/*
 * Copyright 2025 Hirokazu Kobayashi
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.idp.server.core.openid.authentication;

import java.time.LocalDateTime;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import org.idp.server.core.openid.authentication.acr.AcrResolver;
import org.idp.server.core.openid.authentication.evaluator.MfaConditionEvaluator;
import org.idp.server.core.openid.authentication.loa.LoaDeniedScopeResolver;
import org.idp.server.core.openid.authentication.policy.AuthenticationPolicy;
import org.idp.server.core.openid.authentication.policy.AuthenticationResultConditionConfig;
import org.idp.server.core.openid.authentication.policy.AuthenticationStepDefinition;
import org.idp.server.core.openid.federation.FederationInteractionResult;
import org.idp.server.core.openid.identity.User;
import org.idp.server.core.openid.identity.device.AuthenticationDevice;
import org.idp.server.core.openid.oauth.type.AuthFlow;
import org.idp.server.platform.date.SystemDateTime;
import org.idp.server.platform.exception.BadRequestException;

public class AuthenticationTransaction {
  AuthenticationTransactionIdentifier identifier;
  AuthorizationIdentifier authorizationIdentifier;
  AuthenticationRequest request;
  AuthenticationPolicy authenticationPolicy;
  AuthenticationInteractionResults interactionResults;
  AuthenticationTransactionAttributes attributes;

  public AuthenticationTransaction() {}

  public AuthenticationTransaction(
      AuthenticationTransactionIdentifier identifier,
      AuthorizationIdentifier authorizationIdentifier,
      AuthenticationRequest request,
      AuthenticationPolicy authenticationPolicy,
      AuthenticationTransactionAttributes attributes) {
    this(
        identifier,
        authorizationIdentifier,
        request,
        authenticationPolicy,
        new AuthenticationInteractionResults(),
        attributes);
  }

  public AuthenticationTransaction(
      AuthenticationTransactionIdentifier identifier,
      AuthorizationIdentifier authorizationIdentifier,
      AuthenticationRequest request,
      AuthenticationPolicy authenticationPolicy,
      AuthenticationInteractionResults interactionResults,
      AuthenticationTransactionAttributes attributes) {
    this.identifier = identifier;
    this.authorizationIdentifier = authorizationIdentifier;
    this.request = request;
    this.authenticationPolicy = authenticationPolicy;
    this.interactionResults = interactionResults;
    this.attributes = attributes;
  }

  public AuthenticationTransaction updateWith(
      AuthenticationInteractionRequestResult interactionRequestResult) {
    Map<String, AuthenticationInteractionResult> resultMap = interactionResults.toMap();

    AuthenticationRequest updatedRequest = updateWithUser(interactionRequestResult);

    if (interactionResults.contains(interactionRequestResult.interactionTypeName())) {

      AuthenticationInteractionResult foundResult =
          interactionResults.get(interactionRequestResult.interactionTypeName());
      AuthenticationInteractionResult updatedInteraction =
          foundResult.updateWith(interactionRequestResult);
      resultMap.remove(interactionRequestResult.interactionTypeName());
      resultMap.put(interactionRequestResult.interactionTypeName(), updatedInteraction);

    } else {

      // #1771: a named interaction gets its own entry under the type from the very first call, so
      // the breakdown is not missing for whichever interaction happened to run first.
      String operationType = interactionRequestResult.operationType().name();
      String method = interactionRequestResult.method();
      int successCount = interactionRequestResult.isSuccess() ? 1 : 0;
      int failureCount = interactionRequestResult.isSuccess() ? 0 : 1;
      LocalDateTime interactionTime = SystemDateTime.now();
      Map<String, AuthenticationInteractionResult> interactions = new HashMap<>();
      if (interactionRequestResult.hasInteractionName()) {
        interactions.put(
            interactionRequestResult.interactionName(),
            AuthenticationInteractionResult.initialResultFor(interactionRequestResult));
      }
      AuthenticationInteractionResult result =
          new AuthenticationInteractionResult(
              operationType, method, 1, successCount, failureCount, interactionTime, interactions);
      resultMap.put(interactionRequestResult.interactionTypeName(), result);
    }

    AuthenticationInteractionResults updatedResults =
        new AuthenticationInteractionResults(resultMap);
    return new AuthenticationTransaction(
        identifier,
        authorizationIdentifier,
        updatedRequest,
        authenticationPolicy,
        updatedResults,
        attributes);
  }

  /**
   * Updates the authentication request with user information from the interaction result.
   *
   * <p><b>Issue #1021:</b> User is only added to the transaction when:
   *
   * <ul>
   *   <li>The result contains a user
   *   <li>The interaction was successful
   *   <li>The operation type is not CHALLENGE (challenge phase = user not yet verified)
   * </ul>
   *
   * <p>This prevents transaction pollution on failure (PR #973) and ensures that users are only
   * committed to the transaction after successful authentication, not during the challenge phase.
   *
   * @param interactionRequestResult the authentication interaction result
   * @return the updated authentication request
   */
  private AuthenticationRequest updateWithUser(
      AuthenticationInteractionRequestResult interactionRequestResult) {

    // No user in result - keep request unchanged
    if (!interactionRequestResult.hasUser()) {
      return request;
    }

    // Issue #1021: Don't add user on failure (prevents transaction pollution - PR #973)
    if (!interactionRequestResult.isSuccess()) {
      return request;
    }

    // Issue #1021: Challenge phase = user not yet verified, don't add to transaction
    if (interactionRequestResult.operationType().isChallenge()) {
      return request;
    }

    // Authentication success - add user to transaction
    if (!request.hasUser()) {
      return request.updateWithUser(interactionRequestResult);
    }

    if (!request.isSameUser(interactionRequestResult.user())) {
      throw new BadRequestException("User is not the same as the request");
    }

    // Same user: update with latest user data (e.g., 2nd factor user_resolve adds
    // custom_properties)
    return request.updateWithUser(interactionRequestResult);
  }

  /**
   * Merges the federated user into the transaction with the same identifier-switching guard as the
   * standard interaction path.
   *
   * <p>A federation step that runs after a user is already established (e.g. CIBA {@code
   * login_hint} pre-resolves the user, or federation is configured as a later factor) MUST bind to
   * that established user, never silently replace it. Without this gate, a flow that establishes
   * user A and then runs a federation step returning user B would rebind the whole transaction to B
   * — the federation counterpart of the 2nd-factor user binding.
   *
   * @param result the federation interaction result
   * @return the updated authentication request
   */
  private AuthenticationRequest updateWithUser(FederationInteractionResult result) {
    // No user in result - keep request unchanged (also covers federation error / notFound)
    if (!result.hasUser()) {
      return request;
    }

    // Don't bind user on failure (prevents transaction pollution, mirrors the standard path)
    if (!result.isSuccess()) {
      return request;
    }

    // First authenticated user in the transaction - establish it
    if (!request.hasUser()) {
      return request.updateWithUser(result);
    }

    // Established user must match the federated identity (same sub)
    if (!request.isSameUser(result.user())) {
      throw new BadRequestException("User is not the same as the request");
    }

    // Same user: refresh with the latest federated user data
    return request.updateWithUser(result);
  }

  public AuthenticationTransaction updateWith(FederationInteractionResult result) {
    Map<String, AuthenticationInteractionResult> resultMap = interactionResults.toMap();
    AuthenticationRequest updatedRequest = updateWithUser(result);

    if (interactionResults.contains(result.interactionTypeName())) {

      AuthenticationInteractionResult foundResult =
          interactionResults.get(result.interactionTypeName());
      AuthenticationInteractionResult updatedInteraction = foundResult.updateWith(result);
      resultMap.remove(result.interactionTypeName());
      resultMap.put(result.interactionTypeName(), updatedInteraction);

    } else {

      String operationType = OperationType.AUTHENTICATION.name();
      String method = result.ssoProvider().name();
      int successCount = result.isSuccess() ? 1 : 0;
      int failureCount = result.isSuccess() ? 0 : 1;
      LocalDateTime interactionTime = SystemDateTime.now();
      AuthenticationInteractionResult authenticationInteractionResult =
          new AuthenticationInteractionResult(
              operationType, method, 1, successCount, failureCount, interactionTime);
      resultMap.put(result.interactionTypeName(), authenticationInteractionResult);
    }

    AuthenticationInteractionResults updatedResults =
        new AuthenticationInteractionResults(resultMap);
    return new AuthenticationTransaction(
        identifier,
        authorizationIdentifier,
        updatedRequest,
        authenticationPolicy,
        updatedResults,
        attributes);
  }

  public AuthenticationTransactionIdentifier identifier() {
    return identifier;
  }

  public AuthorizationIdentifier authorizationIdentifier() {
    return authorizationIdentifier;
  }

  public AuthFlow flow() {
    return request.authFlow();
  }

  public AuthenticationRequest request() {
    return request;
  }

  public AuthenticationDevice authenticationDevice() {
    return request.authenticationDevice();
  }

  public User user() {
    if (request.hasUser()) {
      return request.user();
    }
    return User.notFound();
  }

  public AuthenticationInteractionResults interactionResults() {
    return interactionResults;
  }

  public Map<String, Object> interactionResultsAsMapObject() {
    return interactionResults.toMapAsObject();
  }

  public Map<String, Object> toRequestMap() {
    return toRequestMap(true);
  }

  /**
   * Converts this transaction to a map for public API response.
   *
   * @param isDeviceAuthenticated true if device authentication was successfully performed
   * @return map representation for public API response
   */
  public Map<String, Object> toRequestMap(boolean isDeviceAuthenticated) {
    Map<String, Object> map = new HashMap<>();
    map.put("id", identifier.value());
    map.putAll(request.toMapForPublic(isDeviceAuthenticated));
    // #1505: once a challenge has issued a code, tell the device to prompt for it (the value itself
    // is never exposed to the device — that is what breaks push fatigue). See
    // isNumberMatchingRequired() for why this stays true even after the code is verified.
    map.put("number_matching_required", isNumberMatchingRequired());
    return map;
  }

  /**
   * Whether to tell the device to prompt for the number-matching code. Keyed on a successful
   * challenge (the code has been issued to the sign-in screen), NOT on whether the verify step
   * succeeded: clearing it on verify success would let an attacker who started the flow satisfy the
   * verify himself and thereby signal the victim's device that the prompt is no longer needed,
   * reopening the blind-approval (push fatigue) path this is meant to close. It therefore stays
   * true for the rest of the flow; whether the code was actually verified is tracked separately in
   * the interaction results. (#1505)
   */
  private boolean isNumberMatchingRequired() {
    if (interactionResults == null) {
      return false;
    }
    String challengeType =
        StandardAuthenticationInteraction.AUTHENTICATION_DEVICE_NUMBER_MATCHING_CHALLENGE
            .toType()
            .name();
    return interactionResults.containsSuccessful(challengeType);
  }

  public boolean hasAuthenticationPolicy() {
    return authenticationPolicy != null && authenticationPolicy.exists();
  }

  public AuthenticationPolicy authenticationPolicy() {
    return authenticationPolicy;
  }

  public boolean isSuccess() {
    if (isLocked() || isFailure()) {
      return false;
    }
    if (hasAuthenticationPolicy()) {
      AuthenticationResultConditionConfig authenticationResultConditionConfig =
          authenticationPolicy.successConditions();
      return MfaConditionEvaluator.isSuccessSatisfied(
          authenticationResultConditionConfig, interactionResults, user());
    }
    return interactionResults.containsAnySuccess();
  }

  public boolean isFailure() {
    if (hasAuthenticationPolicy()) {
      AuthenticationResultConditionConfig authenticationResultConditionConfig =
          authenticationPolicy.failureConditions();
      return MfaConditionEvaluator.isFailureSatisfied(
          authenticationResultConditionConfig, interactionResults, user());
    }
    return interactionResults.containsDenyInteraction();
  }

  public boolean isLocked() {
    if (hasAuthenticationPolicy()) {
      AuthenticationResultConditionConfig authenticationResultConditionConfig =
          authenticationPolicy.lockConditions();
      return MfaConditionEvaluator.isLockedSatisfied(
          authenticationResultConditionConfig, interactionResults, user());
    }
    return false;
  }

  public boolean isComplete() {
    return isSuccess() || isFailure() || isLocked();
  }

  public String authenticationStatus() {
    if (isLocked()) return "locked";
    if (isFailure()) return "failure";
    if (isSuccess()) return "success";
    return "in_progress";
  }

  public boolean exists() {
    return identifier != null && identifier.exists();
  }

  public boolean hasInteractions() {
    return interactionResults != null && interactionResults.exists();
  }

  public boolean hasUser() {
    return request.hasUser();
  }

  public boolean hasAuthenticationDevice() {
    return request.hasAuthenticationDevice();
  }

  public AuthenticationContext requestContext() {
    return request.context();
  }

  public AuthenticationTransactionAttributes attributes() {
    return attributes;
  }

  public boolean hasAttributes() {
    return attributes != null && attributes.exists();
  }

  public Authentication authentication() {
    if (!isSuccess()) {
      return new Authentication();
    }

    LocalDateTime time = interactionResults.authenticationTime();
    List<String> methods = interactionResults.authenticationMethods();
    String acr = AcrResolver.resolve(authenticationPolicy.acrMappingRules(), methods);
    return new Authentication().setTime(time).addMethods(methods).addAcr(acr);
  }

  public List<String> deniedScopes() {
    Map<String, List<String>> levelOfAuthenticationScopes =
        authenticationPolicy.levelOfAuthenticationScopes();
    List<String> methods = interactionResults.authenticationMethods();
    return LoaDeniedScopeResolver.resolve(levelOfAuthenticationScopes, methods);
  }

  public boolean hasAuthorizationIdentifier() {
    return authorizationIdentifier != null && authorizationIdentifier.exists();
  }

  public AuthenticationStepDefinition getCurrentStepDefinition(String method) {
    return getCurrentStepDefinition(method, null);
  }

  /**
   * Resolves the step definition for a method, optionally narrowed to one of its interactions.
   *
   * <p>A definition naming the interaction wins; otherwise one keyed on the method alone applies.
   * That ordering is what makes the method-level definition a default and the interaction-level one
   * an override, so a configuration can say "these steps need an authenticated user, except this
   * one that identifies them". Falling back also keeps every existing configuration — none of which
   * names an interaction — resolving exactly as before. (#1813)
   *
   * @param method the interactor's {@code method()}
   * @param interaction the interaction that ran, or null when the method has only one
   * @return the definition to apply, or null when the policy defines none for this method
   */
  public AuthenticationStepDefinition getCurrentStepDefinition(String method, String interaction) {

    if (!hasAuthenticationPolicy()) {
      return null;
    }

    if (!authenticationPolicy.hasStepDefinitions()) {
      return null;
    }

    AuthenticationStepDefinition methodLevel = null;
    for (AuthenticationStepDefinition step : authenticationPolicy.stepDefinitions()) {
      if (!method.equals(step.authenticationMethod())) {
        continue;
      }
      if (!step.hasInteraction()) {
        if (methodLevel == null) {
          methodLevel = step;
        }
        continue;
      }
      if (step.interaction().equals(interaction)) {
        return step;
      }
    }
    return methodLevel;
  }

  /**
   * Gets the authentication session ID bound to this transaction.
   *
   * @return AuthSessionId for browser session binding, or empty AuthSessionId if not bound
   */
  public AuthSessionId authSessionId() {
    if (hasAttributes()) {
      return attributes.authSessionId();
    }
    return new AuthSessionId();
  }

  /**
   * Checks if this transaction has an authentication session binding.
   *
   * @return true if authSessionId is present
   */
  public boolean hasAuthSessionId() {
    return hasAttributes() && attributes.hasAuthSessionId();
  }
}