//******************************************************************************************************
//  AuthenticationOptions.cs - Gbtc
//
//  Copyright © 2017, Grid Protection Alliance.  All Rights Reserved.
//
//  Licensed to the Grid Protection Alliance (GPA) under one or more contributor license agreements. See
//  the NOTICE file distributed with this work for additional information regarding copyright ownership.
//  The GPA licenses this file to you under the MIT License (MIT), the "License"; you may
//  not use this file except in compliance with the License. You may obtain a copy of the License at:
//
//      http://opensource.org/licenses/MIT
//
//  Unless agreed to in writing, the subject software distributed under the License is distributed on an
//  "AS-IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. Refer to the
//  License for the specific language governing permissions and limitations.
//
//  Code Modification History:
//  ----------------------------------------------------------------------------------------------------
//  08/25/2017 - Stephen C. sWills
//       Generated original version of source code.
//
//******************************************************************************************************

using System;
using System.Collections.Concurrent;
using System.Net;
using System.Text.RegularExpressions;
using GSF.Web.Shared;

namespace GSF.Web.Security
{
    /// <summary>
    /// Represents options for authentication using <see cref="AuthenticationHandler"/>.
    /// </summary>
    public sealed class AuthenticationOptions : Microsoft.Owin.Security.AuthenticationOptions
    {
        #region [ Members ]

        // Constants

        private const string AjaxTokenSuffix = "-Ajax";

        /// <summary>
        /// Default value for <see cref="RequestVerificationToken"/>.
        /// </summary>
        public const string DefaultRequestVerificationToken = "X-GSF-Verify";

        /// <summary>
        /// Default value for <see cref="AjaxRequestVerificationToken"/>.
        /// </summary>
        public const string DefaultAjaxRequestVerificationToken = DefaultRequestVerificationToken + AjaxTokenSuffix;

        /// <summary>
        /// Default value for <see cref="AuthFailureRedirectResourceExpression"/>.
        /// </summary>
        public const string DefaultAuthFailureRedirectResourceExpression = @"^/$|^/.+\.cshtml$|^/.+\.vbhtml$";

        /// <summary>
        /// Default value for <see cref="AnonymousResourceExpression"/>.
        /// </summary>
        public const string DefaultAnonymousResourceExpression = "^/@|^/favicon.ico$";

        /// <summary>
        /// Default value for <see cref="AlternateSecurityProviderResourceExpression"/>.
        /// </summary>
        public const string DefaultAlternateSecurityProviderResourceExpression = "";

        /// <summary>
        /// Default value for <see cref="LoginPage"/>.
        /// </summary>
        public const string DefaultLoginPage = Resources.Root + "/Security/Views/Login.cshtml";

        /// <summary>
        /// Default value for <see cref="LogoutPage"/>.
        /// </summary>
        public const string DefaultLogoutPage = "/Security/logout";

        /// <summary>
        /// Default value for <see cref="AuthTestPage"/>.
        /// </summary>
        public const string DefaultAuthTestPage = "/AuthTest";

        /// <summary>
        /// Default value for <see cref="AuthenticationSchemes"/>.
        /// </summary>
        public const AuthenticationSchemes DefaultAuthenticationSchemes = AuthenticationSchemes.Ntlm | AuthenticationSchemes.Basic;

        /// <summary>
        /// Default value for <see cref="ClearCredentialsParameter"/>.
        /// </summary>
        public const string DefaultClearCredentialsParameter = "clearcredentials";

        // Fields
        private readonly ConcurrentDictionary<string, bool> m_authFailureRedirectResourceCache;
        private readonly ConcurrentDictionary<string, bool> m_anonymousResourceCache;
        private readonly ConcurrentDictionary<string, bool> m_alternateSecurityProviderResourceCache;
        private string m_authFailureRedirectResourceExpression;
        private string m_anonymousResourceExpression;
        private string m_alternateSecurityProviderResourceExpression;
        private Regex m_authFailureRedirectResources;
        private Regex m_alternateSecurityProviderResources;
        private Regex m_anonymousResources;
        private string m_realm;

        #endregion

        #region [ Constructors ]

        /// <summary>
        /// Creates a new instance of the <see cref="AuthenticationOptions"/> class.
        /// </summary>
        public AuthenticationOptions() : base(SessionHandler.DefaultAuthenticationToken)
        {
            m_authFailureRedirectResourceCache = new ConcurrentDictionary<string, bool>(StringComparer.OrdinalIgnoreCase);
            m_anonymousResourceCache = new ConcurrentDictionary<string, bool>(StringComparer.OrdinalIgnoreCase);
            m_alternateSecurityProviderResourceCache = new ConcurrentDictionary<string, bool>(StringComparer.OrdinalIgnoreCase);
        }

        #endregion

        #region [ Properties ]

        /// <summary>
        /// Gets or sets the expression that will match paths for the resources on the web server
        /// that should redirect to the <see cref="LoginPage"/> when authentication fails.
        /// </summary>
        public string AuthFailureRedirectResourceExpression
        {
            get => m_authFailureRedirectResourceExpression;
            set
            {
                m_authFailureRedirectResourceExpression = value;
                m_authFailureRedirectResources = new Regex(m_authFailureRedirectResourceExpression, RegexOptions.Compiled | RegexOptions.IgnoreCase | RegexOptions.Singleline);
            }
        }

        /// <summary>
        /// Gets or sets the expression that will match paths for the resources on the web server
        /// that should user the Alternate SecurityProvider.
        /// </summary>
        public string AlternateSecurityProviderResourceExpression
        {
            get => m_alternateSecurityProviderResourceExpression;
            set
            {
                m_alternateSecurityProviderResourceExpression = value;
                m_alternateSecurityProviderResources = new Regex(m_alternateSecurityProviderResourceExpression, RegexOptions.Compiled | RegexOptions.IgnoreCase | RegexOptions.Singleline);
            }
        }

        /// <summary>
        /// Gets or sets the expression that will match paths for the resources on the web server
        /// that can be provided without checking credentials.
        /// </summary>
        public string AnonymousResourceExpression
        {
            get => m_anonymousResourceExpression;
            set
            {
                m_anonymousResourceExpression = value;
                m_anonymousResources = new Regex(m_anonymousResourceExpression, RegexOptions.Compiled | RegexOptions.IgnoreCase | RegexOptions.Singleline);
            }
        }

        /// <summary>
        /// Gets or sets the token used for identifying the authentication token in cookie headers.
        /// </summary>
        public string AuthenticationToken { get; set; } = SessionHandler.DefaultAuthenticationToken;

        /// <summary>
        /// Gets or sets the token used for identifying the session ID in cookie headers.
        /// </summary>
        public string SessionToken { get; set; } = SessionHandler.DefaultSessionToken;

        /// <summary>
        /// Gets or sets the token used for anti-forgery verification in HTTP request headers.
        /// </summary>
        public string RequestVerificationToken { get; set; } = DefaultRequestVerificationToken;

        /// <summary>
        /// Gets or sets token to specify when using AJAX for request verification tokens.
        /// </summary>
        public string AjaxRequestVerificationToken => RequestVerificationToken + AjaxTokenSuffix;

        /// <summary>
        /// Gets or sets the login page used as a redirect location when authentication fails.
        /// </summary>
        public string LoginPage { get; set; } = DefaultLoginPage;

        /// <summary>
        /// Gets or sets the path for the logout page.
        /// </summary>
        public string LogoutPage { get; set; } = DefaultLogoutPage;

        /// <summary>
        /// Gets or sets the page name used to test user authorization.
        /// </summary>
        public string AuthTestPage { get; set; } = DefaultAuthTestPage;

        /// <summary>
        /// Gets or sets the authentication schemes to use when testing authentication with the <see cref="AuthTestPage"/>.
        /// </summary>
        public AuthenticationSchemes AuthenticationSchemes { get; set; } = DefaultAuthenticationSchemes;

        /// <summary>
        /// Gets or sets the parameter name for the <see cref="AuthTestPage"/> that forces it to use Basic authentication
        /// so that any cached browser credentials can be cleared.
        /// </summary>
        public string ClearCredentialsParameter { get; set; } = DefaultClearCredentialsParameter;

        /// <summary>
        /// Gets or sets the case-sensitive identifier that defines the protection space for this authentication.
        /// </summary>
        /// <remarks>
        /// <para>
        /// The "realm" authentication parameter is reserved for use by authentication schemes that wish to
        /// indicate a scope of protection.
        /// </para>
        /// <para>
        /// A protection space is defined by the canonical root URI (the scheme and authority components of the
        /// effective request URI) of the server being accessed, in combination with the realm value if present.
        /// These realms allow the protected resources on a server to be partitioned into a set of protection
        /// spaces, each with its own authentication scheme and/or authorization database. The realm value is a
        /// string, generally assigned by the origin server, that can have additional semantics specific to the
        /// authentication scheme. Note that a response can have multiple challenges with the same auth-scheme
        /// but with different realms.
        /// </para>
        /// </remarks>
        public string Realm
        {
            get => m_realm;
            set
            {
                if (string.IsNullOrWhiteSpace(value))
                {
                    m_realm = null;
                    return;
                }

                // Verify that Realm does not contain a quote character unless properly
                // escaped, i.e., preceded by a backslash that is not itself escaped
                if (value.Length != Regex.Replace(value, @"\\\\""|(?<!\\)\""", "").Length)
                    throw new FormatException($"Realm value \"{value}\" contains an embedded quote that is not properly escaped.");

                m_realm = value;
            }
        }

        /// <summary>
        /// Gets or sets any custom header to be displayed on the <see cref="LoginPage"/>.
        /// </summary>
        public string LoginHeader { get; set; }

        /// <summary>
        /// Gets an immutable version of the authentication options.
        /// </summary>
        public ReadonlyAuthenticationOptions Readonly => new ReadonlyAuthenticationOptions(this);

        #endregion

        #region [ Methods ]

        /// <summary>
        /// Determines whether the given resource is an authentication failure redirect resource.
        /// </summary>
        /// <param name="urlPath">Path to check as an authentication failure redirect resource.</param>
        /// <returns><c>true</c> if path is an authentication failure redirect resource; otherwise, <c>false</c>.</returns>
        public bool IsAuthFailureRedirectResource(string urlPath)
        {
            if (m_authFailureRedirectResourceExpression is null)
                AuthFailureRedirectResourceExpression = DefaultAuthFailureRedirectResourceExpression;

            return m_authFailureRedirectResourceCache.GetOrAdd(urlPath, m_authFailureRedirectResources.IsMatch);
        }

        /// <summary>
        /// Determines whether the given resource is a alternate securtityProvider resource.
        /// </summary>
        /// <param name="urlPath">Path to check as an alternate securtityProvider resource.</param>
        /// <returns><c>true</c> if path is an alternate securtityProvider resource; otherwise, <c>false</c>.</returns>
        public bool IsAlternateSecurityProviderResource(string urlPath)
        {
            if (m_alternateSecurityProviderResources is null)
                AlternateSecurityProviderResourceExpression = DefaultAlternateSecurityProviderResourceExpression ;

            if (string.IsNullOrEmpty(m_alternateSecurityProviderResourceExpression))
                return m_alternateSecurityProviderResourceCache.GetOrAdd(urlPath, false);
            return m_alternateSecurityProviderResourceCache.GetOrAdd(urlPath, m_alternateSecurityProviderResources.IsMatch);
        }

        /// <summary>
        /// Determines whether the given resource is an anonymous resource.
        /// </summary>
        /// <param name="urlPath">Path to check as an anonymous resource.</param>
        /// <returns><c>true</c> if path is an anonymous resource; otherwise, <c>false</c>.</returns>
        public bool IsAnonymousResource(string urlPath)
        {
            if (m_anonymousResourceExpression is null)
                AnonymousResourceExpression = DefaultAnonymousResourceExpression;
                
            return m_anonymousResourceCache.GetOrAdd(urlPath, path =>
            {
                string resource = path;

                // If path is an embedded resource, convert it to a properly formatted type name identifier
                if (resource.StartsWith("/@"))
                    resource = resource.Substring(2).Replace('/', '.');
                else if (resource.StartsWith("@"))
                    resource = resource.Substring(1).Replace('/', '.');

                if (s_resourceRequiresAuthentication.TryGetValue(resource, out bool state))
                    return !state;

                // Always match against unmodified original path
                return m_anonymousResources.IsMatch(path);
            });
        }

        #endregion

        #region [ Static ]

        // Static Fields
        private static readonly ConcurrentDictionary<string, bool> s_resourceRequiresAuthentication;

        // Static Constructor
        static AuthenticationOptions()
        {
            s_resourceRequiresAuthentication = new ConcurrentDictionary<string, bool>(StringComparer.OrdinalIgnoreCase);
        }

        // Static Methods

        /// <summary>
        /// Sets the resource to the required authentication state.
        /// </summary>
        /// <param name="resource">Resource name.</param>
        /// <param name="required">Set to <c>true</c> to require authenticated access; otherwise, <c>false</c> to require anonymous access.</param>
        /// <remarks>
        /// This state overrides any authentication state that would otherwise be derived from <see cref="AnonymousResourceExpression"/>.
        /// </remarks>
        public static void ResourceRequiresAuthentication(string resource, bool required)
        {
            s_resourceRequiresAuthentication[resource] = required;
        }

        #endregion
    }

    /// <summary>
    /// Represents an immutable version of <see cref="AuthenticationOptions"/>.
    /// </summary>
    public sealed class ReadonlyAuthenticationOptions
    {
        #region [ Members ]

        // Fields
        private readonly AuthenticationOptions m_authenticationOptions;

        #endregion

        #region [ Constructors ]

        internal ReadonlyAuthenticationOptions(AuthenticationOptions authenticationOptions)
        {
            m_authenticationOptions = authenticationOptions;
        }

        #endregion

        #region [ Properties ]

        /// <summary>
        /// Gets the expression that will match paths for the resources on the web server
        /// that should redirect to the <see cref="LoginPage"/> when authentication fails.
        /// </summary>
        public string AuthFailureRedirectResourceExpression => m_authenticationOptions.AuthFailureRedirectResourceExpression;

        /// <summary>
        /// Gets the expression that will match paths for the resources on the web server
        /// that can be provided without checking credentials.
        /// </summary>
        public string AnonymousResourceExpression => m_authenticationOptions.AnonymousResourceExpression;


        /// <summary>
        /// Gets the expression that will match paths for the resources on the web server
        /// that should use the alternate SecurityProvider.
        /// </summary>
        public string AlternateSecurityProviderResourceExpression => m_authenticationOptions.AlternateSecurityProviderResourceExpression;

        /// <summary>
        /// Gets the token used for identifying the authentication token in cookie headers.
        /// </summary>
        public string AuthenticationToken => m_authenticationOptions.AuthenticationToken;

        /// <summary>
        /// Gets the token used for identifying the session ID in cookie headers.
        /// </summary>
        public string SessionToken => m_authenticationOptions.SessionToken;

        /// <summary>
        /// Gets the token used for anti-forgery verification in HTTP request headers.
        /// </summary>
        public string RequestVerificationToken => m_authenticationOptions.RequestVerificationToken;

        /// <summary>
        /// Gets token to specify when using AJAX for request verification tokens.
        /// </summary>
        public string AjaxRequestVerificationToken => m_authenticationOptions.AjaxRequestVerificationToken;

        /// <summary>
        /// Gets the login page used as a redirect location when authentication fails.
        /// </summary>
        public string LoginPage => m_authenticationOptions.LoginPage;

        /// <summary>
        /// Gets the path for the logout page.
        /// </summary>
        public string LogoutPage => m_authenticationOptions.LogoutPage;

        /// <summary>
        /// Gets the page name used to test user authorization.
        /// </summary>
        public string AuthTestPage => m_authenticationOptions.AuthTestPage;

        /// <summary>
        /// Gets the authentication schemes to use when testing authentication with the <see cref="AuthTestPage"/>.
        /// </summary>
        public AuthenticationSchemes AuthenticationSchemes => m_authenticationOptions.AuthenticationSchemes;

        /// <summary>
        /// Gets the parameter name for the <see cref="AuthTestPage"/> that forces it to use Basic authentication
        /// so that any cached browser credentials can be cleared.
        /// </summary>
        public string ClearCredentialsParameter => m_authenticationOptions.ClearCredentialsParameter;

        /// <summary>
        /// Gets the case-sensitive identifier that defines the protection space for this authentication.
        /// </summary>
        public string Realm => m_authenticationOptions.Realm;

        /// <summary>
        /// Gets any custom header to be displayed on the <see cref="LoginPage"/>.
        /// </summary>
        public string LoginHeader => m_authenticationOptions.LoginHeader;

        #endregion

        #region [ Methods ]

        /// <summary>
        /// Determines whether the given resource is an authentication failure redirect resource.
        /// </summary>
        /// <param name="urlPath">Path to check as an authentication failure redirect resource.</param>
        /// <returns><c>true</c> if path is an authentication failure redirect resource; otherwise, <c>false</c>.</returns>
        public bool IsAuthFailureRedirectResource(string urlPath) =>
            m_authenticationOptions.IsAuthFailureRedirectResource(urlPath);

        /// <summary>
        /// Determines whether the given resource is an anonymous resource.
        /// </summary>
        /// <param name="urlPath">Path to check as an anonymous resource.</param>
        /// <returns><c>true</c> if path is an anonymous resource; otherwise, <c>false</c>.</returns>
        public bool IsAnonymousResource(string urlPath) =>
            m_authenticationOptions.IsAnonymousResource(urlPath);

        /// <summary>
        /// Determines whether the given resource is using the alternate SecuityProvider.
        /// </summary>
        /// <param name="urlPath">Path to check as an alternative SecurityProvider resource.</param>
        /// <returns><c>true</c> if path is an alternate Security Provider resource; otherwise, <c>false</c>.</returns>
        public bool IsAlternateSecurityProviderResource(string urlPath) =>
            m_authenticationOptions.IsAlternateSecurityProviderResource(urlPath);

        #endregion
    }
}