/*
 * The contents of this file are subject to the terms of the Common Development and
 * Distribution License (the License). You may not use this file except in compliance with the
 * License.
 *
 * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
 * specific language governing permission and limitations under the License.
 *
 * When distributing Covered Software, include this CDDL Header Notice in each file and include
 * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
 * Header, with the fields enclosed by brackets [] replaced by your own identifying
 * information: "Portions Copyright [year] [name of copyright owner]".
 *
 * Copyright 2016 ForgeRock AS.
 * Portions Copyright 2026 3A Systems, LLC.
 */
package org.forgerock.opendj.rest2ldap.authz;

import static org.forgerock.json.JsonValueFunctions.*;
import static org.forgerock.opendj.rest2ldap.Rest2ldapMessages.*;
import static org.forgerock.opendj.rest2ldap.authz.Utils.newAccessTokenException;
import static org.forgerock.util.Reject.checkNotNull;
import static org.forgerock.util.promise.Promises.newExceptionPromise;
import static org.forgerock.util.promise.Promises.newResultPromise;

import java.io.IOException;
import java.io.InputStream;
import java.nio.file.Files;
import java.nio.file.InvalidPathException;
import java.nio.file.Path;
import java.nio.file.Paths;

import org.forgerock.http.oauth2.AccessTokenException;
import org.forgerock.http.oauth2.AccessTokenInfo;
import org.forgerock.http.oauth2.AccessTokenResolver;
import org.forgerock.http.util.Json;
import org.forgerock.json.JsonValue;
import org.forgerock.json.JsonValueException;
import org.forgerock.services.context.Context;
import org.forgerock.util.promise.Promise;

/**
 * A file access token resolver which should only be used for test purpose.
 * <p>
 * The token is the name of a file directly inside the token folder. The token arrives verbatim from the
 * {@code Authorization} header of an unauthenticated request, so a token which is not a plain file name (it
 * contains a path separator, or it resolves to a file outside the folder) is refused before any file is opened.
 */
final class FileAccessTokenResolver implements AccessTokenResolver {

    private final Path folder;

    FileAccessTokenResolver(final String folderPath) {
        this.folder = Paths.get(checkNotNull(folderPath)).toAbsolutePath().normalize();
    }

    @Override
    public Promise<AccessTokenInfo, AccessTokenException> resolve(final Context context, final String token) {
        final Path tokenFile = tokenFile(token);
        if (tokenFile == null) {
            return newExceptionPromise(newAccessTokenException(ERR_OAUTH2_FILE_INVALID_TOKEN_NAME.get(token)));
        }

        final JsonValue accessToken;
        try (final InputStream stream = Files.newInputStream(tokenFile)) {
            accessToken = new JsonValue(Json.readJsonLenient(stream));
        } catch (final IOException e) {
            return newExceptionPromise(newAccessTokenException(ERR_OAUTH2_FILE_NO_TOKEN.get(token) , e));
        }

        try {
            final AccessTokenInfo result = new AccessTokenInfo(accessToken, token,
                    accessToken.get("scope").required().as(setOf(String.class)),
                    accessToken.get("expireTime").required().asLong());
            return newResultPromise(result);
        } catch (final JsonValueException e) {
            return newExceptionPromise(
                    newAccessTokenException(ERR_OAUTH2_FILE_INVALID_JSON_TOKEN.get(token, e.getMessage()), e));
        }
    }

    /**
     * Returns the file named by the token inside the token folder, or {@code null} when the token is not a plain
     * file name. Separators are refused whatever the platform treats as one, and the resolved path must still have
     * the folder as its parent and the token as its name once normalized, so that {@code .}, {@code ..}, an empty
     * token or an absolute path never select anything outside the folder.
     */
    private Path tokenFile(final String token) {
        if (token.indexOf('/') >= 0 || token.indexOf('\\') >= 0) {
            return null;
        }
        final Path file;
        try {
            file = folder.resolve(token).normalize();
        } catch (final InvalidPathException e) {
            return null;
        }
        final Path name = file.getFileName();
        return folder.equals(file.getParent()) && name != null && token.equals(name.toString()) ? file : null;
    }
}