/*

 * Licensed to the Apache Software Foundation (ASF) under one

 * or more contributor license agreements.  See the NOTICE file

 * distributed with this work for additional information

 * regarding copyright ownership.  The ASF licenses this file

 * to you under the Apache License, Version 2.0 (the

 * "License"); you may not use this file except in compliance

 * with the License.  You may obtain a copy of the License at

 *

 *   http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing,

 * software distributed under the License is distributed on an

 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

 * KIND, either express or implied.  See the License for the

 * specific language governing permissions and limitations

 * under the License.

 */

/***************************************************************************

 * Copyright (C) 2017-2026 ZmartZone Holding BV

 * Copyright (C) 2013-2017 Ping Identity Corporation

 * All rights reserved.

 *

 * DISCLAIMER OF WARRANTIES:

 *

 * THE SOFTWARE PROVIDED HEREUNDER IS PROVIDED ON AN "AS IS" BASIS, WITHOUT

 * ANY WARRANTIES OR REPRESENTATIONS EXPRESS, IMPLIED OR STATUTORY; INCLUDING,

 * WITHOUT LIMITATION, WARRANTIES OF QUALITY, PERFORMANCE, NONINFRINGEMENT,

 * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.  NOR ARE THERE ANY

 * WARRANTIES CREATED BY A COURSE OR DEALING, COURSE OF PERFORMANCE OR TRADE

 * USAGE.  FURTHERMORE, THERE ARE NO WARRANTIES THAT THE SOFTWARE WILL MEET

 * YOUR NEEDS OR BE FREE FROM ERRORS, OR THAT THE OPERATION OF THE SOFTWARE

 * WILL BE UNINTERRUPTED.  IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR

 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES HOWEVER CAUSED AND ON ANY THEORY OF

 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 *

 * @Author: Hans Zandbelt - hans.zandbelt@openidc.com

 */

#ifndef _MOD_AUTH_OPENIDC_HTTP_H_

#define _MOD_AUTH_OPENIDC_HTTP_H_

#include <apr.h>

#include <apr_hash.h>

#include <apr_time.h>

// clang-format off

#include <httpd.h>

#include <http_log.h>

#include <http_request.h>

// clang-format on

#include "json.h"

#define OIDC_HTTP_CONTENT_TYPE_JSON "application/json"

#define OIDC_HTTP_CONTENT_TYPE_JWT "application/jwt"

#define OIDC_HTTP_CONTENT_TYPE_FORM_ENCODED "application/x-www-form-urlencoded"

#define OIDC_HTTP_CONTENT_TYPE_IMAGE_PNG "image/png"

#define OIDC_HTTP_CONTENT_TYPE_TEXT_HTML "text/html"

#define OIDC_HTTP_CONTENT_TYPE_APP_XHTML_XML "application/xhtml+xml"

#define OIDC_HTTP_CONTENT_TYPE_ANY "*/*"

/* HTTP header constants */

#define OIDC_HTTP_HDR_COOKIE "Cookie"

#define OIDC_HTTP_HDR_SET_COOKIE "Set-Cookie"

#define OIDC_HTTP_HDR_USER_AGENT "User-Agent"

#define OIDC_HTTP_HDR_X_FORWARDED_FOR "X-Forwarded-For"

#define OIDC_HTTP_HDR_CONTENT_TYPE "Content-Type"

#define OIDC_HTTP_HDR_CONTENT_LENGTH "Content-Length"

#define OIDC_HTTP_HDR_X_REQUESTED_WITH "X-Requested-With"

#define OIDC_HTTP_HDR_SEC_FETCH_MODE "Sec-Fetch-Mode"

#define OIDC_HTTP_HDR_SEC_FETCH_DEST "Sec-Fetch-Dest"

#define OIDC_HTTP_HDR_ACCEPT "Accept"

#define OIDC_HTTP_HDR_AUTHORIZATION "Authorization"

#define OIDC_HTTP_HDR_X_FORWARDED_PROTO "X-Forwarded-Proto"

#define OIDC_HTTP_HDR_X_FORWARDED_PORT "X-Forwarded-Port"

#define OIDC_HTTP_HDR_X_FORWARDED_HOST "X-Forwarded-Host"

#define OIDC_HTTP_HDR_FORWARDED "Forwarded"

#define OIDC_HTTP_HDR_HOST "Host"

#define OIDC_HTTP_HDR_LOCATION "Location"

#define OIDC_HTTP_HDR_CACHE_CONTROL "Cache-Control"

#define OIDC_HTTP_HDR_PRAGMA "Pragma"

#define OIDC_HTTP_HDR_P3P "P3P"

#define OIDC_HTTP_HDR_EXPIRES "Expires"

#define OIDC_HTTP_HDR_X_FRAME_OPTIONS "X-Frame-Options"

#define OIDC_HTTP_HDR_WWW_AUTHENTICATE "WWW-Authenticate"

#define OIDC_HTTP_HDR_TRACE_PARENT "traceparent"

#define OIDC_HTTP_HDR_DPOP "DPoP"

#define OIDC_HTTP_HDR_DPOP_NONCE "DPoP-Nonce"

#define OIDC_HTTP_HDR_VAL_XML_HTTP_REQUEST "XMLHttpRequest"

#define OIDC_HTTP_HDR_VAL_NAVIGATE "navigate"

#define OIDC_HTTP_HDR_VAL_DOCUMENT "document"

#define OIDC_HTTP_COOKIE_SAMESITE_LAX "SameSite=Lax"

#define OIDC_HTTP_COOKIE_SAMESITE_STRICT "SameSite=Strict"

#define OIDC_HTTP_COOKIE_SAMESITE_NONE(c, r) oidc_util_url_cur_is_secure(r, c) ? "SameSite=None" : NULL

typedef struct oidc_http_timeout_t {

  int request_timeout; // in seconds

  int connect_timeout; // in seconds

  int retries;

  int retry_interval; // in milliseconds

} oidc_http_timeout_t;

#define OIDC_HTTP_PROXY_AUTH_BASIC "basic"

#define OIDC_HTTP_PROXY_AUTH_DIGEST "digest"

#define OIDC_HTTP_PROXY_AUTH_NTLM "ntlm"

#define OIDC_HTTP_PROXY_AUTH_ANY "any"

#define OIDC_HTTP_PROXY_AUTH_NEGOTIATE "negotiate"

typedef struct oidc_http_outgoing_proxy_t {

  const char *host_port;

  const char *username_password;

  unsigned long auth_type;

} oidc_http_outgoing_proxy_t;

char *oidc_http_url_encode(const request_rec *r, const char *str);

char *oidc_http_url_decode(const request_rec *r, const char *str);

/* TRUE when a protocol parameter of this name carries a secret or token and its value

 * must be redacted before it is written to the debug log */

apr_byte_t oidc_http_param_is_sensitive(const char *key);

void oidc_http_hdr_err_out_add(const request_rec *r, const char *name, const char *value);

void oidc_http_set_no_cache_headers(const request_rec *r);

void oidc_http_hdr_in_set(const request_rec *r, const char *name, const char *value);

void oidc_http_hdr_table_add(const request_rec *r, apr_table_t *table, const char *name, const char *value);

const char *oidc_http_hdr_in_cookie_get(const request_rec *r);

void oidc_http_hdr_in_cookie_set(const request_rec *r, const char *value);

const char *oidc_http_hdr_in_user_agent_get(const request_rec *r);

const char *oidc_http_hdr_in_x_forwarded_for_get(const request_rec *r);

const char *oidc_http_hdr_in_content_type_get(const request_rec *r);

const char *oidc_http_hdr_in_content_length_get(const request_rec *r);

const char *oidc_http_hdr_in_x_requested_with_get(const request_rec *r);

const char *oidc_http_hdr_in_sec_fetch_mode_get(const request_rec *r);

const char *oidc_http_hdr_in_sec_fetch_dest_get(const request_rec *r);

const char *oidc_http_hdr_in_accept_get(const request_rec *r);

apr_byte_t oidc_http_hdr_in_accept_contains(const request_rec *r, const char *needle);

const char *oidc_http_hdr_in_authorization_get(const request_rec *r);

const char *oidc_http_hdr_in_x_forwarded_proto_get(const request_rec *r);

const char *oidc_http_hdr_in_x_forwarded_port_get(const request_rec *r);

const char *oidc_http_hdr_in_x_forwarded_host_get(const request_rec *r);

const char *oidc_http_hdr_in_forwarded_get(const request_rec *r);

const char *oidc_http_hdr_in_host_get(const request_rec *r);

const char *oidc_http_hdr_in_traceparent_get(const request_rec *r);

void oidc_http_hdr_out_location_set(const request_rec *r, const char *value);

const char *oidc_http_hdr_out_location_get(const request_rec *r);

const char *oidc_http_hdr_forwarded_get(const request_rec *r, const char *elem);

char *oidc_http_hdr_normalize_name(const request_rec *r, const char *str);

apr_byte_t oidc_http_get(request_rec *r, const char *url, const apr_table_t *params, const char *basic_auth,

       const char *access_token, const char *dpop, int ssl_validate_server, char **response,

       long *response_code, apr_hash_t *response_hdrs, const oidc_http_timeout_t *http_timeout,

       const oidc_http_outgoing_proxy_t *outgoing_proxy, const apr_array_header_t *pass_cookies,

       const char *ssl_cert, const char *ssl_key, const char *ssl_key_pwd);

apr_byte_t oidc_http_post_form(request_rec *r, const char *url, const apr_table_t *params, const char *basic_auth,

             const char *access_token, const char *dpop, int ssl_validate_server, char **response,

             long *response_code, apr_hash_t *response_hdrs, const oidc_http_timeout_t *http_timeout,

             const oidc_http_outgoing_proxy_t *outgoing_proxy, const apr_array_header_t *pass_cookies,

             const char *ssl_cert, const char *ssl_key, const char *ssl_key_pwd);

apr_byte_t oidc_http_post_json(request_rec *r, const char *url, const oidc_json_t *data, const char *basic_auth,

             const char *access_token, const char *dpop, int ssl_validate_server, char **response,

             long *response_code, apr_hash_t *response_hdrs, const oidc_http_timeout_t *http_timeout,

             const oidc_http_outgoing_proxy_t *outgoing_proxy, const apr_array_header_t *pass_cookies,

             const char *ssl_cert, const char *ssl_key, const char *ssl_key_pwd);

apr_byte_t oidc_util_url_has_parameter(request_rec *r, const char *param);

apr_byte_t oidc_util_url_parameter_get(request_rec *r, char *name, char **value);

int oidc_util_http_send(request_rec *r, const char *data, size_t data_len, const char *content_type,

      int success_rvalue);

int oidc_util_http_content_prep(request_rec *r, const char *data, size_t data_len, const char *content_type);

int oidc_util_http_content_send(request_rec *r);

apr_byte_t oidc_util_read_form_encoded_params(request_rec *r, apr_table_t *table, const char *data);

apr_byte_t oidc_util_read_form_encoded_params_reject_dup(request_rec *r, apr_table_t *table, const char *data,

               const char *const *no_repeat);

apr_byte_t oidc_util_read_post_params(request_rec *r, apr_table_t *table, apr_byte_t propagate,

              const char *strip_param_name);

apr_byte_t oidc_util_read_post_params_reject_dup(request_rec *r, apr_table_t *table, apr_byte_t propagate,

             const char *strip_param_name, const char *const *no_repeat);

char *oidc_http_query_encoded_url(request_rec *r, const char *url, const apr_table_t *params);

char *oidc_http_form_encoded_data(request_rec *r, const apr_table_t *params);

char *oidc_http_get_cookie(request_rec *r, const char *cookieName);

void oidc_http_set_cookie(request_rec *r, const char *cookieName, const char *cookieValue, apr_time_t expires,

        const char *ext);

char *oidc_http_get_chunked_cookie(request_rec *r, const char *cookieName, int chunkSize);

apr_byte_t oidc_http_set_chunked_cookie(request_rec *r, const char *cookieName, const char *cookieValue,

          apr_time_t expires, int chunkSize, const char *ext);

const char **oidc_http_proxy_auth_options(void);

unsigned long oidc_http_proxy_s2auth(const char *arg);

void oidc_http_init(void);

void oidc_http_cleanup(void);

void oidc_http_curl_pool_init(apr_pool_t *pool);

void oidc_http_curl_pool_child_init(void);

#endif /* _MOD_AUTH_OPENIDC_HTTP_H_ */