/*

 * Licensed to the Apache Software Foundation (ASF) under one

 * or more contributor license agreements.  See the NOTICE file

 * distributed with this work for additional information

 * regarding copyright ownership.  The ASF licenses this file

 * to you under the Apache License, Version 2.0 (the

 * "License"); you may not use this file except in compliance

 * with the License.  You may obtain a copy of the License at

 *

 *   http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing,

 * software distributed under the License is distributed on an

 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

 * KIND, either express or implied.  See the License for the

 * specific language governing permissions and limitations

 * under the License.

 */

/***************************************************************************

 * Copyright (C) 2017-2026 ZmartZone Holding BV

 * Copyright (C) 2013-2017 Ping Identity Corporation

 * All rights reserved.

 *

 * Client metadata: validation, parsing, on-disk read, and Dynamic Client

 * Registration with the OP.

 *

 * @Author: Hans Zandbelt - hans.zandbelt@openidc.com

 */

#include "metadata/internal.h"

#include "util/util_cfg.h"

#include "cfg/dir.h"

#include "http.h"

#include "metrics.h"

#include "mod_auth_openidc.h"

#include "proto/proto.h"

#include "util/util.h"

#include <apr_strings.h>

/*

 * check to see if dynamically registered JSON client metadata is valid and has not expired

 */

static apr_byte_t oidc_metadata_client_is_valid(request_rec *r, const oidc_json_t *j_client, const char *issuer) {

  char *str;

  /* get a handle to the client_id we need to use for this provider */

  str = NULL;

  oidc_json_object_get_string(r->pool, j_client, OIDC_METADATA_CLIENT_ID, &str, NULL);

  if (str == NULL) {

    oidc_error(r, "client (%s) JSON metadata did not contain a \"" OIDC_METADATA_CLIENT_ID "\" string",

         issuer);

    return FALSE;

  }

  /* get a handle to the client_secret we need to use for this provider */

  str = NULL;

  oidc_json_object_get_string(r->pool, j_client, OIDC_METADATA_CLIENT_SECRET, &str, NULL);

  if (str == NULL) {

    oidc_warn(r, "client (%s) JSON metadata did not contain a \"" OIDC_METADATA_CLIENT_SECRET "\" string",

        issuer);

  }

  /* the expiry timestamp from the JSON object */

  const oidc_json_t *expires_at = oidc_json_object_get(j_client, OIDC_METADATA_CLIENT_SECRET_EXPIRES_AT);

  if ((expires_at == NULL) || (!oidc_json_is_integer(expires_at))) {

    oidc_debug(

        r, "client (%s) metadata did not contain a \"" OIDC_METADATA_CLIENT_SECRET_EXPIRES_AT "\" setting",

        issuer);

    /* assume that it never expires */

    return TRUE;

  }

  /* see if it is unrestricted */

  if (oidc_json_integer_value(expires_at) == 0) {

    oidc_debug(r, "client (%s) metadata never expires (" OIDC_METADATA_CLIENT_SECRET_EXPIRES_AT "=0)",

         issuer);

    return TRUE;

  }

  /* check if the value >= now */

  if (apr_time_sec(apr_time_now()) > oidc_json_integer_value(expires_at)) {

    oidc_warn(r, "client (%s) secret expired", issuer);

    return FALSE;

  }

  oidc_debug(r, "client (%s) metadata is valid", issuer);

  return TRUE;

}

/*

 * register the client with the OP using Dynamic Client Registration

 */

apr_byte_t oidc_metadata_client_register(request_rec *r, oidc_cfg_t *cfg, const oidc_provider_t *provider,

           oidc_json_t **j_client, char **response) {

  /* assemble the JSON registration request */

  oidc_json_t *data = oidc_json_object();

  oidc_json_object_set_new(data, OIDC_METADATA_CLIENT_NAME,

         oidc_json_string(oidc_cfg_provider_client_name_get(provider)));

  oidc_json_t *redirect_uris = oidc_json_array();

  oidc_json_array_append_new(redirect_uris, oidc_json_string(oidc_util_url_redirect_uri(r, cfg)));

  oidc_json_object_set_new(data, OIDC_METADATA_REDIRECT_URIS, redirect_uris);

  oidc_json_t *response_types = oidc_json_array();

  apr_array_header_t *flows = oidc_proto_supported_flows(r->pool);

  for (int i = 0; i < flows->nelts; i++)

    oidc_json_array_append_new(response_types, oidc_json_string(APR_ARRAY_IDX(flows, i, const char *)));

  oidc_json_object_set_new(data, OIDC_METADATA_RESPONSE_TYPES, response_types);

  oidc_json_t *grant_types = oidc_json_array();

  oidc_json_array_append_new(grant_types, oidc_json_string("authorization_code"));

  oidc_json_array_append_new(grant_types, oidc_json_string("implicit"));

  oidc_json_array_append_new(grant_types, oidc_json_string("refresh_token"));

  oidc_json_object_set_new(data, OIDC_METADATA_GRANT_TYPES, grant_types);

  if (oidc_cfg_provider_token_endpoint_auth_get(provider) != NULL)

    oidc_json_object_set_new(data, OIDC_METADATA_TOKEN_ENDPOINT_AUTH_METHOD,

           oidc_json_string(oidc_cfg_provider_token_endpoint_auth_get(provider)));

  /* Request certificate-bound tokens when the provider's resolved RFC 8705 mode requires them. */

  if ((oidc_cfg_provider_cert_bound_tokens_get(provider) == OIDC_CERT_BOUND_TOKENS_ON) ||

      (oidc_cfg_endpoint_auth_is_mtls(oidc_cfg_provider_token_endpoint_auth_get(provider)) == TRUE))

    oidc_json_object_set_new(data, OIDC_METADATA_TLS_CLIENT_CERTIFICATE_BOUND_ACCESS_TOKENS,

           oidc_json_boolean(1));

  if (oidc_cfg_provider_client_contact_get(provider) != NULL) {

    oidc_json_t *contacts = oidc_json_array();

    oidc_json_array_append_new(contacts, oidc_json_string(oidc_cfg_provider_client_contact_get(provider)));

    oidc_json_object_set_new(data, OIDC_METADATA_CONTACTS, contacts);

  }

  if (oidc_cfg_provider_client_jwks_uri_get(provider)) {

    oidc_json_object_set_new(data, OIDC_METADATA_JWKS_URI,

           oidc_json_string(oidc_cfg_provider_client_jwks_uri_get(provider)));

  } else if (oidc_cfg_public_keys_get(cfg) != NULL) {

    oidc_json_object_set_new(

        data, OIDC_METADATA_JWKS_URI,

        oidc_json_string(apr_psprintf(r->pool, "%s?%s=rsa", oidc_util_url_redirect_uri(r, cfg),

              OIDC_REDIRECT_URI_REQUEST_JWKS)));

  }

  if (oidc_cfg_provider_id_token_signed_response_alg_get(provider) != NULL) {

    oidc_json_object_set_new(

        data, OIDC_METADATA_ID_TOKEN_SIGNED_RESPONSE_ALG,

        oidc_json_string(oidc_cfg_provider_id_token_signed_response_alg_get(provider)));

  }

  if (oidc_cfg_provider_id_token_encrypted_response_alg_get(provider) != NULL) {

    oidc_json_object_set_new(

        data, OIDC_METADATA_ID_TOKEN_ENCRYPTED_RESPONSE_ALG,

        oidc_json_string(oidc_cfg_provider_id_token_encrypted_response_alg_get(provider)));

  }

  if (oidc_cfg_provider_id_token_encrypted_response_enc_get(provider) != NULL) {

    oidc_json_object_set_new(

        data, OIDC_METADATA_ID_TOKEN_ENCRYPTED_RESPONSE_ENC,

        oidc_json_string(oidc_cfg_provider_id_token_encrypted_response_enc_get(provider)));

  }

  if (oidc_cfg_provider_userinfo_signed_response_alg_get(provider) != NULL) {

    oidc_json_object_set_new(

        data, OIDC_METADATA_USERINFO_SIGNED_RESPONSE_ALG,

        oidc_json_string(oidc_cfg_provider_userinfo_signed_response_alg_get(provider)));

  }

  if (oidc_cfg_provider_userinfo_encrypted_response_alg_get(provider) != NULL) {

    oidc_json_object_set_new(

        data, OIDC_METADATA_USERINFO_ENCRYPTED_RESPONSE_ALG,

        oidc_json_string(oidc_cfg_provider_userinfo_encrypted_response_alg_get(provider)));

  }

  if (oidc_cfg_provider_userinfo_encrypted_response_enc_get(provider) != NULL) {

    oidc_json_object_set_new(

        data, OIDC_METADATA_USERINFO_ENCRYPTED_RESPONSE_ENC,

        oidc_json_string(oidc_cfg_provider_userinfo_encrypted_response_enc_get(provider)));

  }

  if (oidc_cfg_provider_request_object_get(provider) != NULL) {

    oidc_json_t *request_object_config = NULL;

    if (oidc_json_decode_object(r, oidc_cfg_provider_request_object_get(provider),

              &request_object_config) == TRUE) {

      const oidc_json_t *crypto =

          oidc_json_object_get(request_object_config, OIDC_REQUEST_OBJECT_CRYPTO);

      char *alg = "none";

      oidc_json_object_get_string(r->pool, crypto, OIDC_REQUEST_OBJECT_CRYPTO_SIGN_ALG, &alg, "none");

      oidc_json_object_set_new(data, OIDC_METADATA_REQUEST_OBJECT_SIGNING_ALG, oidc_json_string(alg));

      oidc_json_decref(request_object_config);

    }

  }

  oidc_json_object_set_new(data, OIDC_METADATA_INITIATE_LOGIN_URI,

         oidc_json_string(oidc_util_url_redirect_uri(r, cfg)));

  oidc_json_object_set_new(

      data, OIDC_METADATA_FRONTCHANNEL_LOGOUT_URI,

      oidc_json_string(apr_psprintf(r->pool, "%s?%s=%s", oidc_util_url_redirect_uri(r, cfg),

            OIDC_REDIRECT_URI_REQUEST_LOGOUT, OIDC_GET_STYLE_LOGOUT_PARAM_VALUE)));

  // NB: "backchannel_logout_session_required" is not advertised in the registration

  oidc_json_object_set_new(data, OIDC_METADATA_BACKCHANNEL_LOGOUT_URI,

         oidc_json_string(apr_psprintf(r->pool, "%s?%s=%s", oidc_util_url_redirect_uri(r, cfg),

                     OIDC_REDIRECT_URI_REQUEST_LOGOUT,

                     OIDC_BACKCHANNEL_STYLE_LOGOUT_PARAM_VALUE)));

  if (oidc_cfg_default_slo_url_get(cfg) != NULL) {

    oidc_json_t *post_logout_redirect_uris = oidc_json_array();

    oidc_json_array_append_new(post_logout_redirect_uris, oidc_json_string(oidc_util_url_abs(

                    r, cfg, oidc_cfg_default_slo_url_get(cfg))));

    oidc_json_object_set_new(data, OIDC_METADATA_POST_LOGOUT_REDIRECT_URIS, post_logout_redirect_uris);

  }

  /* add any custom JSON in to the registration request */

  if (oidc_cfg_provider_registration_endpoint_json_get(provider) != NULL) {

    oidc_json_t *json = NULL;

    if (oidc_json_decode_object(r, oidc_cfg_provider_registration_endpoint_json_get(provider), &json) ==

        FALSE) {

      oidc_json_decref(data);

      return FALSE;

    }

    oidc_json_merge(r, json, data);

    oidc_json_decref(json);

  }

  /* dynamically register the client with the specified parameters

   * NB: the TLS client certificate is presented here as it is at the other endpoints, since the

   *     registration endpoint may be an RFC 8705 section 5 "mtls_endpoint_aliases" one */

  if (oidc_http_post_json(r, oidc_cfg_provider_registration_endpoint_url_get(provider), data, NULL,

        oidc_cfg_provider_registration_token_get(provider), NULL,

        oidc_cfg_provider_ssl_validate_server_get(provider), response, NULL, NULL,

        oidc_cfg_http_timeout_short_get(cfg), oidc_cfg_outgoing_proxy_get(cfg),

        oidc_cfg_dir_pass_cookies_get(r),

        oidc_cfg_provider_token_endpoint_tls_client_cert_get(provider),

        oidc_cfg_provider_token_endpoint_tls_client_key_get(provider),

        oidc_cfg_provider_token_endpoint_tls_client_key_pwd_get(provider)) == FALSE) {

    OIDC_METRICS_COUNTER_INC(r, cfg, OM_PROVIDER_REGISTRATION_ERROR);

    oidc_json_decref(data);

    return FALSE;

  }

  oidc_json_decref(data);

  /* decode and see if it is not an error response somehow */

  if (oidc_json_decode_and_check_error(r, *response, j_client) == FALSE) {

    OIDC_METRICS_COUNTER_INC(r, cfg, OM_PROVIDER_REGISTRATION_ERROR);

    oidc_error(r, "JSON parsing of dynamic client registration response failed");

    return FALSE;

  }

  return TRUE;

}

/*

 * see if we have client metadata and check its validity

 * if not, use OpenID Connect Client Registration to get it, check it and store it

 */

apr_byte_t oidc_metadata_client_get(request_rec *r, oidc_cfg_t *cfg, const char *issuer,

            const oidc_provider_t *provider, oidc_json_t **j_client) {

  /* get the full file path to the client metadata for this issuer */

  const char *client_path = oidc_metadata_client_file_path(r, issuer);

  /* if we have valid client metadata already, return it */

  if (oidc_metadata_file_read_json(r, client_path, j_client) == TRUE) {

    if (oidc_metadata_client_is_valid(r, *j_client, issuer) == TRUE)

      return TRUE;

    /* stale/invalid on-disk metadata: release it before re-registering overwrites *j_client */

    oidc_json_decref(*j_client);

    *j_client = NULL;

  }

  /* at this point we have no valid client metadata, see if there's a registration endpoint for this provider */

  if (oidc_cfg_provider_registration_endpoint_url_get(provider) == NULL) {

    oidc_error(r,

         "no (valid) client metadata exists for provider (%s) and provider JSON object did not "

         "contain a (valid) \"" OIDC_METADATA_REGISTRATION_ENDPOINT "\" string",

         issuer);

    return FALSE;

  }

  /* try and get client metadata by registering the client at the registration endpoint */

  char *response = NULL;

  if (oidc_metadata_client_register(r, cfg, provider, j_client, &response) == FALSE)

    return FALSE;

  /* check to see if it is valid metadata */

  if (oidc_metadata_client_is_valid(r, *j_client, issuer) == FALSE)

    return FALSE;

  /* since it is valid, write the obtained client metadata file */

  if (oidc_util_file_write(r, client_path, response) == FALSE)

    return FALSE;

  return TRUE;

}

/*

 * override the provider token endpoint auth method when the client metadata specifies one

 */

static void oidc_metadata_client_parse_token_endpoint_auth(request_rec *r, const oidc_cfg_t *cfg,

                 const oidc_json_t *j_client, oidc_provider_t *provider) {

  char *value = NULL;

  oidc_json_object_get_string(r->pool, j_client, OIDC_METADATA_TOKEN_ENDPOINT_AUTH_METHOD, &value, NULL);

  if (value == NULL)

    return;

  const char *rv = oidc_cfg_provider_token_endpoint_auth_set(r->pool, cfg, provider, value);

  if (rv != NULL)

    oidc_error(r, "oidc_provider_token_endpoint_auth_set: %s", value);

}

/*

 * determine the provider response_type when not already set by .conf: default from the global config,

 * then fall back to the first entry of the client metadata "response_types" array if the configured

 * one is not advertised as supported

 */

static void oidc_metadata_client_parse_response_type(request_rec *r, oidc_cfg_t *cfg, const oidc_json_t *j_client,

                 oidc_provider_t *provider) {

  const char *value = NULL;

  if (oidc_cfg_provider_response_type_is_set(provider))

    return;

  oidc_cfg_provider_response_type_set(r->pool, provider,

              oidc_cfg_provider_response_type_get(oidc_cfg_provider_get(cfg)));

  // "response_types" is an array in the client metadata as by spec

  const oidc_json_t *j_response_types = oidc_json_object_get(j_client, OIDC_METADATA_RESPONSE_TYPES);

  if ((j_response_types == NULL) || (!oidc_json_is_array(j_response_types)))

    return;

  // if there's an array we'll prefer the configured response_type if supported

  if (oidc_json_array_has_value(r, j_response_types, oidc_cfg_provider_response_type_get(provider)) == TRUE)

    return;

  // if the configured response_type is not supported, we'll fallback to the first one that is listed

  const oidc_json_t *j_response_type = oidc_json_array_get(j_response_types, 0);

  if (oidc_json_is_string(j_response_type)) {

    value = apr_pstrdup(r->pool, oidc_json_string_value(j_response_type));

    OIDC_METADATA_PROVIDER_SET(response_type, value);

  }

}

/*

 * parse the JSON client metadata in to a oidc_provider_t struct

 */

apr_byte_t oidc_metadata_client_parse(request_rec *r, oidc_cfg_t *cfg, const oidc_json_t *j_client,

              oidc_provider_t *provider) {

  char *value = NULL;

  /* get a handle to the client_id we need to use for this provider */

  oidc_json_object_get_string(r->pool, j_client, OIDC_METADATA_CLIENT_ID, &value, NULL);

  OIDC_METADATA_PROVIDER_SET(client_id, value);

  /* get a handle to the client_secret we need to use for this provider */

  oidc_json_object_get_string(r->pool, j_client, OIDC_METADATA_CLIENT_SECRET, &value, NULL);

  OIDC_METADATA_PROVIDER_SET(client_secret, value);

  /* see if the token endpoint auth method defined in the client metadata overrides the provider one */

  oidc_metadata_client_parse_token_endpoint_auth(r, cfg, j_client, provider);

  /* determine the response type if not set by .conf */

  oidc_metadata_client_parse_response_type(r, cfg, j_client, provider);

  oidc_json_object_get_string(r->pool, j_client, OIDC_METADATA_ID_TOKEN_SIGNED_RESPONSE_ALG, &value,

            oidc_cfg_provider_id_token_signed_response_alg_get(oidc_cfg_provider_get(cfg)));

  OIDC_METADATA_PROVIDER_SET(id_token_signed_response_alg, value);

  // NB: id_token_encrypted_response_alg and the other encryption-related client metadata are not parsed here

  return TRUE;

}