use bitflags::bitflags;

use foreign_types::ForeignTypeRef;

use libc::{c_int, c_long, c_ulong};

use std::mem;

use std::ptr;

use crate::asn1::Asn1GeneralizedTimeRef;

use crate::error::ErrorStack;

use crate::hash::MessageDigest;

use crate::stack::StackRef;

use crate::util::ForeignTypeRefExt;

use crate::x509::store::X509StoreRef;

use crate::x509::{X509Ref, X509};

use crate::{cvt, cvt_p};

use openssl_macros::corresponds;

bitflags! {

    #[derive(Copy, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]

    #[repr(transparent)]

    pub struct OcspFlag: c_ulong {

        const NO_CERTS = ffi::OCSP_NOCERTS;

        const NO_INTERN = ffi::OCSP_NOINTERN;

        const NO_CHAIN = ffi::OCSP_NOCHAIN;

        const NO_VERIFY = ffi::OCSP_NOVERIFY;

        const NO_EXPLICIT = ffi::OCSP_NOEXPLICIT;

        const NO_CA_SIGN = ffi::OCSP_NOCASIGN;

        const NO_DELEGATED = ffi::OCSP_NODELEGATED;

        const NO_CHECKS = ffi::OCSP_NOCHECKS;

        const TRUST_OTHER = ffi::OCSP_TRUSTOTHER;

        const RESPID_KEY = ffi::OCSP_RESPID_KEY;

        const NO_TIME = ffi::OCSP_NOTIME;

    }

}

#[derive(Copy, Clone, Debug, PartialEq, Eq)]

pub struct OcspResponseStatus(c_int);

impl OcspResponseStatus {

    pub const SUCCESSFUL: OcspResponseStatus =

        OcspResponseStatus(ffi::OCSP_RESPONSE_STATUS_SUCCESSFUL);

    pub const MALFORMED_REQUEST: OcspResponseStatus =

        OcspResponseStatus(ffi::OCSP_RESPONSE_STATUS_MALFORMEDREQUEST);

    pub const INTERNAL_ERROR: OcspResponseStatus =

        OcspResponseStatus(ffi::OCSP_RESPONSE_STATUS_INTERNALERROR);

    pub const TRY_LATER: OcspResponseStatus =

        OcspResponseStatus(ffi::OCSP_RESPONSE_STATUS_TRYLATER);

    pub const SIG_REQUIRED: OcspResponseStatus =

        OcspResponseStatus(ffi::OCSP_RESPONSE_STATUS_SIGREQUIRED);

    pub const UNAUTHORIZED: OcspResponseStatus =

        OcspResponseStatus(ffi::OCSP_RESPONSE_STATUS_UNAUTHORIZED);

    pub fn from_raw(raw: c_int) -> OcspResponseStatus {

        OcspResponseStatus(raw)

    }

    #[allow(clippy::trivially_copy_pass_by_ref)]

    pub fn as_raw(&self) -> c_int {

        self.0

    }

}

#[derive(Copy, Clone, Debug, PartialEq, Eq)]

pub struct OcspCertStatus(c_int);

impl OcspCertStatus {

    pub const GOOD: OcspCertStatus = OcspCertStatus(ffi::V_OCSP_CERTSTATUS_GOOD);

    pub const REVOKED: OcspCertStatus = OcspCertStatus(ffi::V_OCSP_CERTSTATUS_REVOKED);

    pub const UNKNOWN: OcspCertStatus = OcspCertStatus(ffi::V_OCSP_CERTSTATUS_UNKNOWN);

    pub fn from_raw(raw: c_int) -> OcspCertStatus {

        OcspCertStatus(raw)

    }

    #[allow(clippy::trivially_copy_pass_by_ref)]

    pub fn as_raw(&self) -> c_int {

        self.0

    }

}

#[derive(Copy, Clone, Debug, PartialEq, Eq)]

pub struct OcspRevokedStatus(c_int);

impl OcspRevokedStatus {

    pub const NO_STATUS: OcspRevokedStatus = OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_NOSTATUS);

    pub const UNSPECIFIED: OcspRevokedStatus =

        OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_UNSPECIFIED);

    pub const KEY_COMPROMISE: OcspRevokedStatus =

        OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_KEYCOMPROMISE);

    pub const CA_COMPROMISE: OcspRevokedStatus =

        OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_CACOMPROMISE);

    pub const AFFILIATION_CHANGED: OcspRevokedStatus =

        OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_AFFILIATIONCHANGED);

    pub const STATUS_SUPERSEDED: OcspRevokedStatus =

        OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_SUPERSEDED);

    pub const STATUS_CESSATION_OF_OPERATION: OcspRevokedStatus =

        OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_CESSATIONOFOPERATION);

    pub const STATUS_CERTIFICATE_HOLD: OcspRevokedStatus =

        OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_CERTIFICATEHOLD);

    pub const REMOVE_FROM_CRL: OcspRevokedStatus =

        OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_REMOVEFROMCRL);

    pub fn from_raw(raw: c_int) -> OcspRevokedStatus {

        OcspRevokedStatus(raw)

    }

    #[allow(clippy::trivially_copy_pass_by_ref)]

    pub fn as_raw(&self) -> c_int {

        self.0

    }

}

pub struct OcspStatus<'a> {

    /// The overall status of the response.

    pub status: OcspCertStatus,

    /// If `status` is `CERT_STATUS_REVOKED`, the reason for the revocation.

    pub reason: OcspRevokedStatus,

    /// If `status` is `CERT_STATUS_REVOKED`, the time at which the certificate was revoked.

    pub revocation_time: Option<&'a Asn1GeneralizedTimeRef>,

    /// The time that this revocation check was performed.

    pub this_update: &'a Asn1GeneralizedTimeRef,

    /// The time at which this revocation check expires.

    pub next_update: &'a Asn1GeneralizedTimeRef,

}

impl<'a> OcspStatus<'a> {

    /// Checks validity of the `this_update` and `next_update` fields.

    ///

    /// The `nsec` parameter specifies an amount of slack time that will be used when comparing

    /// those times with the current time to account for delays and clock skew.

    ///

    /// The `maxsec` parameter limits the maximum age of the `this_update` parameter to prohibit

    /// very old responses.

    #[corresponds(OCSP_check_validity)]

    pub fn check_validity(&self, nsec: u32, maxsec: Option<u32>) -> Result<(), ErrorStack> {

        unsafe {

            cvt(ffi::OCSP_check_validity(

                self.this_update.as_ptr(),

                self.next_update.as_ptr(),

                nsec as c_long,

                maxsec.map(|n| n as c_long).unwrap_or(-1),

            ))

            .map(|_| ())

        }

    }

}

foreign_type_and_impl_send_sync! {

    type CType = ffi::OCSP_BASICRESP;

    fn drop = ffi::OCSP_BASICRESP_free;

    pub struct OcspBasicResponse;

    pub struct OcspBasicResponseRef;

}

impl OcspBasicResponseRef {

    /// Verifies the validity of the response.

    ///

    /// The `certs` parameter contains a set of certificates that will be searched when locating the

    /// OCSP response signing certificate. Some responders do not include this in the response.

    #[corresponds(OCSP_basic_verify)]

    pub fn verify(

        &self,

        certs: &StackRef<X509>,

        store: &X509StoreRef,

        flags: OcspFlag,

    ) -> Result<(), ErrorStack> {

        unsafe {

            cvt(ffi::OCSP_basic_verify(

                self.as_ptr(),

                certs.as_ptr(),

                store.as_ptr(),

                flags.bits(),

            ))

            .map(|_| ())

        }

    }

    /// Looks up the status for the specified certificate ID.

    #[corresponds(OCSP_resp_find_status)]

    pub fn find_status<'a>(&'a self, id: &OcspCertIdRef) -> Option<OcspStatus<'a>> {

        unsafe {

            let mut status = ffi::V_OCSP_CERTSTATUS_UNKNOWN;

            let mut reason = ffi::OCSP_REVOKED_STATUS_NOSTATUS;

            let mut revocation_time = ptr::null_mut();

            let mut this_update = ptr::null_mut();

            let mut next_update = ptr::null_mut();

            let r = ffi::OCSP_resp_find_status(

                self.as_ptr(),

                id.as_ptr(),

                &mut status,

                &mut reason,

                &mut revocation_time,

                &mut this_update,

                &mut next_update,

            );

            if r == 1 {

                let revocation_time = Asn1GeneralizedTimeRef::from_const_ptr_opt(revocation_time);

                Some(OcspStatus {

                    status: OcspCertStatus(status),

                    reason: OcspRevokedStatus(status),

                    revocation_time,

                    this_update: Asn1GeneralizedTimeRef::from_ptr(this_update),

                    next_update: Asn1GeneralizedTimeRef::from_ptr(next_update),

                })

            } else {

                None

            }

        }

    }

}

foreign_type_and_impl_send_sync! {

    type CType = ffi::OCSP_CERTID;

    fn drop = ffi::OCSP_CERTID_free;

    pub struct OcspCertId;

    pub struct OcspCertIdRef;

}

impl OcspCertId {

    /// Constructs a certificate ID for certificate `subject`.

    #[corresponds(OCSP_cert_to_id)]

    pub fn from_cert(

        digest: MessageDigest,

        subject: &X509Ref,

        issuer: &X509Ref,

    ) -> Result<OcspCertId, ErrorStack> {

        unsafe {

            cvt_p(ffi::OCSP_cert_to_id(

                digest.as_ptr(),

                subject.as_ptr(),

                issuer.as_ptr(),

            ))

            .map(OcspCertId)

        }

    }

}

foreign_type_and_impl_send_sync! {

    type CType = ffi::OCSP_RESPONSE;

    fn drop = ffi::OCSP_RESPONSE_free;

    pub struct OcspResponse;

    pub struct OcspResponseRef;

}

impl OcspResponse {

    /// Creates an OCSP response from the status and optional body.

    ///

    /// A body should only be provided if `status` is `RESPONSE_STATUS_SUCCESSFUL`.

    #[corresponds(OCSP_response_create)]

    pub fn create(

        status: OcspResponseStatus,

        body: Option<&OcspBasicResponseRef>,

    ) -> Result<OcspResponse, ErrorStack> {

        unsafe {

            ffi::init();

            cvt_p(ffi::OCSP_response_create(

                status.as_raw(),

                body.map(|r| r.as_ptr()).unwrap_or(ptr::null_mut()),

            ))

            .map(OcspResponse)

        }

    }

    from_der! {

        /// Deserializes a DER-encoded OCSP response.

        #[corresponds(d2i_OCSP_RESPONSE)]

        from_der,

        OcspResponse,

        ffi::d2i_OCSP_RESPONSE

    }

}

impl OcspResponseRef {

    to_der! {

        /// Serializes the response to its standard DER encoding.

        #[corresponds(i2d_OCSP_RESPONSE)]

        to_der,

        ffi::i2d_OCSP_RESPONSE

    }

    /// Returns the status of the response.

    #[corresponds(OCSP_response_status)]

    pub fn status(&self) -> OcspResponseStatus {

        unsafe { OcspResponseStatus(ffi::OCSP_response_status(self.as_ptr())) }

    }

    /// Returns the basic response.

    ///

    /// This will only succeed if `status()` returns `RESPONSE_STATUS_SUCCESSFUL`.

    #[corresponds(OCSP_response_get1_basic)]

    pub fn basic(&self) -> Result<OcspBasicResponse, ErrorStack> {

        unsafe { cvt_p(ffi::OCSP_response_get1_basic(self.as_ptr())).map(OcspBasicResponse) }

    }

}

foreign_type_and_impl_send_sync! {

    type CType = ffi::OCSP_REQUEST;

    fn drop = ffi::OCSP_REQUEST_free;

    pub struct OcspRequest;

    pub struct OcspRequestRef;

}

impl OcspRequest {

    #[corresponds(OCSP_REQUEST_new)]

    pub fn new() -> Result<OcspRequest, ErrorStack> {

        unsafe {

            ffi::init();

            cvt_p(ffi::OCSP_REQUEST_new()).map(OcspRequest)

        }

    }

    from_der! {

        /// Deserializes a DER-encoded OCSP request.

        #[corresponds(d2i_OCSP_REQUEST)]

        from_der,

        OcspRequest,

        ffi::d2i_OCSP_REQUEST

    }

}

impl OcspRequestRef {

    to_der! {

        /// Serializes the request to its standard DER encoding.

        #[corresponds(i2d_OCSP_REQUEST)]

        to_der,

        ffi::i2d_OCSP_REQUEST

    }

    #[corresponds(OCSP_request_add0_id)]

    pub fn add_id(&mut self, id: OcspCertId) -> Result<&mut OcspOneReqRef, ErrorStack> {

        unsafe {

            let ptr = cvt_p(ffi::OCSP_request_add0_id(self.as_ptr(), id.as_ptr()))?;

            mem::forget(id);

            Ok(OcspOneReqRef::from_ptr_mut(ptr))

        }

    }

}

foreign_type_and_impl_send_sync! {

    type CType = ffi::OCSP_ONEREQ;

    fn drop = ffi::OCSP_ONEREQ_free;

    pub struct OcspOneReq;

    pub struct OcspOneReqRef;

}