package com.nimbusds.openid.connect.provider.spi.grants;


import java.util.*;

import net.minidev.json.JSONObject;

import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.Audience;
import com.nimbusds.oauth2.sdk.id.Subject;
import com.nimbusds.oauth2.sdk.util.JSONObjectUtils;

import com.nimbusds.openid.connect.sdk.claims.ACR;
import com.nimbusds.openid.connect.sdk.claims.AMR;


/**
 * Authorisation response from a {@link PasswordGrantHandler}.
 *
 * <p>The minimum details it contains is the identifier of the authenticated
 * subject (end-user) and the authorised scope values. The other parameters are
 * optional or have suitable defaults.
 */
public class PasswordGrantAuthorization extends GrantAuthorization {


        /**
         * The identifier of the authorised subject.
         */
        private final Subject subject;


        /**
         * The time of the subject authentication. If {@code null} it will be
         * set to now. Applies only if an ID token is issued.
         */
        private final Date authTime;


        /**
         * The Authentication Context Class Reference (ACR), {@code null} if
         * not specified. Applies only if an ID token is issued.
         */
        private final ACR acr;


        /**
         * The Authentication Methods Reference (AMR) list, {@code null} if not
         * specified. Applies only if an ID token is issued.
         */
        private final List<AMR> amrList;


        /**
         * Controls the authorisation lifetime. {@code true} for a long-lived
         * authorisation (implies persistence), {@code false} for a short-lived
         * one.
         */
        private final boolean longLived;


        /**
         * The refresh token specification.
         */
        private final RefreshTokenSpec refreshTokenSpec;


        /**
         * The ID token specification.
         */
        private final IDTokenSpec idTokenSpec;


        /**
         * The OpenID Connect claims spec.
         */
        private final ClaimsSpec claimsSpec;


        /**
         * Creates a new OAuth 2.0 - only authorisation response from a
         * {@link PasswordGrantHandler}.
         *
         * @param subject             The identifier of the authorised
         *                            subject. Must not be {@code null}.
         * @param scope               The authorised scope values. Must not be
         *                            {@code null}.
         * @param audList             Explicit list of audiences for the access
         *                            token, {@code null} if not specified.
         * @param longLived           Controls the authorisation lifetime.
         *                            {@code true} for a long-lived
         *                            authorisation (implies persistence),
         *                            {@code false} for a short-lived
         *                            (transient) one.
         * @param accessTokenSpec     The access token specification. Must not
         *                            be {@code null}.
         * @param refreshTokenSpec    The refresh token specification. Must not
         *                            be {@code null}.
         * @param data                Optional authorisation data as a JSON
         *                            object, {@code null} if not specified.
         */
        public PasswordGrantAuthorization(final Subject subject,
                                          final Scope scope,
                                          final List<Audience> audList,
                                          final boolean longLived,
                                          final AccessTokenSpec accessTokenSpec,
                                          final RefreshTokenSpec refreshTokenSpec,
                                          final JSONObject data) {

                this (subject, null, null, null, scope, audList, longLived, accessTokenSpec, refreshTokenSpec, new IDTokenSpec(), new ClaimsSpec(), data);
        }


        /**
         * Creates a new OpenID Connect / OAuth 2.0 authorisation response from
         * a {@link PasswordGrantHandler}.
         *
         * @param subject              The identifier of the authorised
         *                             subject. Must not be {@code null}.
         * @param authTime             The time of the subject authentication.
         *                             If {@code null} it will be set to now.
         *                             Applies only if an ID token is issued.
         * @param acr                  The Authentication Context Class
         *                             Reference (ACR), {@code null} if not
         *                             specified. Applies only if an ID token
         *                             is issued.
         * @param amrList              The Authentication Methods Reference
         *                             (AMR) list, {@code null} if not
         *                             specified. Applies only if an ID token
         *                             is issued.
         * @param scope                The authorised scope values. Must not be
         *                             {@code null}.
         * @param audList              Explicit list of audiences for the
         *                             access token, {@code null} if not
         *                             specified.
         * @param longLived            Controls the authorisation lifetime.
         *                             {@code true} for a long-lived
         *                             authorisation (implies persistence),
         *                             {@code false} for a short-lived one.
         * @param accessTokenSpec      The access token specification. Must not
         *                             be {@code null}.
         * @param refreshTokenSpec     The refresh token specification. Must not
         *                             be {@code null}.
         * @param idTokenSpec          The ID token specification. Must not be
         *                             {@code null}.
         * @param claimsSpec           The claims specification.
         * @param data                 Optional authorisation data as a JSON
         *                             object, {@code null} if not specified.
         */
        public PasswordGrantAuthorization(final Subject subject,
                                          final Date authTime,
                                          final ACR acr,
                                          final List<AMR> amrList,
                                          final Scope scope,
                                          final List<Audience> audList,
                                          final boolean longLived,
                                          final AccessTokenSpec accessTokenSpec,
                                          final RefreshTokenSpec refreshTokenSpec,
                                          final IDTokenSpec idTokenSpec,
                                          final ClaimsSpec claimsSpec,
                                          final JSONObject data) {

                super(scope, audList, accessTokenSpec, data);

                if (subject == null) {
                        throw new IllegalArgumentException("The subject must not be null");
                }

                this.subject = subject;

                this.authTime = authTime;
                this.acr = acr;
                this.amrList = amrList;
                this.longLived = longLived;

                if (refreshTokenSpec == null) {
                        throw new IllegalArgumentException("The refresh token specification must not be null");
                }

                if (longLived) {
                        this.refreshTokenSpec = refreshTokenSpec;
                } else {
                        // Defaults to no-issue
                        this.refreshTokenSpec = new RefreshTokenSpec();
                }

                if (idTokenSpec == null) {
                        throw new IllegalArgumentException("The ID token specification must not be null");
                }

                this.idTokenSpec = idTokenSpec;

                if (claimsSpec == null) {
                        throw new IllegalArgumentException("The claim specification must not be null");
                }

                this.claimsSpec = claimsSpec;
        }


        /**
         * Returns the authorised subject.
         *
         * @return The identifier of the authorised subject.
         */
        public Subject getSubject() {

                return subject;
        }


        /**
         * Returns the time of the subject authentication.
         *
         * @return The time of the subject authentication. If {@code null} it
         *         will be set to now. Applies only if an ID token is issued.
         */
        public Date getAuthTime() {

                return authTime;
        }


        /**
         * Returns the Authentication Context Class Reference (ACR).
         *
         * @return The Authentication Context Class Reference (ACR),
         *         {@code null} if not specified. Applies only if an ID token
         *         is issued.
         */
        public ACR getACR() {

                return acr;
        }


        /**
         * Returns The Authentication Methods Reference (AMR) list.
         *
         * @return The Authentication Methods Reference (AMR) list,
         *         {@code null} if not specified. Applies only if an ID token
         *         is issued.
         */
        public List<AMR> getAMRList() {

                return amrList;
        }


        /**
         * Returns the authorisation lifetime.
         *
         * @return {@code true} for a long-lived authorisation (implies
         *         persistence), {@code false} for a short-lived one.
         */
        public boolean isLongLived() {

                return longLived;
        }


        /**
         * Returns the refresh token specification.
         *
         * @return The refresh token specification.
         */
        public RefreshTokenSpec getRefreshTokenSpec() {

                return refreshTokenSpec;
        }


        /**
         * Returns the ID token specification.
         *
         * @return The ID token specification.
         */
        public IDTokenSpec getIDTokenSpec() {

                return idTokenSpec;
        }


        /**
         * Returns the claims specification.
         *
         * @return The claims specification.
         */
        public ClaimsSpec getClaimsSpec() {

                return claimsSpec;
        }


        /**
         * Returns a JSON object representation of this authorisation response.
         *
         * @return The JSON object representation.
         */
        public JSONObject toJSONObject() {

                JSONObject o = super.toJSONObject();

                o.put("sub", subject.getValue());

                if (authTime != null) {
                        o.put("auth_time", authTime.getTime() / 1000l);
                }

                if (acr != null) {
                        o.put("acr", acr.getValue());
                }

                if (amrList != null) {

                        List<String> sl = new ArrayList<>(amrList.size());

                        for (AMR amr: amrList) {
                                sl.add(amr.getValue());
                        }

                        o.put("amr", sl);
                }

                o.put("long_lived", longLived);

                if (longLived && refreshTokenSpec.issue()) {
                        o.put("refresh_token", refreshTokenSpec.toJSONObject());
                }

                if (idTokenSpec.issue()) {
                        o.put("id_token", idTokenSpec.toJSONObject());
                }

                o.putAll(claimsSpec.toJSONObject());

                return o;
        }


        /**
         * Parses an authorisation response from the specified JSON object
         * representation.
         *
         * @param o The JSON object to parse. Must not be {@code null}.
         *
         * @return The authorisation response.
         *
         * @throws ParseException If parsing failed.
         */
        public static PasswordGrantAuthorization parse(final JSONObject o)
                throws ParseException {

                GrantAuthorization basicAuthz = GrantAuthorization.parse(o);

                Subject sub = new Subject(JSONObjectUtils.getString(o, "sub"));

                Date authTime = null;

                if (o.containsKey("auth_time")) {
                        authTime = new Date(JSONObjectUtils.getLong(o, "auth_time") * 1000l);
                }

                ACR acr = null;

                if (o.containsKey("acr")) {
                        acr = new ACR(JSONObjectUtils.getString(o, "acr"));
                }

                List<AMR> amrList = null;

                if (o.containsKey("amr")) {
                        String[] sa = JSONObjectUtils.getStringArray(o, "amr");
                        amrList = new ArrayList<>(sa.length);
                        for (String s: sa) {
                                amrList.add(new AMR(s));
                        }
                }

                boolean longLived = false;

                if (o.containsKey("long_lived")) {
                        longLived = JSONObjectUtils.getBoolean(o, "long_lived");
                }

                RefreshTokenSpec rtSpec = new RefreshTokenSpec();

                if (longLived && o.containsKey("refresh_token")) {

                        rtSpec = RefreshTokenSpec.parse(JSONObjectUtils.getJSONObject(o, "refresh_token"));
                }

                IDTokenSpec idSpec = new IDTokenSpec();

                if (o.containsKey("id_token")) {

                        idSpec = IDTokenSpec.parse(JSONObjectUtils.getJSONObject(o, "id_token"));
                }

                ClaimsSpec clSpec = ClaimsSpec.parse(o);

                return new PasswordGrantAuthorization(
                        sub, authTime, acr, amrList,
                        basicAuthz.getScope(),
                        basicAuthz.getAudience(),
                        longLived,
                        basicAuthz.getAccessTokenSpec(),
                        rtSpec,
                        idSpec,
                        clSpec,
                        basicAuthz.getData());
        }
}