/*
Copyright CAcert Inc.
SPDX-License-Identifier: Apache-2.0

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package services

import (
	"errors"
	"fmt"
	"log/slog"
	"time"

	"github.com/gorilla/sessions"
	"github.com/lestrrat-go/jwx/jwk"
	"github.com/lestrrat-go/jwx/jwt"
	"github.com/lestrrat-go/jwx/jwt/openid"
)

type OIDCTokenInfo struct {
	AccessToken  string
	IDToken      string
	RefreshToken string
	Expires      time.Time
	Name         string
	Email        string
}

type TokenInfoService struct {
	logger *slog.Logger
	keySet jwk.Set
}

func (s *TokenInfoService) GetTokenInfo(session *sessions.Session) (*OIDCTokenInfo, error) {
	tokenInfo := &OIDCTokenInfo{}

	var ok bool

	if tokenInfo.AccessToken, ok = session.Values[SessionAccessToken].(string); ok {
		s.logger.Debug("found access token in session", "access_token", tokenInfo.AccessToken)
	}

	if tokenInfo.RefreshToken, ok = session.Values[SessionRefreshToken].(string); ok {
		s.logger.Debug("found refresh token in session", "refresh_token", tokenInfo.RefreshToken)
	}

	if tokenInfo.IDToken, ok = session.Values[SessionIDToken].(string); ok {
		s.logger.Debug("found ID token in session", "id_token", tokenInfo.IDToken)
	}

	if tokenInfo.IDToken == "" {
		return tokenInfo, nil
	}

	oidcToken, err := ParseIDToken(tokenInfo.IDToken, s.keySet)
	if err != nil {
		return nil, fmt.Errorf("could not parse ID token: %w", err)
	}

	tokenInfo.Expires = oidcToken.Expiration()

	tokenInfo.Name = oidcToken.Name()

	tokenInfo.Email = oidcToken.Email()

	return tokenInfo, nil
}

func InitTokenInfoService(logger *slog.Logger, oidcInfo *OIDCInformation) (*TokenInfoService, error) {
	return &TokenInfoService{logger: logger, keySet: oidcInfo.KeySet}, nil
}

func ParseIDToken(token string, keySet jwk.Set) (openid.Token, error) {
	var (
		parsedIDToken jwt.Token
		err           error
	)

	if parsedIDToken, err = jwt.ParseString(token, jwt.WithKeySet(keySet), jwt.WithToken(openid.New())); err != nil {
		return nil, fmt.Errorf("could not parse ID token: %w", err)
	}

	if v, ok := parsedIDToken.(openid.Token); ok {
		return v, nil
	}

	return nil, errors.New("ID token is no OpenID Connect Identity Token")
}