/*
 *
 *    Copyright (c) 2017 Nest Labs, Inc.
 *    All rights reserved.
 *
 *    Licensed under the Apache License, Version 2.0 (the "License");
 *    you may not use this file except in compliance with the License.
 *    You may obtain a copy of the License at
 *
 *        http://www.apache.org/licenses/LICENSE-2.0
 *
 *    Unless required by applicable law or agreed to in writing, software
 *    distributed under the License is distributed on an "AS IS" BASIS,
 *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *    See the License for the specific language governing permissions and
 *    limitations under the License.
 */

/**
 *    @file
 *      Utility functions for interacting with Weave Access Tokens.
 *
 */

#include <Weave/Core/WeaveCore.h>
#include <Weave/Profiles/WeaveProfiles.h>
#include <Weave/Core/WeaveTLV.h>
#include <Weave/Support/ASN1.h>
#include <Weave/Support/crypto/HashAlgos.h>
#include <Weave/Support/crypto/EllipticCurve.h>
#include <Weave/Profiles/security/WeaveSecurity.h>
#include <Weave/Profiles/security/WeaveCert.h>
#include <Weave/Support/CodeUtils.h>
#include "WeaveAccessToken.h"

namespace nl {
namespace Weave {
namespace Profiles {
namespace Security {

using namespace nl::Weave::ASN1;
using namespace nl::Weave::TLV;
using namespace nl::Weave::Profiles;
using namespace nl::Weave::Crypto;

/**
 * @brief
 *   Load the certificates in an access token into a Weave certificate set.
 *
 * @details
 *   This function decodes a given Weave access token and loads the access token certificates into the
 *   specified Weave certificate set object.  If the access tokens contains one or more related certificate
 *   these are loaded into the certificate set as well.
 *
 * @param accessToken                       A pointer to a buffer containing an encoded Weave Access Token.
 * @param accessTokenLen                    The length of the encoded access token.
 * @param certSet                           The certificate set into which the access token certificates should
 *                                          be loaded.
 * @param devodeFlags                       The certificate decode flags that should be used when loading
 *                                          the certificates.
 * @param accessTokenCert                   A reference to a pointer that will be set to the Weave certificate
 *                                          data structure for the access token certificate. NOTE: This
 *                                          pointer will only be set if the function returns successfully.
 *
 * @retval #WEAVE_NO_ERROR                  If the access token certificates were successfully loaded.
 * @retval tlv-errors                       Weave errors related to reading TLV.
 * @retval cert-errors                      Weave errors related to decoding Weave certificates.
 * @retval platform-errors                  Other platform-specific errors.
 */
WEAVE_ERROR LoadAccessTokenCerts(const uint8_t *accessToken, uint32_t accessTokenLen, WeaveCertificateSet& certSet, uint16_t decodeFlags, WeaveCertificateData *& accessTokenCert)
{
    TLVReader reader;
    reader.Init(accessToken, accessTokenLen);
    return LoadAccessTokenCerts(reader, certSet, decodeFlags, accessTokenCert);
}

/**
 * @brief
 *   Load the certificates in an access token into a Weave certificate set.
 *
 * @details
 *   This function reads a Weave access token from a given TLVReader and loads the access token certificates
 *   into the specified Weave certificate set object.  If the access tokens contains one or more related
 *   certificate these are loaded into the certificate set as well.
 *
 * @param reader                            A TLVReader object that is position immediately before a Weave
 *                                          Access Token.
 * @param certSet                           The certificate set into which the access token certificates should
 *                                          be loaded.
 * @param devodeFlags                       The certificate decode flags that should be used when loading
 *                                          the certificates.
 * @param accessTokenCert                   A reference to a pointer that will be set to the Weave certificate
 *                                          data structure for the access token certificate. NOTE: This value
 *                                          is only set when the function returns successfully.
 *
 * @retval #WEAVE_NO_ERROR                  If the access token certificates were successfully loaded.
 * @retval tlv-errors                       Weave errors related to reading TLV.
 * @retval cert-errors                      Weave errors related to decoding Weave certificates.
 * @retval platform-errors                  Other platform-specific errors.
 */
WEAVE_ERROR LoadAccessTokenCerts(TLVReader& reader, WeaveCertificateSet& certSet, uint16_t decodeFlags, WeaveCertificateData *& accessTokenCert)
{
    WEAVE_ERROR err = WEAVE_NO_ERROR;
    TLVType tokenContainer;

    reader.ImplicitProfileId = kWeaveProfile_Security;

    // Advance the reader to the start of the access token structure.
    err = reader.Next(kTLVType_Structure, ProfileTag(kWeaveProfile_Security, kTag_WeaveAccessToken));
    SuccessOrExit(err);

    // Enter the structure.
    err = reader.EnterContainer(tokenContainer);
    SuccessOrExit(err);

    // Advance to the first element, which should be the access token certificate.
    err = reader.Next(kTLVType_Structure, ContextTag(kTag_AccessToken_Certificate));
    SuccessOrExit(err);

    // Load the access token certificate into the certificate set.  Return a pointer to the
    // cert data structure to the caller.
    err = certSet.LoadCert(reader, decodeFlags, accessTokenCert);
    SuccessOrExit(err);

    // Advance to the private key field. (We will be ignoring this).
    err = reader.Next(kTLVType_Structure, ContextTag(kTag_AccessToken_PrivateKey));
    SuccessOrExit(err);

    // Advance to the related certificates field.  If the field is present...
    err = reader.Next(kTLVType_Structure, ContextTag(kTag_AccessToken_RelatedCertificates));
    if (err == WEAVE_NO_ERROR) {

        // Load the related certificates into the certificate set.
        err = certSet.LoadCerts(reader, decodeFlags);
        SuccessOrExit(err);
    }
    else {
        if (err == WEAVE_END_OF_TLV)
            err = WEAVE_NO_ERROR;
        SuccessOrExit(err);
    }

    // Verify there are no further fields in the access token.
    err = reader.VerifyEndOfContainer();
    SuccessOrExit(err);

    // Exit the access token container.
    err = reader.ExitContainer(tokenContainer);
    SuccessOrExit(err);

exit:
    return err;
}

/**
 * @brief
 *   Reads a Weave Access Token and constructs a CASE Certificate Info TLV structure containing the
 *   certificates from the access token.
 *
 * @details
 *   This function decodes a given Weave Access Token and encodes the TLV for a Weave CASE Certificate
 *   Info structure.  The EntityCertificate field within the CertificateInfo structure is set to the
 *   access token certificate, and the RelatedCertificates field (if present) is set to the corresponding
 *   field within the access token.
 *
 * @param accessToken                       A pointer to a buffer containing an encoded Weave Access Token.
 * @param accessTokenLen                    The length of the encoded access token.
 * @param certInfoBuf                       A pointer to a buffer into which the CASE certificate info
 *                                          structure should be encoded.
 * @param certInfoBufSize                   The size of the buffer pointed to by certInfoBuf.
 * @param certInfoLen                       A reference to an integer will be set to the length of the
 *                                          encoded certificate info structure. NOTE: This value is only
 *                                          set when the function returns successfully.
 *
 * @retval #WEAVE_NO_ERROR                  If the access CASE certificate info structure was successfully
 *                                          encoded.
 * @retval tlv-errors                       Weave errors related to reading or writing TLV.
 * @retval cert-errors                      Weave errors related to decoding Weave certificates.
 * @retval platform-errors                  Other platform-specific errors.
 */
WEAVE_ERROR CASECertInfoFromAccessToken(const uint8_t *accessToken, uint32_t accessTokenLen, uint8_t *certInfoBuf, uint16_t certInfoBufSize, uint16_t& certInfoLen)
{
    WEAVE_ERROR err = WEAVE_NO_ERROR;
    TLVReader reader;
    TLVWriter writer;

    reader.Init(accessToken, accessTokenLen);

    writer.Init(certInfoBuf, certInfoBufSize);
    writer.ImplicitProfileId = kWeaveProfile_Security;

    err = CASECertInfoFromAccessToken(reader, writer);
    SuccessOrExit(err);

    err = writer.Finalize();
    SuccessOrExit(err);

    certInfoLen = writer.GetLengthWritten();

exit:
    return err;
}

/**
 * @brief
 *   Reads a Weave Access Token and writes a CASE Certificate Info TLV structure containing the
 *   certificates from the access token.
 *
 * @details
 *   This function reads a Weave Access Token from a given TLVReader and writes the TLV for a Weave CASE Certificate
 *   Info structure to a TLVWriter.  The EntityCertificate field within the CertificateInfo structure is set to the
 *   access token certificate, and the RelatedCertificates field (if present) is set to the corresponding
 *   field within the access token.
 *
 * @param accessToken                       A pointer to a buffer containing an encoded Weave Access Token.
 * @param accessTokenLen                    The length of the encoded access token.
 * @param certInfoBuf                       A pointer to a buffer into which the CASE certificate info
 *                                          structure should be encoded.
 * @param certInfoBufSize                   The size of the buffer pointed to by certInfoBuf.
 * @param certInfoLen                       A reference to an integer will be set to the length of the
 *                                          encoded certificate info structure. NOTE: This value is only
 *                                          set when the function returns successfully.
 *
 * @retval #WEAVE_NO_ERROR                  If the access CASE certificate info structure was successfully
 *                                          encoded.
 * @retval tlv-errors                       Weave errors related to reading or writing TLV.
 * @retval cert-errors                      Weave errors related to decoding Weave certificates.
 * @retval platform-errors                  Other platform-specific errors.
 */
WEAVE_ERROR CASECertInfoFromAccessToken(TLVReader& reader, TLVWriter& writer)
{
    WEAVE_ERROR err = WEAVE_NO_ERROR;
    TLVType tokenContainer;
    TLVType certInfoContainer;

    reader.ImplicitProfileId = kWeaveProfile_Security;

    // Advance the reader to the start of the access token structure.
    err = reader.Next(kTLVType_Structure, ProfileTag(kWeaveProfile_Security, kTag_WeaveAccessToken));
    SuccessOrExit(err);

    // Enter the structure.
    err = reader.EnterContainer(tokenContainer);
    SuccessOrExit(err);

    // Advance the reader to the first element, which should be the access token certificate.
    err = reader.Next(kTLVType_Structure, ContextTag(kTag_AccessToken_Certificate));
    SuccessOrExit(err);

    // Write the start of the CASE cert info structure to the writer
    err = writer.StartContainer(ProfileTag(kWeaveProfile_Security, kTag_WeaveCASECertificateInformation), kTLVType_Structure, certInfoContainer);
    SuccessOrExit(err);

    // Copy the access token certificate into the cert info structure, using the EntityCertificate tag.
    err = writer.CopyContainer(ContextTag(kTag_CASECertificateInfo_EntityCertificate), reader);
    SuccessOrExit(err);

    // Advance the reader to the private key field. (We will be ignoring this).
    err = reader.Next(kTLVType_Structure, ContextTag(kTag_AccessToken_PrivateKey));
    SuccessOrExit(err);

    // Advance the reader to the related certificates field.  If the field is present...
    err = reader.Next(kTLVType_Structure, ContextTag(kTag_AccessToken_RelatedCertificates));
    if (err == WEAVE_NO_ERROR) {

        // Copy the related certificates collection into the cert info structure, using the EntityCertificate tag.
        err = writer.CopyContainer(ContextTag(kTag_CASECertificateInfo_RelatedCertificates), reader);
        SuccessOrExit(err);
    }
    else {
        if (err == WEAVE_END_OF_TLV)
            err = WEAVE_NO_ERROR;
        SuccessOrExit(err);
    }

    // Verify there are no further fields in the access token.
    err = reader.VerifyEndOfContainer();
    SuccessOrExit(err);

    // Exit the access token container.
    err = reader.ExitContainer(tokenContainer);
    SuccessOrExit(err);

    // Finish writing the cert info container.
    err = writer.EndContainer(certInfoContainer);
    SuccessOrExit(err);

exit:
    return err;
}

WEAVE_ERROR ExtractPrivateKeyFromAccessToken(const uint8_t *accessToken, uint32_t accessTokenLen, uint8_t *privKeyBuf, uint16_t privKeyBufSize, uint16_t& privKeyLen)
{
    WEAVE_ERROR err = WEAVE_NO_ERROR;
    TLVReader reader;
    TLVWriter writer;

    reader.Init(accessToken, accessTokenLen);

    writer.Init(privKeyBuf, privKeyBufSize);

    err = ExtractPrivateKeyFromAccessToken(reader, writer);
    SuccessOrExit(err);

    err = writer.Finalize();
    SuccessOrExit(err);

    privKeyLen = writer.GetLengthWritten();

exit:
    return err;
}

WEAVE_ERROR ExtractPrivateKeyFromAccessToken(TLVReader& reader, TLVWriter& writer)
{
    WEAVE_ERROR err = WEAVE_NO_ERROR;
    TLVType tokenContainer;

    reader.ImplicitProfileId = kWeaveProfile_Security;

    // Advance the reader to the start of the access token structure.
    err = reader.Next(kTLVType_Structure, ProfileTag(kWeaveProfile_Security, kTag_WeaveAccessToken));
    SuccessOrExit(err);

    // Enter the structure.
    err = reader.EnterContainer(tokenContainer);
    SuccessOrExit(err);

    // Advance the reader to the first element, which should be the access token certificate.
    err = reader.Next(kTLVType_Structure, ContextTag(kTag_AccessToken_Certificate));
    SuccessOrExit(err);

    // Advance the reader to the next element, which should be the private key field.
    err = reader.Next(kTLVType_Structure, ContextTag(kTag_AccessToken_PrivateKey));
    SuccessOrExit(err);

    // Copy the private key to the writer, changing the tag to EllipticCurvePrivateKey.
    err = writer.CopyContainer(ProfileTag(kWeaveProfile_Security, kTag_EllipticCurvePrivateKey), reader);
    SuccessOrExit(err);

    // Exit the access token container.
    err = reader.ExitContainer(tokenContainer);
    SuccessOrExit(err);

exit:
    return err;
}


} // namespace Security
} // namespace Profiles
} // namespace Weave
} // namespace nl