/*
 * Copyright (C) 2021 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package com.android.libraries.entitlement.eapaka;

import static com.android.libraries.entitlement.ServiceEntitlementException.ERROR_EAP_AKA_SYNCHRONIZATION_FAILURE;
import static com.android.libraries.entitlement.ServiceEntitlementException.ERROR_MALFORMED_HTTP_RESPONSE;

import android.content.Context;
import android.net.Uri;
import android.telephony.TelephonyManager;
import android.text.TextUtils;
import android.util.Log;

import androidx.annotation.Nullable;
import androidx.annotation.VisibleForTesting;

import com.android.libraries.entitlement.CarrierConfig;
import com.android.libraries.entitlement.EsimOdsaOperation;
import com.android.libraries.entitlement.ServiceEntitlementException;
import com.android.libraries.entitlement.ServiceEntitlementRequest;
import com.android.libraries.entitlement.http.HttpClient;
import com.android.libraries.entitlement.http.HttpConstants.RequestMethod;
import com.android.libraries.entitlement.http.HttpRequest;
import com.android.libraries.entitlement.http.HttpResponse;

import com.google.common.collect.ImmutableList;
import com.google.common.net.HttpHeaders;

import org.json.JSONException;
import org.json.JSONObject;

public class EapAkaApi {
    private static final String TAG = "ServiceEntitlement";

    public static final String EAP_CHALLENGE_RESPONSE = "eap-relay-packet";

    private static final String VERS = "vers";
    private static final String ENTITLEMENT_VERSION = "entitlement_version";
    private static final String TERMINAL_ID = "terminal_id";
    private static final String TERMINAL_VENDOR = "terminal_vendor";
    private static final String TERMINAL_MODEL = "terminal_model";
    private static final String TERMIAL_SW_VERSION = "terminal_sw_version";
    private static final String APP = "app";
    private static final String EAP_ID = "EAP_ID";
    private static final String IMSI = "IMSI";
    private static final String TOKEN = "token";
    private static final String NOTIF_ACTION = "notif_action";
    private static final String NOTIF_TOKEN = "notif_token";
    private static final String APP_VERSION = "app_version";
    private static final String APP_NAME = "app_name";

    private static final String OPERATION = "operation";
    private static final String OPERATION_TYPE = "operation_type";
    private static final String COMPANION_TERMINAL_ID = "companion_terminal_id";
    private static final String COMPANION_TERMINAL_VENDOR = "companion_terminal_vendor";
    private static final String COMPANION_TERMINAL_MODEL = "companion_terminal_model";
    private static final String COMPANION_TERMINAL_SW_VERSION = "companion_terminal_sw_version";
    private static final String COMPANION_TERMINAL_FRIENDLY_NAME =
            "companion_terminal_friendly_name";
    private static final String COMPANION_TERMINAL_SERVICE = "companion_terminal_service";
    private static final String COMPANION_TERMINAL_ICCID = "companion_terminal_iccid";
    private static final String COMPANION_TERMINAL_EID = "companion_terminal_eid";

    private static final String TERMINAL_ICCID = "terminal_iccid";
    private static final String TERMINAL_EID = "terminal_eid";

    private static final String TARGET_TERMINAL_ID = "target_terminal_id";
    private static final String TARGET_TERMINAL_ICCID = "target_terminal_iccid";
    private static final String TARGET_TERMINAL_EID = "target_terminal_eid";

    // In case of EAP-AKA synchronization failure, we try to recover for at most two times.
    private static final int FOLLOW_SYNC_FAILURE_MAX_COUNT = 2;

    private final Context mContext;
    private final int mSimSubscriptionId;
    private final HttpClient mHttpClient;

    public EapAkaApi(Context context, int simSubscriptionId) {
        this(context, simSubscriptionId, new HttpClient());
    }

    @VisibleForTesting
    EapAkaApi(Context context, int simSubscriptionId, HttpClient httpClient) {
        this.mContext = context;
        this.mSimSubscriptionId = simSubscriptionId;
        this.mHttpClient = httpClient;
    }

    /**
     * Retrieves raw entitlement configuration doc though EAP-AKA authentication.
     *
     * <p>Implementation based on GSMA TS.43-v5.0 2.6.1.
     *
     * @throws ServiceEntitlementException when getting an unexpected http response.
     */
    @Nullable
    public String queryEntitlementStatus(ImmutableList<String> appIds,
            CarrierConfig carrierConfig, ServiceEntitlementRequest request)
            throws ServiceEntitlementException {
        Uri.Builder urlBuilder = Uri.parse(carrierConfig.serverUrl()).buildUpon();
        appendParametersForServiceEntitlementRequest(urlBuilder, appIds, request);
        if (!TextUtils.isEmpty(request.authenticationToken())) {
            // Fast Re-Authentication flow with pre-existing auth token
            Log.d(TAG, "Fast Re-Authentication");
            return httpGet(
                    urlBuilder.toString(), carrierConfig, request.acceptContentType()).body();
        } else {
            // Full Authentication flow
            Log.d(TAG, "Full Authentication");
            HttpResponse challengeResponse =
                    httpGet(
                        urlBuilder.toString(),
                        carrierConfig,
                        ServiceEntitlementRequest.ACCEPT_CONTENT_TYPE_JSON);
            return respondToEapAkaChallenge(
                    carrierConfig,
                    challengeResponse,
                    FOLLOW_SYNC_FAILURE_MAX_COUNT,
                    request.acceptContentType())
                    .body();
        }
    }

    /**
     * Sends a follow-up HTTP request to the HTTP {@code response} using the same cookie, and
     * returns the follow-up HTTP response.
     *
     * <p>The {@code response} should contain a EAP-AKA challenge from server, and the
     * follow-up request could contain:
     *
     * <ul>
     *   <li>The EAP-AKA response message, and the follow-up response should contain the
     *       service entitlement configuration; or,
     *   <li>The EAP-AKA synchronization failure message, and the follow-up response should
     *       contain the new EAP-AKA challenge. Then this method calls itself to follow-up
     *       the new challenge and return a new response, if {@code followSyncFailureCount}
     *       is greater than zero. When this method call itself {@code followSyncFailureCount} is
     *       reduced by one to prevent infinite loop (unlikely in practice, but just in case).
     * </ul>
     *
     * @param response Challenge response from server which its content type is JSON
     */
    private HttpResponse respondToEapAkaChallenge(
            CarrierConfig carrierConfig,
            HttpResponse response,
            int followSyncFailureCount,
            String contentType)
            throws ServiceEntitlementException {
        String eapAkaChallenge;
        try {
            eapAkaChallenge = new JSONObject(response.body()).getString(EAP_CHALLENGE_RESPONSE);
        } catch (JSONException jsonException) {
            throw new ServiceEntitlementException(
                    ERROR_MALFORMED_HTTP_RESPONSE, "Failed to parse json object", jsonException);
        }
        EapAkaChallenge challenge = EapAkaChallenge.parseEapAkaChallenge(eapAkaChallenge);
        EapAkaResponse eapAkaResponse =
                EapAkaResponse.respondToEapAkaChallenge(mContext, mSimSubscriptionId, challenge);
        // This could be a successful authentication, or synchronization failure.
        if (eapAkaResponse.response() != null) { // successful authentication
            return challengeResponse(
                            eapAkaResponse.response(),
                            carrierConfig,
                            response.cookies(),
                            contentType);
        } else if (eapAkaResponse.synchronizationFailureResponse() != null) {
            Log.d(TAG, "synchronization failure");
            HttpResponse newChallenge =
                    challengeResponse(
                            eapAkaResponse.synchronizationFailureResponse(),
                            carrierConfig,
                            response.cookies(),
                            ServiceEntitlementRequest.ACCEPT_CONTENT_TYPE_JSON);
            if (followSyncFailureCount > 0) {
                return respondToEapAkaChallenge(
                        carrierConfig, newChallenge, followSyncFailureCount - 1, contentType);
            } else {
                throw new ServiceEntitlementException(
                        ERROR_EAP_AKA_SYNCHRONIZATION_FAILURE,
                        "Unable to recover from EAP-AKA synchroinization failure");
            }
        } else { // not possible
            throw new AssertionError("EapAkaResponse invalid.");
        }
    }

    private HttpResponse challengeResponse(
            String eapAkaChallengeResponse,
            CarrierConfig carrierConfig,
            ImmutableList<String> cookies,
            String contentType)
            throws ServiceEntitlementException {
        Log.d(TAG, "challengeResponse");
        JSONObject postData = new JSONObject();
        try {
            postData.put(EAP_CHALLENGE_RESPONSE, eapAkaChallengeResponse);
        } catch (JSONException jsonException) {
            throw new ServiceEntitlementException(
                    ERROR_MALFORMED_HTTP_RESPONSE, "Failed to put post data", jsonException);
        }
        HttpRequest request =
                HttpRequest.builder()
                        .setUrl(carrierConfig.serverUrl())
                        .setRequestMethod(RequestMethod.POST)
                        .setPostData(postData)
                        .addRequestProperty(HttpHeaders.ACCEPT, contentType)
                        .addRequestProperty(
                                HttpHeaders.CONTENT_TYPE,
                                ServiceEntitlementRequest.ACCEPT_CONTENT_TYPE_JSON)
                        .addRequestProperty(HttpHeaders.COOKIE, cookies)
                        .setTimeoutInSec(carrierConfig.timeoutInSec())
                        .setNetwork(carrierConfig.network())
                        .build();
        return mHttpClient.request(request);
    }

    /**
     * Retrieves raw doc of performing ODSA operations. For operation type, see {@link
     * EsimOdsaOperation}.
     *
     * <p>Implementation based on GSMA TS.43-v5.0 6.1.
     */
    public String performEsimOdsaOperation(String appId, CarrierConfig carrierConfig,
            ServiceEntitlementRequest request, EsimOdsaOperation odsaOperation)
            throws ServiceEntitlementException {
        Uri.Builder urlBuilder = Uri.parse(carrierConfig.serverUrl()).buildUpon();
        appendParametersForServiceEntitlementRequest(urlBuilder, ImmutableList.of(appId), request);
        appendParametersForEsimOdsaOperation(urlBuilder, odsaOperation);

        if (!TextUtils.isEmpty(request.authenticationToken())) {
            // Fast Re-Authentication flow with pre-existing auth token
            Log.d(TAG, "Fast Re-Authentication");
            return httpGet(
                    urlBuilder.toString(), carrierConfig, request.acceptContentType()).body();
        } else {
            // Full Authentication flow
            Log.d(TAG, "Full Authentication");
            HttpResponse challengeResponse =
                    httpGet(
                            urlBuilder.toString(),
                            carrierConfig,
                            ServiceEntitlementRequest.ACCEPT_CONTENT_TYPE_JSON);
            return respondToEapAkaChallenge(
                    carrierConfig,
                    challengeResponse,
                    FOLLOW_SYNC_FAILURE_MAX_COUNT,
                    request.acceptContentType())
                    .body();
        }
    }

    private void appendParametersForServiceEntitlementRequest(
            Uri.Builder urlBuilder, ImmutableList<String> appIds,
            ServiceEntitlementRequest request) {
        TelephonyManager telephonyManager = mContext.getSystemService(
                TelephonyManager.class).createForSubscriptionId(mSimSubscriptionId);
        if (TextUtils.isEmpty(request.authenticationToken())) {
            // EAP_ID required for initial AuthN
            urlBuilder.appendQueryParameter(
                    EAP_ID,
                    getImsiEap(telephonyManager.getSimOperator(),
                            telephonyManager.getSubscriberId()));
        } else {
            // IMSI and token required for fast AuthN.
            urlBuilder
                    .appendQueryParameter(IMSI, telephonyManager.getSubscriberId())
                    .appendQueryParameter(TOKEN, request.authenticationToken());
        }

        if (!TextUtils.isEmpty(request.notificationToken())) {
            urlBuilder
                    .appendQueryParameter(NOTIF_ACTION,
                            Integer.toString(request.notificationAction()))
                    .appendQueryParameter(NOTIF_TOKEN, request.notificationToken());
        }

        // Assign terminal ID with device IMEI if not set.
        if (TextUtils.isEmpty(request.terminalId())) {
            urlBuilder.appendQueryParameter(TERMINAL_ID, telephonyManager.getImei());
        } else {
            urlBuilder.appendQueryParameter(TERMINAL_ID, request.terminalId());
        }

        // Optional query parameters, append them if not empty
        appendOptionalQueryParameter(urlBuilder, APP_VERSION, request.appVersion());
        appendOptionalQueryParameter(urlBuilder, APP_NAME, request.appName());

        for (String appId : appIds) {
            urlBuilder.appendQueryParameter(APP, appId);
        }

        urlBuilder
                // Identity and Authentication parameters
                .appendQueryParameter(TERMINAL_VENDOR, request.terminalVendor())
                .appendQueryParameter(TERMINAL_MODEL, request.terminalModel())
                .appendQueryParameter(TERMIAL_SW_VERSION, request.terminalSoftwareVersion())
                // General Service parameters
                .appendQueryParameter(VERS, Integer.toString(request.configurationVersion()))
                .appendQueryParameter(ENTITLEMENT_VERSION, request.entitlementVersion());
    }

    private void appendParametersForEsimOdsaOperation(
            Uri.Builder urlBuilder, EsimOdsaOperation odsaOperation) {
        urlBuilder.appendQueryParameter(OPERATION, odsaOperation.operation());
        if (odsaOperation.operationType() != EsimOdsaOperation.OPERATION_TYPE_NOT_SET) {
            urlBuilder.appendQueryParameter(OPERATION_TYPE,
                    Integer.toString(odsaOperation.operationType()));
        }
        appendOptionalQueryParameter(urlBuilder, COMPANION_TERMINAL_ID,
                odsaOperation.companionTerminalId());
        appendOptionalQueryParameter(urlBuilder, COMPANION_TERMINAL_VENDOR,
                odsaOperation.companionTerminalVendor());
        appendOptionalQueryParameter(urlBuilder, COMPANION_TERMINAL_MODEL,
                odsaOperation.companionTerminalModel());
        appendOptionalQueryParameter(urlBuilder, COMPANION_TERMINAL_SW_VERSION,
                odsaOperation.companionTerminalSoftwareVersion());
        appendOptionalQueryParameter(urlBuilder, COMPANION_TERMINAL_FRIENDLY_NAME,
                odsaOperation.companionTerminalFriendlyName());
        appendOptionalQueryParameter(urlBuilder, COMPANION_TERMINAL_SERVICE,
                odsaOperation.companionTerminalService());
        appendOptionalQueryParameter(urlBuilder, COMPANION_TERMINAL_ICCID,
                odsaOperation.companionTerminalIccid());
        appendOptionalQueryParameter(urlBuilder, COMPANION_TERMINAL_EID,
                odsaOperation.companionTerminalEid());
        appendOptionalQueryParameter(urlBuilder, TERMINAL_ICCID,
                odsaOperation.terminalIccid());
        appendOptionalQueryParameter(urlBuilder, TERMINAL_EID, odsaOperation.terminalEid());
        appendOptionalQueryParameter(urlBuilder, TARGET_TERMINAL_ID,
                odsaOperation.targetTerminalId());
        appendOptionalQueryParameter(urlBuilder, TARGET_TERMINAL_ICCID,
                odsaOperation.targetTerminalIccid());
        appendOptionalQueryParameter(urlBuilder, TARGET_TERMINAL_EID,
                odsaOperation.targetTerminalEid());
    }

    private HttpResponse httpGet(String url, CarrierConfig carrierConfig, String contentType)
            throws ServiceEntitlementException {
        HttpRequest httpRequest =
                HttpRequest.builder()
                        .setUrl(url)
                        .setRequestMethod(RequestMethod.GET)
                        .addRequestProperty(HttpHeaders.ACCEPT, contentType)
                        .setTimeoutInSec(carrierConfig.timeoutInSec())
                        .setNetwork(carrierConfig.network())
                        .build();
        return mHttpClient.request(httpRequest);
    }

    private void appendOptionalQueryParameter(Uri.Builder urlBuilder, String key, String value) {
        if (!TextUtils.isEmpty(value)) {
            urlBuilder.appendQueryParameter(key, value);
        }
    }

    /**
     * Returns the IMSI EAP value. The resulting realm part of the Root NAI in 3GPP TS 23.003 clause
     * 19.3.2 will be in the form:
     *
     * <p>{@code 0<IMSI>@nai.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org}
     */
    @Nullable
    public static String getImsiEap(@Nullable String mccmnc, @Nullable String imsi) {
        if (mccmnc == null || mccmnc.length() < 5 || imsi == null) {
            return null;
        }

        String mcc = mccmnc.substring(0, 3);
        String mnc = mccmnc.substring(3);
        if (mnc.length() == 2) {
            mnc = "0" + mnc;
        }
        return "0" + imsi + "@nai.epc.mnc" + mnc + ".mcc" + mcc + ".3gppnetwork.org";
    }
}