package main

import(
	"github.com/go-errors/errors"

	. "github.com/ory-am/fosite"
	"github.com/ory-am/fosite/enigma"
	"github.com/ory-am/fosite/handler/core/explicit"
	"github.com/ory-am/fosite/handler/core/implicit"
	"github.com/ory-am/fosite/handler/core/owner"
	"github.com/ory-am/fosite/handler/core/refresh"
	"github.com/ory-am/fosite/handler/core/strategy"
	"github.com/ory-am/fosite/handler/core/client"
	"log"
	"net/http"
	"time"
)

var hmacStrategy = &strategy.HMACSHAStrategy{
	Enigma: &enigma.HMACSHAEnigma{
		GlobalSecret: []byte("some-super-cool-secret-that-nobody-knows"),
	},
}

var oauth2 = fositeFactory()

func main() {
    // Note that you MUST use http over TLS if you use OAuth2. Do not use OAuth2 otherwise.
    // This example does not implement TLS for simplicity.
	http.HandleFunc("/auth", authEndpoint)
	http.HandleFunc("/token", tokenEndpoint)
	log.Fatal(http.ListenAndServe(":3846", nil))
}

func fositeFactory() OAuth2Provider {
    // NewMyStorageImplementation should implement all storage interfaces.
    // You can find an exemplary implementation in ./fosite-example/internal/store.go
    var store = newMyStorageImplementation()

	f := NewFosite(store)
	accessTokenLifespan := time.Hour

	// Let's enable the explicit authorize code grant!
	explicitHandler := &explicit.AuthorizeExplicitGrantTypeHandler{
		AccessTokenStrategy:   hmacStrategy,
		RefreshTokenStrategy:  hmacStrategy,
		AuthorizeCodeStrategy: hmacStrategy,
		Store:               store,
		AuthCodeLifespan:    time.Minute * 10,
		AccessTokenLifespan: accessTokenLifespan,
	}
	f.AuthorizeEndpointHandlers.Add("code", explicitHandler)
	f.TokenEndpointHandlers.Add("code", explicitHandler)

	// Implicit grant type
	implicitHandler := &implicit.AuthorizeImplicitGrantTypeHandler{
		AccessTokenStrategy: hmacStrategy,
		Store:               store,
		AccessTokenLifespan: accessTokenLifespan,
	}
	f.AuthorizeEndpointHandlers.Add("implicit", implicitHandler)

	// Client credentials grant type
	clientHandler := &coreclient.ClientCredentialsGrantHandler{
		AccessTokenStrategy: hmacStrategy,
		Store:               store,
		AccessTokenLifespan: accessTokenLifespan,
	}
	f.TokenEndpointHandlers.Add("client", clientHandler)

	// Resource owner password credentials grant type
	ownerHandler := &owner.ResourceOwnerPasswordCredentialsGrantHandler{
		AccessTokenStrategy: hmacStrategy,
		Store:               store,
		AccessTokenLifespan: accessTokenLifespan,
	}
	f.TokenEndpointHandlers.Add("owner", ownerHandler)

	// Refresh grant type
	refreshHandler := &refresh.RefreshTokenGrantHandler{
		AccessTokenStrategy:  hmacStrategy,
		RefreshTokenStrategy: hmacStrategy,
		Store:                store,
		AccessTokenLifespan:  accessTokenLifespan,
	}
	f.TokenEndpointHandlers.Add("refresh", refreshHandler)

    return f
}
// ...

// ...
type session struct {
	User string
}

func authEndpoint(rw http.ResponseWriter, req *http.Request) {
    // This context will be passed to all methods.
	ctx := NewContext()

    // Let's create an AuthorizeRequest object!
    // It will analyze the request and extract important information like scopes, response type and others.
	ar, err := oauth2.NewAuthorizeRequest(ctx, req)
	if err != nil {
		log.Printf("Error occurred in NewAuthorizeRequest: %s\nStack: \n%s", err, err.(*errors.Error).ErrorStack())
		oauth2.WriteAuthorizeError(rw, ar, err)
		return
	}

    // you have now access to authorizeRequest, Code ResponseTypes, Scopes ...
    // and can show the user agent a login or consent page
    //
    // or, for example:
    // if authorizeRequest.GetScopes().Has("admin") {
    //     http.Error(rw, "you're not allowed to do that", http.StatusForbidden)
    //     return
    // }

	// Normally, this would be the place where you would check if the user is logged in and gives his consent.
	// We're simplifying things and just checking if the request includes a valid username and password
	if req.Form.Get("username") != "peter" || req.Form.Get("password") != "secret password" {
		rw.Write([]byte(`<h1>Please log in</h1>`))
		// ...
		return
	}

	// You MUST also get the user's consent which is left out here for simplicity.

    // Now it's time to persist some data. This session will be later available to us in the token endpoint.
    // So make sure to store things like the user id here.
    // The authorize request will be stored additionally, so no need to save scopes or similar things.
	sess := &session{User: "peter"}

	// Now we need to get an response.
	// This is the place where the AuthorizeEndpointHandlers kick in and start processing the request.
	// In our case (let's assume response_type=code), the AuthorizeExplicitGrantTypeHandler is going to handle the request.
	//
	// NewAuthorizeResponse is capable of running multiple response type handlers which in turn enables this library
	// to support open id connect.
	response, err := oauth2.NewAuthorizeResponse(ctx, req, ar, sess)
	if err != nil {
		log.Printf("Error occurred in NewAuthorizeResponse: %s\nStack: \n%s", err, err.(*errors.Error).ErrorStack())
		oauth2.WriteAuthorizeError(rw, ar, err)
		return
	}

    // Last but not least, send the response!
	oauth2.WriteAuthorizeResponse(rw, ar, response)

    // Done! The client should now have a valid authorize code!
}

// ...

// ...
func tokenEndpoint(rw http.ResponseWriter, req *http.Request) {
    // This context will be passed to all methods.
	ctx := NewContext()

	// Remember the sesion data from before? Yup, that's going to be saved in here!
	var mySessionData session

    // This will create an access request object and iterate through the registered TokenEndpointHandlers to validate the request.
	accessRequest, err := oauth2.NewAccessRequest(ctx, req, &mySessionData)
	if err != nil {
		log.Printf("Error occurred in NewAccessRequest: %s\nStack: \n%s", err, err.(*errors.Error).ErrorStack())
		oauth2.WriteAccessError(rw, accessRequest, err)
		return
	}

    // Now we have access to mySessionData's populated values and can do crazy things.

    // Next we create a response for the access request. Again, we iterate through the TokenEndpointHandlers
    // and aggregate the result in response.
	response, err := oauth2.NewAccessResponse(ctx, req, accessRequest)
	if err != nil {
		log.Printf("Error occurred in NewAccessResponse: %s\nStack: \n%s", err, err.(*errors.Error).ErrorStack())
		oauth2.WriteAccessError(rw, accessRequest, err)
		return
	}

    // All done, send the response.
	oauth2.WriteAccessResponse(rw, accessRequest, response)

	// Your client does now have a valid access token
}

package internal

import (
	"github.com/go-errors/errors"
	"github.com/ory-am/common/pkg"
	"github.com/ory-am/fosite"
	"github.com/ory-am/fosite/client"
)

type UserRelation struct {
	Username string
	Password string
}

// Store is an in memory storage.
type Store struct {
	Clients        map[string]client.Client
	AuthorizeCodes map[string]fosite.Requester
	AccessTokens   map[string]fosite.Requester
	Implicit       map[string]fosite.Requester
	RefreshTokens  map[string]fosite.Requester
	Users          map[string]UserRelation
}

func (s *Store) GetClient(id string) (client.Client, error) {
	cl, ok := s.Clients[id]
	if !ok {
		return nil, pkg.ErrNotFound
	}
	return cl, nil
}

func (s *Store) CreateAuthorizeCodeSession(code string, req fosite.Requester) error {
	s.AuthorizeCodes[code] = req
	return nil
}

func (s *Store) GetAuthorizeCodeSession(code string, _ interface{}) (fosite.Requester, error) {
	rel, ok := s.AuthorizeCodes[code]
	if !ok {
		return nil, pkg.ErrNotFound
	}
	return rel, nil
}

func (s *Store) DeleteAuthorizeCodeSession(code string) error {
	delete(s.AuthorizeCodes, code)
	return nil
}

func (s *Store) CreateAccessTokenSession(signature string, req fosite.Requester) error {
	s.AccessTokens[signature] = req
	return nil
}

func (s *Store) GetAccessTokenSession(signature string, _ interface{}) (fosite.Requester, error) {
	rel, ok := s.AccessTokens[signature]
	if !ok {
		return nil, pkg.ErrNotFound
	}
	return rel, nil
}

func (s *Store) DeleteAccessTokenSession(signature string) error {
	delete(s.AccessTokens, signature)
	return nil
}

func (s *Store) CreateRefreshTokenSession(signature string, req fosite.Requester) error {
	s.RefreshTokens[signature] = req
	return nil
}

func (s *Store) GetRefreshTokenSession(signature string, _ interface{}) (fosite.Requester, error) {
	rel, ok := s.RefreshTokens[signature]
	if !ok {
		return nil, pkg.ErrNotFound
	}
	return rel, nil
}

func (s *Store) DeleteRefreshTokenSession(signature string) error {
	delete(s.RefreshTokens, signature)
	return nil
}

func (s *Store) CreateImplicitAccessTokenSession(code string, req fosite.Requester) error {
	s.Implicit[code] = req
	return nil
}

func (s *Store) DoCredentialsAuthenticate(name string, secret string) error {
	rel, ok := s.Users[name]
	if !ok {
		return pkg.ErrNotFound
	}
	if rel.Password != secret {
		return errors.New("Invalid credentials")
	}
	return nil
}

var hmacStrategy = &strategy.HMACSHAStrategy{
	Enigma: &enigma.HMACSHAEnigma{
		GlobalSecret: []byte("some-super-cool-secret-that-nobody-knows"),
	},
}

// var store = ...

f := NewFosite(store)
accessTokenLifespan := time.Hour

// Let's enable the explicit authorize code grant!
explicitHandler := &explicit.AuthorizeExplicitGrantTypeHandler{
    AccessTokenStrategy:   hmacStrategy,
    RefreshTokenStrategy:  hmacStrategy,
    AuthorizeCodeStrategy: hmacStrategy,
    Store:               store,
    AuthCodeLifespan:    time.Minute * 10,
    AccessTokenLifespan: accessTokenLifespan,
}
f.AuthorizeEndpointHandlers.Add("code", explicitHandler)
f.TokenEndpointHandlers.Add("code", explicitHandler)