/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

/***************************************************************************
 * Copyright (C) 2017-2026 ZmartZone Holding BV
 * All rights reserved.
 *
 * DISCLAIMER OF WARRANTIES:
 *
 * THE SOFTWARE PROVIDED HEREUNDER IS PROVIDED ON AN "AS IS" BASIS, WITHOUT
 * ANY WARRANTIES OR REPRESENTATIONS EXPRESS, IMPLIED OR STATUTORY; INCLUDING,
 * WITHOUT LIMITATION, WARRANTIES OF QUALITY, PERFORMANCE, NONINFRINGEMENT,
 * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.  NOR ARE THERE ANY
 * WARRANTIES CREATED BY A COURSE OR DEALING, COURSE OF PERFORMANCE OR TRADE
 * USAGE.  FURTHERMORE, THERE ARE NO WARRANTIES THAT THE SOFTWARE WILL MEET
 * YOUR NEEDS OR BE FREE FROM ERRORS, OR THAT THE OPERATION OF THE SOFTWARE
 * WILL BE UNINTERRUPTED.  IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES HOWEVER CAUSED AND ON ANY THEORY OF
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * @Author: Hans Zandbelt - hans.zandbelt@openidc.com
 */

#include "cfg/dir.h"
#include "cfg/provider.h"
#include "handle/handle.h"
#include "mod_auth_openidc.h"
#include "proto/proto.h"
#include "util/util.h"
#include "util/util_cfg.h"

/*
 * store claims resolved from the userinfo endpoint in the session
 */
void oidc_userinfo_store_claims(request_rec *r, const oidc_cfg_t *c, oidc_session_t *session,
				const oidc_provider_t *provider, oidc_json_t *userinfo_claims,
				const char *userinfo_jwt) {

	oidc_debug(r, "enter");

	/* see if we've resolved any claims */
	if (userinfo_claims != NULL) {
		/*
		 * Successfully decoded a set claims from the response so we can store them
		 * (well actually the stringified representation in the response)
		 * in the session context safely now
		 */
		oidc_session_set_userinfo_claims(r, session, userinfo_claims);

		if (oidc_cfg_session_type_get(c) != OIDC_SESSION_TYPE_CLIENT_COOKIE) {
			/* this will also clear the entry if a JWT was not returned at this point */
			oidc_session_set_userinfo_jwt(r, session, userinfo_jwt);
		}

	} else {
		/*
		 * clear the existing claims because we could not refresh them
		 */
		oidc_session_set_userinfo_claims(r, session, NULL);

		oidc_session_set_userinfo_jwt(r, session, NULL);
	}

	/* store the last refresh time if we've configured a userinfo refresh interval */
	if (oidc_cfg_provider_userinfo_refresh_interval_get(provider) > -1)
		oidc_session_reset_userinfo_last_refresh(r, session);
}

/*
 * retrieve claims from the userinfo endpoint and return the stringified response
 */
const char *oidc_userinfo_retrieve_claims(request_rec *r, oidc_cfg_t *c, const oidc_provider_t *provider,
					  const char *access_token, const char *access_token_type,
					  oidc_session_t *session, char *id_token_sub, oidc_json_t **userinfo_claims,
					  char **userinfo_jwt) {

	char *result = NULL;
	char *refreshed_access_token = NULL;
	char *refreshed_access_token_type = NULL;
	const oidc_json_t *id_token_claims = NULL;
	long response_code = 0;

	oidc_debug(r, "enter");

	/* see if a userinfo endpoint is set (and not explicitly disabled with an empty value), otherwise there's
	 * nothing to do for us */
	if ((oidc_cfg_provider_userinfo_endpoint_url_get(provider) == NULL) ||
	    (_oidc_strcmp(oidc_cfg_provider_userinfo_endpoint_url_get(provider), "") == 0)) {
		oidc_debug(r, "not retrieving userinfo claims because userinfo_endpoint is not set or disabled");
		goto end;
	}

	/* see if there's an access token, otherwise we can't call the userinfo endpoint at all */
	if (access_token == NULL) {
		oidc_debug(r, "not retrieving userinfo claims because access_token is not provided");
		goto end;
	}

	if ((id_token_sub == NULL) && (session != NULL)) {
		// when refreshing claims from the userinfo endpoint
		id_token_claims = oidc_session_get_idtoken_claims(r, session);
		if (id_token_claims != NULL) {
			oidc_jose_get_string(r->pool, id_token_claims, OIDC_CLAIM_SUB, FALSE, &id_token_sub, NULL);
		} else {
			oidc_debug(r, "no id_token_claims found in session");
		}
	}

	/*
	 * NB: userinfo results are ultimately stored in the session in their stringified form; a future
	 * improvement would be to keep session storage as typed JSON to avoid the string<->JSON conversions
	 */

	/* try to get claims from the userinfo endpoint using the provided access token */
	if (oidc_proto_userinfo_request(r, c, provider, id_token_sub, access_token, access_token_type, &result,
					userinfo_jwt, userinfo_claims, &response_code) == TRUE)
		goto end;

	/* see if this is the initial call to the user info endpoint upon receiving the authorization response */
	if (session == NULL) {
		oidc_error(r, "resolving user info claims with the provided access token failed, nothing will be "
			      "stored in the session");
		result = NULL;
		goto end;
	}

	// a connectivity error rather than a HTTP error: refreshing the access token won't help
	if (response_code == 0) {
		oidc_error(r, "resolving user info claims failed with a connectivity error, no attempt will be made to "
			      "refresh the access token and try again");
		result = NULL;
		goto end;
	}

	/* only an "invalid_token" response (401) indicates the access token may have expired and is worth
	 * refreshing; any other HTTP error (e.g. 403, 5xx) will not be resolved by presenting a fresh token */
	if (response_code != HTTP_UNAUTHORIZED) {
		oidc_error(r,
			   "resolving user info claims failed with HTTP status %ld; since this is not a 401 the access "
			   "token will not be refreshed",
			   response_code);
		result = NULL;
		goto end;
	}

	/* first call to user info endpoint failed, but this is for an existing session and the access token may have
	 * just expired, so refresh it */
	if (oidc_refresh_token_grant(r, c, session, provider, &refreshed_access_token, &refreshed_access_token_type,
				     NULL) == FALSE) {
		oidc_error(r, "refreshing access token failed, claims will not be retrieved/refreshed from the "
			      "userinfo endpoint");
		result = NULL;
		goto end;
	}

	/* try again with the new access token */
	if (oidc_proto_userinfo_request(r, c, provider, id_token_sub, refreshed_access_token,
					refreshed_access_token_type, &result, userinfo_jwt, userinfo_claims,
					NULL) == FALSE) {

		oidc_error(r, "resolving user info claims with the refreshed access token failed, nothing will be "
			      "stored in the session");
		result = NULL;
		goto end;
	}

end:

	oidc_debug(r, "return (%d)", result != NULL);

	return result;
}

/*
 * get (new) claims from the userinfo endpoint
 */
apr_byte_t oidc_userinfo_refresh_claims(request_rec *r, oidc_cfg_t *cfg, oidc_session_t *session,
					apr_byte_t *needs_save) {

	apr_byte_t rc = TRUE;
	oidc_provider_t *provider = NULL;
	const char *claims = NULL;
	char *userinfo_jwt = NULL;
	oidc_json_t *userinfo_claims = NULL;
	apr_time_t last_refresh = 0;

	/* see if we can do anything here, i.e. a refresh interval is configured */
	int interval = oidc_session_get_userinfo_refresh_interval(r, session);

	oidc_debug(r, "interval=%d", interval);

	if (interval <= -1)
		goto end;

	/* get the current provider info */
	if (oidc_get_provider_from_session(r, cfg, session, &provider) == FALSE) {
		*needs_save = TRUE;
		rc = FALSE;
		goto end;
	}

	/* nothing to do without a userinfo endpoint (or when it is explicitly disabled with an empty value) */
	if ((oidc_cfg_provider_userinfo_endpoint_url_get(provider) == NULL) ||
	    (_oidc_strcmp(oidc_cfg_provider_userinfo_endpoint_url_get(provider), "") == 0))
		goto end;

	/* get the last refresh timestamp from the session info */
	last_refresh = oidc_session_get_userinfo_last_refresh(r, session);

	oidc_debug(r,
		   "refresh needed in: %" APR_TIME_T_FMT " seconds (last_refresh=%" APR_TIME_T_FMT
		   ", interval=%d, now=%" APR_TIME_T_FMT ")",
		   apr_time_sec(last_refresh + apr_time_from_sec(interval) - apr_time_now()),
		   apr_time_sec(last_refresh), interval, apr_time_sec(apr_time_now()));

	/* see if we need to refresh again */
	if (last_refresh + apr_time_from_sec(interval) >= apr_time_now())
		goto end;

	/* retrieve the current claims using the current access token */
	claims = oidc_userinfo_retrieve_claims(r, cfg, provider, oidc_session_get_access_token(r, session),
					       oidc_session_get_access_token_type(r, session), session, NULL,
					       &userinfo_claims, &userinfo_jwt);

	/* store claims resolved from userinfo endpoint */
	oidc_userinfo_store_claims(r, cfg, session, provider, userinfo_claims, userinfo_jwt);

	oidc_json_decref(userinfo_claims);

	if (claims == NULL) {
		*needs_save = FALSE;
		rc = FALSE;
	} else {
		/* indicated something changed */
		*needs_save = TRUE;
	}

end:

	oidc_debug(r, "return: %d", rc);

	return rc;
}

#define OIDC_USERINFO_SIGNED_JWT_EXP_DEFAULT 60
#define OIDC_USERINFO_SIGNED_JWT_CACHE_TTL_DEFAULT -1
#define OIDC_USERINFO_SIGNED_JWT_CACHE_TTL_ENVVAR "OIDC_USERINFO_SIGNED_JWT_CACHE_TTL"

/*
 * obtain the signed JWT cache TTL from the environment variables
 */
static int oidc_userinfo_signed_jwt_cache_ttl(const request_rec *r) {
	const char *s_ttl = apr_table_get(r->subprocess_env, OIDC_USERINFO_SIGNED_JWT_CACHE_TTL_ENVVAR);
	return _oidc_str_to_int(s_ttl, OIDC_USERINFO_SIGNED_JWT_CACHE_TTL_DEFAULT);
}

/*
 * create a signed JWT with s_claims payload and return the serialized form in cser
 */
static apr_byte_t oidc_userinfo_create_signed_jwt(request_rec *r, oidc_cfg_t *cfg, const oidc_session_t *session,
						  oidc_json_t *claims, char **cser) {
	apr_byte_t rv = FALSE;
	oidc_jwt_t *jwt = NULL;
	oidc_jwk_t *jwk = NULL;
	oidc_jose_error_t err;
	apr_time_t access_token_expires = -1;
	char *key = NULL;
	int ttl = 0;
	int exp = 0;
	apr_time_t expiry = 0;

	if (oidc_proto_jwt_create_from_first_pkey(r, cfg, &jwk, &jwt, FALSE) == FALSE)
		goto end;

	oidc_json_object_set_new(jwt->payload.value.json, OIDC_CLAIM_AUD,
				 oidc_json_string(oidc_util_url_cur(r, oidc_cfg_x_forwarded_headers_get(cfg))));
	oidc_json_object_set_new(jwt->payload.value.json, OIDC_CLAIM_ISS,
				 oidc_json_string(oidc_cfg_provider_issuer_get(oidc_cfg_provider_get(cfg))));

	if (oidc_json_merge(r, claims, jwt->payload.value.json) == FALSE)
		goto end;
	const char *s_claims =
	    oidc_json_encode(r->pool, jwt->payload.value.json, OIDC_JSON_PRESERVE_ORDER | OIDC_JSON_COMPACT);
	if (oidc_jose_hash_and_base64url_encode(r->pool, OIDC_JOSE_ALG_SHA256, s_claims,
						(int)_oidc_strlen(s_claims) + 1, &key, &err) == FALSE) {
		oidc_error(r, "oidc_jose_hash_and_base64url_encode failed: %s", oidc_jose_e2s(r->pool, err));
		goto end;
	}

	ttl = oidc_userinfo_signed_jwt_cache_ttl(r);
	if (ttl > -1)
		oidc_cache_get_signed_jwt(r, key, cser);

	if (*cser != NULL) {
		oidc_debug(r, "signed JWT found in cache");
		rv = TRUE;
		goto end;
	}

	if (oidc_json_object_get(jwt->payload.value.json, OIDC_CLAIM_JTI) == NULL) {
		oidc_json_object_set_new(jwt->payload.value.json, OIDC_CLAIM_JTI,
					 oidc_json_string(oidc_proto_jti_gen(r)));
	}
	if (oidc_json_object_get(jwt->payload.value.json, OIDC_CLAIM_IAT) == NULL) {
		oidc_json_object_set_new(jwt->payload.value.json, OIDC_CLAIM_IAT,
					 oidc_json_integer(apr_time_sec(apr_time_now())));
	}
	if (oidc_json_object_get(jwt->payload.value.json, OIDC_CLAIM_EXP) == NULL) {
		access_token_expires = oidc_session_get_access_token_expires(r, session);
		oidc_json_object_set_new(
		    jwt->payload.value.json, OIDC_CLAIM_EXP,
		    oidc_json_integer(access_token_expires > 0
					  ? apr_time_sec(access_token_expires)
					  : apr_time_sec(apr_time_now()) + OIDC_USERINFO_SIGNED_JWT_EXP_DEFAULT));
	}

	if (oidc_proto_jwt_sign_and_serialize(r, jwk, jwt, cser) == FALSE)
		goto end;

	rv = TRUE;

	if (ttl < 0)
		goto end;

	if (ttl == 0) {
		// need to get the cache ttl from the exp claim
		oidc_json_object_get_int(jwt->payload.value.json, OIDC_CLAIM_EXP, &exp, 0);
		// actually the exp claim always exists by now
		expiry = (exp > 0) ? apr_time_from_sec(exp)
				   : apr_time_now() + apr_time_from_sec(OIDC_USERINFO_SIGNED_JWT_EXP_DEFAULT);
	} else {
		// ttl > 0
		expiry = apr_time_now() + apr_time_from_sec(ttl);
	}

	oidc_debug(r, "caching signed JWT with ~ttl(%ld)", apr_time_sec(expiry - apr_time_now()));
	oidc_cache_set_signed_jwt(r, key, *cser, expiry);

end:

	if (jwt)
		oidc_jwt_destroy(jwt);

	return rv;
}

/*
 * set an appinfo value, falling back to default_name (with the default
 * header prefix) when no explicit name was configured
 */
static void oidc_userinfo_appinfo_set(request_rec *r, const char *name, const char *default_name, const char *value,
				      oidc_appinfo_pass_in_t pass_in, oidc_appinfo_encoding_t encoding) {
	oidc_util_appinfo_set(r, name ? name : default_name, value, name ? "" : OIDC_DEFAULT_HEADER_PREFIX, pass_in,
			      encoding);
}

/*
 * pass the userinfo JWT stored in the session to the app, rejecting the
 * client-cookie session type which does not support storing such JWTs
 */
static void oidc_userinfo_pass_as_jwt(request_rec *r, const oidc_cfg_t *cfg, const oidc_session_t *session,
				      const char *name, oidc_appinfo_pass_in_t pass_in,
				      oidc_appinfo_encoding_t encoding) {

	if (oidc_cfg_session_type_get(cfg) == OIDC_SESSION_TYPE_CLIENT_COOKIE) {
		oidc_error(r, "session type \"client-cookie\" does not allow storing/passing a "
			      "userinfo JWT; use \"" OIDCSessionType " server-cache\" for that");
		return;
	}

	const char *s_userinfo_jwt = oidc_session_get_userinfo_jwt(r, session);
	if (s_userinfo_jwt == NULL) {
		oidc_debug(r, "configured to pass userinfo in a JWT, but no such JWT was found in the session "
			      "(probably no such JWT was returned from the userinfo endpoint)");
		return;
	}

	oidc_userinfo_appinfo_set(r, name, OIDC_APP_INFO_USERINFO_JWT, s_userinfo_jwt, pass_in, encoding);
}

/*
 * dispatch a single configured "pass userinfo as" entry to the matching
 * encoding-specific handler
 */
static void oidc_userinfo_pass_entry(request_rec *r, oidc_cfg_t *cfg, const oidc_session_t *session,
				     oidc_json_t *claims, const oidc_pass_user_info_as_t *p,
				     oidc_appinfo_pass_in_t pass_in, oidc_appinfo_encoding_t encoding) {

	char *cser = NULL;

	switch (p->type) {
	case OIDC_PASS_USERINFO_AS_CLAIMS:
		/* set the userinfo claims in the app headers */
		oidc_set_app_claims(r, cfg, claims);
		break;
	case OIDC_PASS_USERINFO_AS_JSON_OBJECT:
		/* pass the userinfo JSON object to the app in a header or environment variable */
		oidc_userinfo_appinfo_set(
		    r, p->name, OIDC_APP_INFO_USERINFO_JSON,
		    oidc_json_encode(r->pool, claims, OIDC_JSON_PRESERVE_ORDER | OIDC_JSON_COMPACT), pass_in, encoding);
		break;
	case OIDC_PASS_USERINFO_AS_JWT:
		oidc_userinfo_pass_as_jwt(r, cfg, session, p->name, pass_in, encoding);
		break;
	case OIDC_PASS_USERINFO_AS_SIGNED_JWT:
		if (oidc_userinfo_create_signed_jwt(r, cfg, session, claims, &cser) == TRUE)
			oidc_userinfo_appinfo_set(r, p->name, OIDC_APP_INFO_SIGNED_JWT, cser, pass_in, encoding);
		break;
	default:
		break;
	}
}

/*
 * resolve the claims to pass to the app, optionally applying a JQ filter
 * to the userinfo claims stored in the session; *filtered receives the
 * newly allocated oidc_json_t that the caller must release, or NULL when no
 * filter was applied
 */
static oidc_json_t *oidc_userinfo_resolve_claims(request_rec *r, const oidc_session_t *session,
						 oidc_json_t **filtered) {

	*filtered = NULL;

#ifdef USE_LIBJQ
	const char *s_filter = oidc_cfg_dir_userinfo_claims_expr_get(r);
	if (s_filter != NULL) {
		const char *s_claims = oidc_util_jq_filter(r, oidc_session_get_userinfo_claims(r, session), s_filter);
		if (oidc_json_decode_object(r, s_claims, filtered) == FALSE) {
			oidc_error(r, "JQ filtering of claims for [%s] resulted in invalid JSON object, filter='%s'",
				   "userinfo", s_filter);
			return NULL;
		}
		return *filtered;
	}
#endif

	return oidc_session_get_userinfo_claims(r, session);
}

/*
 * pass the userinfo claims to headers and/or environment variables, encoded as configured
 */
void oidc_userinfo_pass_as(request_rec *r, oidc_cfg_t *cfg, const oidc_session_t *session,
			   oidc_appinfo_pass_in_t pass_in, oidc_appinfo_encoding_t encoding) {

	const apr_array_header_t *pass_userinfo_as = oidc_cfg_dir_pass_userinfo_as_get(r);
	oidc_json_t *filtered_claims = NULL;
	oidc_json_t *claims = oidc_userinfo_resolve_claims(r, session, &filtered_claims);

	if (claims == NULL)
		return;

	for (int i = 0; (pass_userinfo_as != NULL) && (i < pass_userinfo_as->nelts); i++)
		oidc_userinfo_pass_entry(r, cfg, session, claims,
					 APR_ARRAY_IDX(pass_userinfo_as, i, oidc_pass_user_info_as_t *), pass_in,
					 encoding);

	if (filtered_claims)
		oidc_json_decref(filtered_claims);
}
