/*
 *
 *    Copyright (c) 2016-2017 Nest Labs, Inc.
 *    All rights reserved.
 *
 *    Licensed under the Apache License, Version 2.0 (the "License");
 *    you may not use this file except in compliance with the License.
 *    You may obtain a copy of the License at
 *
 *        http://www.apache.org/licenses/LICENSE-2.0
 *
 *    Unless required by applicable law or agreed to in writing, software
 *    distributed under the License is distributed on an "AS IS" BASIS,
 *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *    See the License for the specific language governing permissions and
 *    limitations under the License.
 */

/**
 *    @file
 *      This file implements a Wrapper for C++ implementation of pincode encryption/decryption functionality.
 *      for pin encryption.
 *
 */

#import "NLWeavePasscodeEncryptionSupport.h"
#include <Weave/Profiles/security/WeavePasscodes.h>

using namespace nl::Weave::Profiles::Security::Passcodes;

NSUInteger const NLWeavePasscode_Config1_TEST_ONLY = kPasscode_Config1_TEST_ONLY;
NSUInteger const NLWeavePasscode_Config2 = kPasscode_Config2;

UInt8 const NLWeavePasscodeEncKeyDiversifier[] = { 0x1A, 0x65, 0x5D, 0x96 };
UInt32 const NLWeavePasscodeEncKeyDiversifierSize = sizeof(NLWeavePasscodeEncKeyDiversifier);
UInt8 const NLWeavePasscodeFingerprintKeyDiversifier[] = { 0xD1, 0xA1, 0xD9, 0x6C };
UInt32 const NLWeavePasscodeFingerprintKeyDiversifierSize = sizeof(NLWeavePasscodeFingerprintKeyDiversifier);

UInt32 const NLWeavePasscodeEncryptionKeyLen = kPasscodeEncryptionKeyLen;
UInt32 const NLWeavePasscodeAuthenticationKeyLen = kPasscodeAuthenticationKeyLen;
UInt32 const NLWeavePasscodeFingerprintKeyLen = kPasscodeFingerprintKeyLen;

NSString *const NLPasscodeEncryptionSupportDomain = @"NLPasscodeEncryptionSupportDomain";

@implementation NLWeavePasscodeEncryptionSupport

#pragma mark Public Methods

+ (NSData *) encryptPasscode: (UInt8) config
                                keyId: (UInt32) keyId
                                nonce: (UInt32) nonce
                             passcode: (NSData *) passcode
                               encKey: (NSData *) encKey
                              authKey: (NSData *) authKey
                       fingerprintKey: (NSData *) fingerprintKey
                       error: (NSError **) errOut {

    if (config != NLWeavePasscode_Config1_TEST_ONLY) {
        if (![NLWeavePasscodeEncryptionSupport validateKeySize: encKey
                                                       authKey: authKey
                                                fingerprintKey: fingerprintKey
                                                         error: errOut]) {
            return nil;
        }
    }
    
    NSMutableData * encPasscodeBuff = [[NSMutableData alloc] initWithLength: kPasscodeMaxEncryptedLen];
    size_t encPasscodeLen =0;
    
    WEAVE_ERROR err = EncryptPasscode(config, keyId, nonce,
                                      (unsigned char *) [passcode bytes],
                                      [passcode length],
                                      (unsigned char *) [encKey bytes],
                                      (unsigned char *) [authKey bytes],
                                      (unsigned char *) [fingerprintKey bytes],
                                      (unsigned char *) [encPasscodeBuff mutableBytes],
                                      [encPasscodeBuff length],
                                      encPasscodeLen);
    if (err != WEAVE_NO_ERROR){
        if (errOut) {
            NSString *failureReason = [NSString stringWithFormat:NSLocalizedString(@"EncryptPasscode error: %d", @""), err];
            NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason };
        
            *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain
                                      code: NLPasscodeEncryptionSupportDomainEncryptionFailure
                                  userInfo: userInfo];
        }
        return nil;
    }
    
    [encPasscodeBuff setLength: encPasscodeLen];
    return encPasscodeBuff;
}

+ (nullable NSData *) decryptPasscode: (NSData *) encPasscode
                               config: (UInt8) config
                               encKey: (NSData *) encKey
                              authKey: (NSData *) authKey
                       fingerprintKey: (NSData *) fingerprintKey
                                error: (NSError **) errOut {
    
    NSMutableData * passcodeBuff = [[NSMutableData alloc] initWithLength: kPasscodePaddedLen];
    size_t passcodeLen =0;
    
    if (config != NLWeavePasscode_Config1_TEST_ONLY) {
        if (![NLWeavePasscodeEncryptionSupport validateKeySize: encKey
                                                       authKey: authKey
                                                fingerprintKey: fingerprintKey
                                                         error: errOut]) {
            return nil;
        }
    }
    
    WEAVE_ERROR err = DecryptPasscode((unsigned char *) [encPasscode bytes],
                                      [encPasscode length],
                                      (unsigned char *) [encKey bytes],
                                      (unsigned char *) [authKey bytes],
                                      (unsigned char *) [fingerprintKey bytes],
                                      (unsigned char *) [passcodeBuff mutableBytes],
                                      [passcodeBuff length],
                                      passcodeLen);
    if (err != WEAVE_NO_ERROR){
        
        NSString *failureReason = [NSString stringWithFormat:NSLocalizedString(@"DecryptPasscode error: %d", @""), err];
        NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason };
        
        *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain
                                      code: NLPasscodeEncryptionSupportDomainDecryptionFailure
                                  userInfo: userInfo];
        return nil;
    }
    
    [passcodeBuff setLength: passcodeLen];
    return passcodeBuff;
}

+ (BOOL) isSupportedPasscodeEncryptionConfig: (UInt8) config {
    return IsSupportedPasscodeEncryptionConfig(config);
}

+ (BOOL) getEncryptedPasscodeConfig: (NSData *) encPasscode
                              config: (UInt8 *) configOut
                               error: (NSError **) errOut {
    UInt8 config =0;
    WEAVE_ERROR err = GetEncryptedPasscodeConfig((unsigned char *) [encPasscode bytes],
                                                [encPasscode length], config);
    if (err != WEAVE_NO_ERROR){
        NSString *failureReason =
        [NSString stringWithFormat:NSLocalizedString(@"retrieving encrypted config error: %d", @""), err];
        NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason };
        
        *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain
                                      code: NLPasscodeEncryptionSupportDomainInvalidData
                                  userInfo: userInfo];
        return FALSE;
    }
    *configOut = config;
    
    return TRUE;
}
+ (BOOL) getEncryptedPasscodeKeyId: (NSData *) encPasscode
                             keyId: (UInt32 *) keyIdOut
                             error: (NSError **) errOut {
    UInt32 keyId =0;
    WEAVE_ERROR err = GetEncryptedPasscodeKeyId((unsigned char *) [encPasscode bytes],
                                                  [encPasscode length], (uint32_t &) keyId);
    if (err != WEAVE_NO_ERROR) {
        NSString *failureReason =
        [NSString stringWithFormat:NSLocalizedString(@"retrieving encrypted config error: %d", @""), err];
        NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason };
        
        *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain
                                      code: NLPasscodeEncryptionSupportDomainInvalidData
                                  userInfo: userInfo];
        return FALSE;
    }
    *keyIdOut = keyId;
    
    return TRUE;
}

+ (BOOL) getEncryptedPasscodeNonce: (NSData *) encPasscode
                             nonce: (UInt32 *) nonceOut
                             error: (NSError **) errOut {
    UInt32 nonce = 0;
    WEAVE_ERROR err = GetEncryptedPasscodeNonce((unsigned char *) [encPasscode bytes],
                                                [encPasscode length], (uint32_t &) nonce);
    if (err != WEAVE_NO_ERROR) {
        NSString *failureReason =
        [NSString stringWithFormat:NSLocalizedString(@"retrieving encrypted passcode nonce: %d", @""), err];
        NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason };
        
        *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain
                                      code: NLPasscodeEncryptionSupportDomainInvalidData
                                  userInfo: userInfo];
        return FALSE;
    }
    *nonceOut = nonce;
    
    return TRUE;
    
}

+ (nullable NSData *) getEncryptedPasscodeFingerprint: (NSData *) encPasscode
                                                error: (NSError **) errOut {
    
    NSMutableData * fingerprint = [[NSMutableData alloc] initWithLength: kPasscodeFingerprintLen];
    size_t fingerprintLen =0;
    
    WEAVE_ERROR err = GetEncryptedPasscodeFingerprint((unsigned char *) [encPasscode bytes],
                                                      [encPasscode length],
                                                      (unsigned char *) [fingerprint mutableBytes],
                                                      [fingerprint length],
                                                      fingerprintLen);
    if (err != WEAVE_NO_ERROR){
        
        NSString *failureReason = [NSString stringWithFormat:NSLocalizedString(@"get fingerprint error: %d", @""), err];
        NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason };
        
        *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain
                                      code: NLPasscodeEncryptionSupportDomainInvalidData
                                  userInfo: userInfo];
        return nil;
    }
    
    [fingerprint setLength: fingerprintLen];
    return fingerprint;
}

#pragma mark Private Methods

+ (BOOL) validateKeySize: (NSData *) encKey
                 authKey: (NSData *) authKey
          fingerprintKey: (NSData *) fingerprintKey
                   error: (NSError **) errOut {
    
    if ([encKey length] != kPasscodeEncryptionKeyLen) {
        if (errOut) {
            *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain
                                          code: NLPasscodeEncryptionSupportDomainInvalidEncKeySize
                                      userInfo: nil];
        }
        return FALSE;
    }
    
    if ([authKey length] != kPasscodeAuthenticationKeyLen) {
        if (errOut) {
            *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain
                                          code: NLPasscodeEncryptionSupportDomainInvalidAuthKeySize
                                      userInfo: nil];
        }
        return FALSE;
    }
    
    if ([fingerprintKey length] != kPasscodeFingerprintKeyLen) {
        
        if (errOut) {
            *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain
                                          code: NLPasscodeEncryptionSupportDomainInvalidFingerprintKeySize
                                      userInfo: nil];
        }
        return FALSE;
    }
    
    return TRUE;
}

@end