: Uuid::new_v4(),
            organization_id: Uuid::new_v4(),
            provider: SsoProvider::OAuth2,
            name: "Google".to_string(),
            config: SsoConfig::OAuth2(OAuth2Config {
                client_id: "test-client".to_string(),
                client_secret: "secret".to_string(),
                authorization_url: "https://accounts.google.com/o/oauth2/auth".to_string(),
                token_url: "https://oauth2.googleapis.com/token".to_string(),
                userinfo_url: "https://www.googleapis.com/oauth2/v1/userinfo".to_string(),
                scopes: vec!["email".to_string(), "profile".to_string()],
                redirect_uri: "https://portalis.dev/oauth2/callback".to_string(),
            }),
            is_enabled: true,
            created_at: Utc::now(),
            updated_at: Utc::now(),
        };

        let url = service.get_authorization_url(&connection, "test-state").unwrap();
        assert!(url.contains("https://accounts.google.com/o/oauth2/auth"));
        assert!(url.contains("client_id=test-client"));
        assert!(url.contains("state=test-state"));
        assert!(url.contains("response_type=code"));
    }

    #[test]
    fn test_get_authorization_url_ldap_fails() {
        let service = SsoService::new();
        let connection = SsoConnection {
            id: Uuid::new_v4(),
            organization_id: Uuid::new_v4(),
            provider: SsoProvider::Ldap,
            name: "Active Directory".to_string(),
            config: SsoConfig::Ldap(LdapConfig::default()),
            is_enabled: true,
            created_at: Utc::now(),
            updated_at: Utc::now(),
        };

        let result = service.get_authorization_url(&connection, "test-state");
        assert!(result.is_err());
    }
}