#pragma once

#include "envoy/common/pure.h"

#include "envoy/common/time.h"

#include "source/common/common/cleanup.h"

#include "source/common/common/thread.h"

#include "absl/types/optional.h"

namespace Envoy {

namespace Extensions {

namespace Common {

namespace Aws {

constexpr char AWS_ACCESS_KEY_ID[] = "AWS_ACCESS_KEY_ID";

constexpr char AWS_SECRET_ACCESS_KEY[] = "AWS_SECRET_ACCESS_KEY";

constexpr char AWS_SESSION_TOKEN[] = "AWS_SESSION_TOKEN";

constexpr char ACCESS_KEY_ID[] = "AccessKeyId";

constexpr char SECRET_ACCESS_KEY[] = "SecretAccessKey";

constexpr char TOKEN[] = "Token";

constexpr char SESSION_TOKEN[] = "SessionToken";

constexpr char EXPIRATION[] = "Expiration";

constexpr char CREDENTIALS[] = "Credentials";

constexpr char STS_SERVICE_NAME[] = "sts";

constexpr std::chrono::hours REFRESH_INTERVAL{1};

constexpr std::chrono::seconds REFRESH_GRACE_PERIOD{60};

constexpr std::chrono::seconds MAX_CACHE_JITTER{30};

/**

 * AWS credentials containers

 *

 * If a credential component was not found in the execution environment, it's getter method will

 * return absl::nullopt. Credential components with the empty string value are treated as not found.

 */

class Credentials {

public:

  // Access Key Credentials

  explicit Credentials(absl::string_view access_key_id = absl::string_view(),

                       absl::string_view secret_access_key = absl::string_view(),

private:

  absl::optional<std::string> access_key_id_;

  absl::optional<std::string> secret_access_key_;

  absl::optional<std::string> session_token_;

};

using CredentialsPendingCallback = std::function<void()>;

/*

 * X509 Credentials used for IAM Roles Anywhere

 */

class X509Credentials {

public:

  enum class PublicKeySignatureAlgorithm {

    RSA,

    ECDSA,

  };

  // X509 Credentials

  X509Credentials(absl::string_view certificate_b64,

                  PublicKeySignatureAlgorithm certificate_signature_algorithm,

                  absl::string_view certificate_serial,

                  absl::optional<absl::string_view> certificate_chain_b64,

                  absl::string_view certificate_private_key_pem,

                  SystemTime certificate_expiration_time)

private:

  // RolesAnywhere certificate based credentials

  absl::optional<std::string> certificate_b64_ = absl::nullopt;

  absl::optional<std::string> certificate_chain_b64_ = absl::nullopt;

  absl::optional<std::string> certificate_private_key_pem_ = absl::nullopt;

  absl::optional<std::string> certificate_serial_ = absl::nullopt;

  absl::optional<SystemTime> certificate_expiration_ = absl::nullopt;

  absl::optional<PublicKeySignatureAlgorithm> certificate_signature_algorithm_ = absl::nullopt;

};

/*

 * Interface for classes able to fetch AWS credentials from the execution environment.

 */

class CredentialsProvider {

public:

  /**

   * Get credentials from the environment.

   *

   * @return AWS credentials

   */

  virtual std::string providerName() PURE;

  virtual Credentials getCredentials() PURE;

  /**

   * @return true if credentials are pending from this provider, false if credentials are available

   */

  virtual bool credentialsPending() PURE;

};

using CredentialsConstSharedPtr = std::shared_ptr<const Credentials>;

using CredentialsConstUniquePtr = std::unique_ptr<const Credentials>;

using CredentialsProviderSharedPtr = std::shared_ptr<CredentialsProvider>;

class CredentialSubscriberCallbacks {

public:

  virtual void onCredentialUpdate() PURE;

};

using CredentialSubscriberCallbacksSharedPtr = std::shared_ptr<CredentialSubscriberCallbacks>;

// Subscription model allowing CredentialsProviderChains to be notified of credential provider

// updates. A credential provider chain will call credential_provider->subscribeToCredentialUpdates

// to register itself for updates via onCredentialUpdate callback. When a credential provider has

// successfully updated all threads with new credentials, via the setCredentialsToAllThreads method

// it will notify all subscribers that credentials have been retrieved.

//

// Subscription is only relevant for metadata credentials providers, as these are the only

// credential providers that implement async credential retrieval functionality.

//

// RAII is used, as credential providers may be instantiated as singletons, as such they may outlive

// the credential provider chain.

//

// Uses weak_ptr to safely handle subscriber lifetime without dangling pointers.

class CredentialSubscriberCallbacksHandle

    : public RaiiListElement<std::weak_ptr<CredentialSubscriberCallbacks>> {

public:

  CredentialSubscriberCallbacksHandle(

      CredentialSubscriberCallbacksSharedPtr cb,

      std::list<std::weak_ptr<CredentialSubscriberCallbacks>>& parent)

};

using CredentialSubscriberCallbacksHandlePtr = std::unique_ptr<CredentialSubscriberCallbacksHandle>;

/**

 * AWS credentials provider chain, able to fallback between multiple credential providers.

 */

class CredentialsProviderChain : public CredentialSubscriberCallbacks,

                                 public Logger::Loggable<Logger::Id::aws>,

                                 public std::enable_shared_from_this<CredentialsProviderChain> {

public:

  // Store a callback if credentials are pending from a credential provider, to be called when

  // credentials are available

  virtual bool addCallbackIfChainCredentialsPending(CredentialsPendingCallback&&);

  // Loop through all credential providers in a chain and return credentials from the first one that

  // has credentials available

  Credentials chainGetCredentials();

  // Store the RAII handle for a subscription to credential provider notification

  void storeSubscription(CredentialSubscriberCallbacksHandlePtr);

  // Returns the size of the credential provider chain

private:

  // Callback to notify on credential updates occurring from a chain member

  void onCredentialUpdate() override;

  bool chainProvidersPending();

protected:

  std::list<CredentialsProviderSharedPtr> providers_;

  Thread::MutexBasicLockable mu_;

  std::vector<CredentialsPendingCallback> credential_pending_callbacks_ ABSL_GUARDED_BY(mu_);

  std::list<CredentialSubscriberCallbacksHandlePtr> subscriber_handles_;

};

using CredentialsProviderChainSharedPtr = std::shared_ptr<CredentialsProviderChain>;

/*

 * X509 credential provider used for IAM Roles Anywhere

 */

class X509CredentialsProvider {

public:

  /**

   * Get credentials from the environment.

   *

   * @return AWS credentials

   */

  virtual X509Credentials getCredentials() PURE;

};

using X509CredentialsProviderSharedPtr = std::shared_ptr<X509CredentialsProvider>;

} // namespace Aws

} // namespace Common

} // namespace Extensions

} // namespace Envoy