/*

 * Licensed to the Apache Software Foundation (ASF) under one

 * or more contributor license agreements.  See the NOTICE file

 * distributed with this work for additional information

 * regarding copyright ownership.  The ASF licenses this file

 * to you under the Apache License, Version 2.0 (the

 * "License"); you may not use this file except in compliance

 * with the License.  You may obtain a copy of the License at

 *

 *   http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing,

 * software distributed under the License is distributed on an

 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

 * KIND, either express or implied.  See the License for the

 * specific language governing permissions and limitations

 * under the License.

 */

/***************************************************************************

 * Copyright (C) 2017-2026 ZmartZone Holding BV

 * All rights reserved.

 *

 * DISCLAIMER OF WARRANTIES:

 *

 * THE SOFTWARE PROVIDED HEREUNDER IS PROVIDED ON AN "AS IS" BASIS, WITHOUT

 * ANY WARRANTIES OR REPRESENTATIONS EXPRESS, IMPLIED OR STATUTORY; INCLUDING,

 * WITHOUT LIMITATION, WARRANTIES OF QUALITY, PERFORMANCE, NONINFRINGEMENT,

 * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.  NOR ARE THERE ANY

 * WARRANTIES CREATED BY A COURSE OR DEALING, COURSE OF PERFORMANCE OR TRADE

 * USAGE.  FURTHERMORE, THERE ARE NO WARRANTIES THAT THE SOFTWARE WILL MEET

 * YOUR NEEDS OR BE FREE FROM ERRORS, OR THAT THE OPERATION OF THE SOFTWARE

 * WILL BE UNINTERRUPTED.  IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR

 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES HOWEVER CAUSED AND ON ANY THEORY OF

 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 *

 * @Author: Hans Zandbelt - hans.zandbelt@openidc.com

 */

#include "handle/handle.h"

#include "mod_auth_openidc.h"

#include "proto/proto.h"

#include "util/util.h"

#include <ap_mmn.h>

#define OIDC_DPOP_PARAM_URL "url"

#define OIDC_DPOP_PARAM_NONCE "nonce"

#define OIDC_DPOP_PARAM_METHOD "method"

int oidc_dpop_request(request_rec *r, const oidc_cfg_t *c) {

  int rc = HTTP_BAD_REQUEST;

  char *s_url = NULL;

  char *s_access_token = NULL;

  char *s_nonce = NULL;

  char *s_method = NULL;

  char *s_dpop = NULL;

  const char *s_response = NULL;

  oidc_json_t *json = NULL;

  char *remote_ip = NULL;

#if AP_MODULE_MAGIC_AT_LEAST(20111130, 0)

  remote_ip = r->useragent_ip;

#else

  remote_ip = r->connection->remote_ip;

#endif

  if (!oidc_cfg_dpop_api_enabled_get(c)) {

    oidc_error(r, "DPoP hook called but the DPoP API is not enabled in %s", OIDCDPoPMode);

    goto end;

  }

  /* try to make sure that the proof-of-possession semantics are preserved */

  if ((_oidc_strnatcasecmp(remote_ip, r->connection->local_ip) != 0) &&

      (apr_table_get(r->subprocess_env, "OIDC_DPOP_API_INSECURE") == 0)) {

    oidc_warn(

        r,

        "reject DPoP creation request from remote host: you should create a separate virtual (sub)host "

        "that requires client certificate authentication to allow and proxy this request (remote_ip=%s, "

        "r->connection->local_ip=%s)",

        remote_ip, r->connection->local_ip);

    rc = HTTP_UNAUTHORIZED;

    goto end;

  }

  /* retrieve the access token parameter */

  oidc_util_url_parameter_get(r, OIDC_REDIRECT_URI_REQUEST_DPOP, &s_access_token);

  if (s_access_token == NULL) {

    oidc_error(r, "\"access_token\" value to the \"%s\" parameter is missing",

         OIDC_REDIRECT_URI_REQUEST_DPOP);

    goto end;

  }

  /* retrieve the URL parameter */

  oidc_util_url_parameter_get(r, OIDC_DPOP_PARAM_URL, &s_url);

  if (s_url == NULL) {

    oidc_error(r, "\"url\" parameter is missing");

    goto end;

  }

  /* retrieve the optional nonce parameter */

  oidc_util_url_parameter_get(r, OIDC_DPOP_PARAM_NONCE, &s_nonce);

  /* parse the optional HTTP method parameter */

  oidc_util_url_parameter_get(r, OIDC_DPOP_PARAM_METHOD, &s_method);

  if (_oidc_strnatcasecmp(s_method, "post") == 0)

    s_method = "POST";

  else if ((_oidc_strnatcasecmp(s_method, "get") == 0) || (s_method == NULL))

    s_method = "GET";

  /* create the DPoP header value */

  if ((oidc_proto_dpop_create(r, c, s_url, s_method, s_access_token, s_nonce, &s_dpop) == FALSE) ||

      (s_dpop == NULL)) {

    oidc_error(r, "creating the DPoP proof value failed");

    rc = HTTP_INTERNAL_SERVER_ERROR;

    goto end;

  }

  /* assemble and serialize the JSON response object */

  json = oidc_json_object();

  oidc_json_object_set_new(json, OIDC_HTTP_HDR_DPOP, oidc_json_string(s_dpop));

  s_response = oidc_json_encode(r->pool, json, OIDC_JSON_COMPACT | OIDC_JSON_PRESERVE_ORDER);

  /* return the serialized JSON response */

  rc = oidc_util_http_send(r, s_response, _oidc_strlen(s_response), OIDC_HTTP_CONTENT_TYPE_JSON, OK);

end:

  if (json)

    oidc_json_decref(json);

  return rc;

}