/*
 * InspIRCd -- Internet Relay Chat Daemon
 *
 *   Copyright (C) 2026 Sadie Powell <sadie@witchery.services>
 *
 * This file is part of InspIRCd.  InspIRCd is free software: you can
 * redistribute it and/or modify it under the terms of the GNU General Public
 * License as published by the Free Software Foundation, version 2.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
 * details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */


#pragma once

#include "iohook.h"

namespace TLS
{
	class API;
	class APIBase;
	class Certificate;
	class IOHook;

	/** A shared pointer to a TLS certificate. */
	using CertificatePtr = std::shared_ptr<Certificate>;

	/** A list of TLS certificate fingerprints. */
	using FingerprintList = std::vector<std::string>;

	/** If a socket contains a TLS hook then returns the hook; otherwise, returns nullptr. */
	inline IOHook* GetHook(StreamSocket* sock);
}

/** Encapsulates information about a TLS certificate. */
class TLS::Certificate
	: public std::enable_shared_from_this<TLS::Certificate>
{
protected:
	Certificate() = default;

	/** A list of zero or more TLS certificate fingerprints. */
	TLS::FingerprintList fingerprints;

	/** The Distinguished Name of the TLS certificate. */
	std::string dn;

	/** If non-empty then the error which occurred whilst creating this \ref TLS::Certificate. */
	std::string error;

	/** The Distinguished Name of the TLS certificate's issuer. */
	std::string issuer_dn;

	/** The time at which the TLS certificate was activated. */
	time_t activation = 0;

	/** The time at which the TLS certificate will expire. */
	time_t expiration = 0;

	/** Whether the signer of the TLS certificate is known. */
	bool known_signer:1 = false;

	/* Whether the TLS certificate has been revoked. */
	bool revoked:1 = false;

	/** Whether the TLS certificate is trusted by the system certificate store. */
	bool trusted:1 = false;

	/** Whether the TLS certificate is valid. */
	bool valid:1 = false;

public:
	/** Retrieves the time at which the TLS certificate was activated, or 0 if the peer did not
	 * provide a TLS certificate.
	 */
	inline auto GetActivationTime() const { return this->activation; }

	/** Retrieves the Distinguished Name of the TLS certificate. */
	inline const auto& GetDN() const { return this->dn; }

	/** If an error occurred whilst creating this \ref TLS::Certificate then the error; otherwise,
	 * an empty string. Call \ref HasError instead if you just want to check if an error occurred.
	 */
	inline const auto& GetError() const { return this->error; }

	/** Retrieves the time at which the TLS certificate will expire, or 0 if the peer did not
	 * provide a TLS certificate.
	 */
	inline auto GetExpirationTime() const { return this->expiration; }

	/** Retrieves all available fingerprints. */
	inline const auto& GetFingerprints() const { return this->fingerprints; }

	/** Retrieves the primary fingerprint. */
	inline auto GetFingerprint() const
	{
		return GetFingerprints().empty() ? "" : GetFingerprints().front();
	}

	/** Retrieves the Distinguished Name of the TLS certificate's issuer. */
	inline const auto& GetIssuerDN() const { return this->issuer_dn; }

	/** Whether an error occurred whilst creating this \ref TLS::Certificate. */
	inline auto HasError() const { return !this->error.empty(); }

	/** Determines whether the signer of the TLS certificate is known. */
	inline auto IsKnownSigner() const { return this->known_signer; }

	/* Determines whether the TLS certificate has been revoked. */
	inline auto IsRevoked() const { return this->revoked; }

	/** Determines whether the TLS certificate is trusted by the system certificate store. */
	inline auto IsTrusted() const { return this->trusted; }

	/** Determines whether the TLS certificate is valid. */
	inline auto IsValid() const { return this->valid; }

	/** Determines whether this TLS certificate is usable.
	 * @param strict Whether to consider self-signed TLS certificates as invalid.
	 */
	inline auto IsUsable(bool strict = false) const
	{
		if (strict && (!IsTrusted() || !IsKnownSigner()))
			return false;

		return !HasError() && !IsRevoked() && IsValid();
	}
};

class TLS::APIBase
	: public Service::SimpleProvider
{
public:
	APIBase(const WeakModulePtr& mod)
		: Service::SimpleProvider(mod, "tlsapi")
	{
	}

	/** Retrieves the TLS certificate of a user.
	 * @param user The user to retrieve the TLS certificate of.
	 * @return The TLS certificate of the user or a null pointer if they are not using TLS.
	 */
	virtual Certificate* GetCertificate(User* user) const = 0;

	/** Retrieves the primary TLS fingerprint of a user.
	 * @param user The user to retrieve the primary TLS fingerprint of.
	 * @param strict Whether to consider self-signed TLS certificates as invalid.
	 * @return The primary TLS fingerprint of the user or an empty string if \p user did not provide
	 *         a TLS certificate.
	 */
	inline auto GetFingerprint(User* user, bool strict = false) const
	{
		const auto* cert = GetCertificate(user);
		if (cert && cert->IsUsable(strict)) [[likely]]
			return cert->GetFingerprint();
		return std::string();
	}

	/** Retrieves all available TLS fingerprint of a user.
	 * @param user The user to retrieve all available TLS fingerprints of.
	 * @param strict Whether to consider self-signed TLS certificates as invalid.
	 * @return A list of TLS fingerprints or an empty list if \p user did not provide a TLS
	 *         certificate.
	 */
	inline auto GetFingerprints(User* user, bool strict = false) const
	{
		const auto* cert = GetCertificate(user);
		if (cert && cert->IsUsable(strict)) [[likely]]
			return cert->GetFingerprints();
		return TLS::FingerprintList();
	}

	/** Determines whether the specified user is connected securely. A secure connection is defined
	 * as using TLS or connecting locally to the server.
	 * @return True if the user is connected securely; otherwise, false.
	 */
	virtual bool IsSecure(User* user) const = 0;

	/** Sets the TLS certificate of a user.
	 * @param user The user whose TLS certificate to set.
	 * @param cert The TLS certificate to set for the user.
	 */
	virtual void SetCertificate(User* user, const TLS::CertificatePtr& cert) const = 0;
};

class TLS::API final
	: public dynamic_reference<TLS::APIBase>
{
public:
	API(const WeakModulePtr& mod)
		: dynamic_reference<TLS::APIBase>(mod, "tlsapi")
	{
	}
};

class TLS::IOHook
	: public ::IOHook
{
protected:
	/** An enumeration of possible TLS socket states. */
	enum Status
		: uint8_t
	{
		/** The TLS socket has just been opened or has been closed. */
		STATUS_NONE,

		/** The TLS socket is currently handshaking. */
		STATUS_HANDSHAKING,

		/** The TLS handshake has completed and data can be sent. */
		STATUS_OPEN
	};

	/** The TLS certificate of the peer. */
	TLS::CertificatePtr certificate;

	/** The status of the TLS connection. */
	Status status = STATUS_NONE;

public:
	IOHook(const std::shared_ptr<IOHookProvider>& hookprov)
		: ::IOHook(hookprov)
	{
	}

	/** Retrieves the TLS certificate of the peer. */
	const auto& GetCertificate() const
	{
		return this->certificate;
	}

	/** Retrieves the ciphersuite that was negotiated with the peer.
	 * @param out The location that the ciphersuite will be stored.
	 * @return True if the ciphersuite was retrieved; otherwise, false.
	 */
	virtual bool GetCiphersuite(std::string& out) const = 0;

	/** Retrieves the hostname that was sent by the peer using SNI.
	 * @param out The location that the server name will be stored.
	 * @return True if the server name was retrieved; otherwise, false.
	 */
	virtual bool GetServerName(std::string& out) const = 0;

	/** @copydoc IOHook::IsHookReady */
	bool IsHookReady() const override { return this->status == STATUS_OPEN; }
};

TLS::IOHook* TLS::GetHook(StreamSocket* sock)
{
	if (!sock)
		return nullptr; // No socket.

	auto* const lasthook = sock->GetLastHook();
	if (!lasthook || !lasthook->prov->service_name.starts_with("ssl/"))
		return nullptr; // Not our hook.

	return static_cast<TLS::IOHook*>(lasthook);
}