ws-auth 0.0.3

use jsonwebtoken::EncodingKey;

use crate::auth::AuthenticationContext;

use self::auth::{
    AuthErrorCode, AuthErrorResponse, AuthRequest, AuthResponse, RequestPrompt, ResponseType,
};

pub mod auth;
pub mod token;

#[cfg(test)]
pub mod tests;

pub struct OAuthManager {}

#[derive(Copy, Clone)]
pub enum AuthErrorType {
    MissingParameter = 10000,
    MissingParameterClientId = 10001,
    MissingParameterScope = 10002,
    MissingParameterRedirectUri = 10003,
    MissingParameterResponseType = 10004,
    MissingParameterCodeChallenge = 10005,
    InvalidParameter = 11000,
    InvalidParameterResponseType = 11004,
    MaxValue = 65535,
}

impl AuthErrorType {
    fn as_u16(&mut self) -> u16 {
        *self as u16
    }
}

fn create_error(
    error: AuthErrorCode,
    error_type_code: AuthErrorType,
    error_description: &str,
    callback_uri: Option<String>,
) -> AuthErrorResponse {
    let mut error_message = String::from("");
    let error_type = format!("WSA{:?}", error_type_code.to_owned().as_u16());
    error_message.push_str(error_type.to_owned().as_str());
    error_message.push_str(": ");
    error_message.push_str(error_description);

    AuthErrorResponse {
        error: Some(error),
        error_description: Some(error_message),
        callback_uri: callback_uri.to_owned(),
    }
}

fn validate_request(req: &AuthRequest) -> Option<AuthErrorResponse> {
    // TODO: Find a way to pass in the auth-manager so that it can provide a default callback_uri
    let mut callback_uri = String::from("http://192.168.88.220:9000/error");

    if req.redirect_uri.is_some() {
        callback_uri = req.redirect_uri.to_owned().unwrap();
    }

    if req.client_id.is_none() {
        return Some(create_error(
            AuthErrorCode::InvalidRequest,
            AuthErrorType::MissingParameterClientId,
            "Request is missing a required parameter, `client_id`",
            Some(callback_uri),
        ));
    }

    if req.scope.is_none() {
        return Some(create_error(
            AuthErrorCode::InvalidRequest,
            AuthErrorType::MissingParameterScope,
            "Request is missing a required parameter, `scope`",
            Some(callback_uri),
        ));
    }

    if req.redirect_uri.is_none() {
        return Some(create_error(
            AuthErrorCode::InvalidRequest,
            AuthErrorType::MissingParameterRedirectUri,
            "Request is missing a required parameter, `redirect_uri`",
            Some(callback_uri),
        ));
    }

    if req.response_type.is_none() {
        return Some(create_error(
            AuthErrorCode::InvalidRequest,
            AuthErrorType::MissingParameterResponseType,
            "Request is missing a required parameter, `response_type`",
            Some(callback_uri),
        ));
    }

    if req.get_response_types().len() == 0 {
        return Some(create_error(
            AuthErrorCode::InvalidRequest,
            AuthErrorType::InvalidParameterResponseType,
            "Invalid parameter `response_type`",
            Some(callback_uri),
        ));
    }

    if !req.code_challenge_method.is_none() && req.code_challenge.is_none() {
        return Some(create_error(
            AuthErrorCode::InvalidRequest,
            AuthErrorType::MissingParameterCodeChallenge,
            "Request is missing a required parameter, `code_challenge`",
            Some(callback_uri),
        ));
    }

    return Option::None;
}

impl OAuthManager {
    pub fn new() -> OAuthManager {
        OAuthManager {}
    }

    pub fn authorize(
        &mut self,
        req: &AuthRequest,
        ctx: &AuthenticationContext,
    ) -> Result<AuthResponse, AuthErrorResponse> {
        let validation_response = validate_request(req);

        if !validation_response.is_none() {
            return Err(validation_response.unwrap());
        }

        let identity = ctx.get_identity();

        // Single-Sign-On (SSO) Flow
        if (!req.prompt.is_none() && req.prompt.to_owned().unwrap() == RequestPrompt::None)
            && identity.is_none()
        {
            // TODO: Determine if interaction_required or login_required is more appropriate.
            return Err(AuthErrorResponse {
                error: Some(AuthErrorCode::InteractionRequired),
                error_description: Some("A user is not currently signed-in.".to_owned()),
                callback_uri: Some("".to_owned()),
            });
        }

        let mut response = AuthResponse {
            code: Option::None,
            access_token: Option::None,
            expires_in: Option::None,
            token_type: Option::None,
            id_token: Option::None,
            refresh_token: Option::None,
            scope: Option::None,
            state: req.state.to_owned(),
            callback_uri: req.redirect_uri.to_owned(),
        };

        for response_type in req.get_response_types() {
            match response_type {
                ResponseType::Code => {
                    todo!();
                }
                ResponseType::Token => {
                    let signing_key =
                        EncodingKey::from_rsa_pem(&std::fs::read("localhost.key").unwrap())
                            .unwrap();
                    response.access_token = Some(identity.to_owned().unwrap().as_jwt(signing_key));
                }
                ResponseType::IdToken => {
                    todo!();
                }
                _ => {}
            }
        }

        // https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow#acquire-access-tokens-silently
        Ok(response)
    }

    pub fn token_exchange(
        &mut self,
        _req: &token::TokenRequest,
        _ctx: &super::auth::AuthenticationContext,
    ) {
    }
}