defmodule Paseto.V1 do
  @moduledoc """
  The Version1 implementation of the Paseto protocol.

  More information about the implementation can be found here:
  1.) https://github.com/paragonie/paseto/blob/master/docs/01-Protocol-Versions/Version1.md
  """

  @behaviour Paseto.VersionBehaviour

  alias Paseto.Token
  alias Paseto.Utils
  alias Paseto.Utils.Crypto, as: PasetoCrypto

  import Paseto.Utils, only: [b64_decode: 1, b64_decode!: 1]

  @required_keys [:version, :purpose, :payload]
  @all_keys @required_keys ++ [:footer]

  @enforce_keys @all_keys
  defstruct @all_keys

  @header_public "v1.public."
  @header_local "v1.local."

  @hash_algo :sha384

  @nonce_size 32
  @mac_size 48
  @signature_size 256

  @doc """
  Takes a token and will decrypt/verify the signature and return the token in a more digestable manner
  """
  @spec from_token(Token.t()) :: %__MODULE__{}
  def from_token(token) do
    %__MODULE__{
      version: token.version,
      purpose: token.purpose,
      payload: token.payload,
      footer: token.footer
    }
  end

  @doc """
  Handles encrypting the payload and returning a valid token

  # Examples:
      iex> Paseto.V1.encrypt("This is a test message", "Test Key")
      "v1.local.3qbJND5q6IbF7cZxxWjmSTaVyMo2M3LaEDJ8StdFXw8PTUo55YIyy2BhIaAN6m-IdbGmdwM_ud1IpOyrz3CysNIkjBjab7NLRPbksV-XIsWYRFX6r7z2jsIfH-8emAv_BVtXi9lY"
  """
  @spec encrypt(String.t(), binary, String.t(), binary | nil) ::
          String.t() | {:error, String.t()}
  def encrypt(data, secret_key, footer \\ "", n \\ nil) do
    aead_encrypt(data, secret_key, footer, n || :crypto.strong_rand_bytes(@nonce_size))
  end

  @doc """
  Handles decrypting a token given the correct key

  # Examples:
      iex> token = Paseto.V1.encrypt("This is a test message", "Test Key")
      iex> token
      "v1.local.3qbJND5q6IbF7cZxxWjmSTaVyMo2M3LaEDJ8StdFXw8PTUo55YIyy2BhIaAN6m-IdbGmdwM_ud1IpOyrz3CysNIkjBjab7NLRPbksV-XIsWYRFX6r7z2jsIfH-8emAv_BVtXi9lY"
      iex> Paseto.V1.decrypt(token, "Test Key")
      "{:ok, "This is a test message"}"
  """
  @spec decrypt(String.t(), binary, String.t() | nil) ::
          {:ok, String.t()} | {:error, String.t()}
  def decrypt(data, secret_key, footer \\ "") do
    aead_decrypt(data, @header_local, secret_key, footer)
  end

  @doc """
  Handles signing the token for public use.

  # Examples:
      iex> {public_key, secret_key} = :crypto.generate_key(:rsa, {2048, 65_537})
      iex> Paseto.V1.sign("This is a test message!", secret_key)
      "v1.public.VGhpcyBpcyBhIHRlc3QgbWVzc2FnZSGswqHiZVv31r99PZphr2hqJQe81Qc_7XkxHyVb_7-xORKp-VFJdEiqfINgLnwxo8n1pkIDH4_9UfhpEyS1ivgxfYe-55INfV-OyzSpHMbuGA0xviIln0fdn98QljGwh3uDFduXnfaWeBYA6nE0JingWEvVG-V8L12IdFh1rq9ZWLleFVsn719Iz8BqsasmFAICLRpnToL7X1syHdZ6PjhBnStCM5GHHzCwbdvj64P5QqxvtUzTfXBBeC-IKu_HVxIxY9VaN3d3KQotBZ1J6W1oJ4cX0JvUR4pIaq3eKfOKdoR5fUkyjS0mP9GjjoJcW8oiKKqb3dAaCHZW9he2iZNn"
  """
  @spec sign(String.t(), binary, String.t()) :: String.t() | {:error, String.t()}
  def sign(data, secret_key, footer \\ "") do
    m2 = Utils.pre_auth_encode([@header_public, data, footer])

    signature =
      :crypto.sign(:rsa, @hash_algo, m2, secret_key, [
        {:rsa_padding, :rsa_pkcs1_pss_padding},
        {:rsa_mgf1_md, @hash_algo}
      ])

    Utils.b64_encode_token(@header_public, data <> signature, footer)
  rescue
    _ -> {:error, "Signing failure."}
  end

  @doc """
  Handles verifying the signature belongs to the provided key.

  # Examples:
      iex> {public_key, secret_key} = :crypto.generate_key(:rsa, {2048, 65_537})
      iex> token = Paseto.V1.sign("This is a test message!", secret_key)
      "v1.public.VGhpcyBpcyBhIHRlc3QgbWVzc2FnZSGswqHiZVv31r99PZphr2hqJQe81Qc_7XkxHyVb_7-xORKp-VFJdEiqfINgLnwxo8n1pkIDH4_9UfhpEyS1ivgxfYe-55INfV-OyzSpHMbuGA0xviIln0fdn98QljGwh3uDFduXnfaWeBYA6nE0JingWEvVG-V8L12IdFh1rq9ZWLleFVsn719Iz8BqsasmFAICLRpnToL7X1syHdZ6PjhBnStCM5GHHzCwbdvj64P5QqxvtUzTfXBBeC-IKu_HVxIxY9VaN3d3KQotBZ1J6W1oJ4cX0JvUR4pIaq3eKfOKdoR5fUkyjS0mP9GjjoJcW8oiKKqb3dAaCHZW9he2iZNn"
      iex> [version, purpose, payload] = String.split(token, ".")
      iex> V1.verify(version <> "." <> purpose <> ".", payload, public_key)
      "{:ok, "This is a test message!"}"
  """
  @spec verify(
          String.t(),
          [binary()],
          String.t() | nil
        ) :: {:ok, binary} | {:error, binary()}
  def verify(signed_message, [_exp, mod] = public_key, footer \\ "")
      when byte_size(mod) == 256 do
    with {:ok, decoded} <- valid_b64?(:decode, signed_message),
         {:ok, decoded_footer} <- b64_decode(footer) do
      message_size = byte_size(decoded) - @signature_size

      <<
        message::binary-size(message_size),
        signature::binary-size(@signature_size)
      >> = decoded

      m2 = Utils.pre_auth_encode([@header_public, message, decoded_footer])

      case :crypto.verify(
             :rsa,
             @hash_algo,
             m2,
             signature,
             public_key,
             [
               {:rsa_padding, :rsa_pkcs1_pss_padding},
               {:rsa_mgf1_md, @hash_algo}
             ]
           ) do
        true -> {:ok, message}
        false -> {:error, "Failed to verify signature."}
      end
    else
      :error -> {:error, "Failed to decode token during verification."}
      err -> {:error, "Token verification failed due to #{inspect(err)}"}
    end
  end

  @spec get_claims_from_signed_message(signed_message :: String.t()) :: String.t()
  defp get_claims_from_signed_message(signed_message) do
    case valid_b64?(:decode, signed_message) do
      {:ok, decoded} ->
        message_size = byte_size(decoded) - @signature_size

        <<
          message::binary-size(message_size),
          _signature::binary-size(@signature_size)
        >> = decoded

        message

      {:error, _reason} = err ->
        err
    end
  end

  @doc """
  Allows looking at the claims without having verified them.
  """
  @spec peek(token :: String.t()) :: String.t()
  def peek(token) do
    {:ok, %Paseto.Token{payload: payload}} = Utils.parse_token(token)

    get_claims_from_signed_message(payload)
  end

  ##############################
  # Internal Private Functions #
  ##############################

  @spec aead_encrypt(String.t(), String.t(), String.t() | nil, binary) :: String.t()
  defp aead_encrypt(plaintext, key, footer, n) do
    nonce = get_nonce(plaintext, n)
    <<leftmost::binary-16, rightmost::binary-16>> = nonce
    ek = HKDF.derive(@hash_algo, key, 32, leftmost, "paseto-encryption-key")
    ak = HKDF.derive(@hash_algo, key, 32, leftmost, "paseto-auth-key-for-aead")

    ciphertext = PasetoCrypto.aes_256_ctr_encrypt(ek, plaintext, rightmost)

    pre_auth_hash =
      [@header_local, nonce, ciphertext, footer]
      |> Utils.pre_auth_encode()
      |> (&PasetoCrypto.hmac_sha384(ak, &1)).()

    Utils.b64_encode_token(@header_local, nonce <> ciphertext <> pre_auth_hash, footer)
  end

  @spec aead_decrypt(String.t(), String.t(), String.t(), String.t() | nil) ::
          {:ok, String.t()} | {:error, String.t()}
  defp aead_decrypt(message, header, key, footer) do
    expected_len = String.length(header)
    given_header = String.slice(message, 0..(expected_len - 1))

    decoded =
      case b64_decode(message) do
        {:ok, decoded_value} ->
          decoded_value

        :error ->
          {:error, "Failed to decode header #{given_header} during decryption"}
      end

    length = byte_size(decoded)
    ciphertext_len = length - @nonce_size - @mac_size
    footer = b64_decode!(footer)

    <<
      nonce::binary-size(@nonce_size),
      ciphertext::binary-size(ciphertext_len),
      mac::binary-48
    >> = decoded

    <<leftmost::binary-16, rightmost::binary-16>> = nonce

    ek = HKDF.derive(@hash_algo, key, 32, leftmost, "paseto-encryption-key")
    ak = HKDF.derive(@hash_algo, key, 32, leftmost, "paseto-auth-key-for-aead")

    calc =
      [header, nonce, ciphertext, footer]
      |> Utils.pre_auth_encode()
      |> (&PasetoCrypto.hmac_sha384(ak, &1)).()

    if calc == mac do
      {:ok, PasetoCrypto.aes_256_ctr_decrypt(ek, ciphertext, rightmost)}
    else
      {:error, "Calculated hmac didn't match hmac from token."}
    end
  end

  @spec get_nonce(String.t(), String.t()) :: binary
  defp get_nonce(m, n) do
    PasetoCrypto.hmac_sha384(n, m, 32)
  end

  @spec valid_b64?(atom(), binary) :: {:ok, binary} | {:error, String.t()}
  defp valid_b64?(:decode, input) do
    case b64_decode(input) do
      {:ok, _decoded} = retval -> retval
      _ -> {:error, "Invalid payload. Payload was not b64 encoded."}
    end
  end
end
