/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
package org.apache.shindig.gadgets.servlet;

import com.google.inject.Inject;
import com.google.inject.name.Named;

import org.apache.shindig.common.crypto.BlobCrypter;
import org.apache.shindig.common.servlet.HttpUtil;
import org.apache.shindig.common.servlet.InjectedServlet;
import org.apache.shindig.common.uri.UriBuilder;
import org.apache.shindig.gadgets.oauth.OAuthCallbackState;
import org.apache.shindig.gadgets.oauth.OAuthFetcherConfig;

import java.io.IOException;
import java.util.List;
import java.util.Map;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * Servlet to act as our OAuth callback URL.  When gadget authors register a consumer key with an
 * OAuth service provider, they can provide a URL pointing to this servlet as their callback URL.
 *
 * Protocol flow:
 * - gadget discovers it needs approval to access data at OAuth SP.
 * - gadget opens popup window to approval URL, passing URL to this servlet as the oauth_callback
 *   parameter on the approval URL.
 * - user grants approval at service provider
 * - service provider redirects to this servlet
 * - this servlet closes the window
 * - gadget discovers the window has closed and automatically fetches the user's data.
 */
public class OAuthCallbackServlet extends InjectedServlet {

  private static final long serialVersionUID = 7126255229334669172L;
  
  public static final String CALLBACK_STATE_PARAM = "cs";
  public static final String REAL_DOMAIN_PARAM = "d";
  private static final int ONE_HOUR_IN_SECONDS = 3600;
  
  // This bit of magic passes the entire callback URL into the opening gadget for later use.
  // gadgets.io.makeRequest (or osapi.oauth) will then pick up the callback URL to complete the
  // oauth dance.
  private static final String RESP_BODY =
    "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" " +
    "\"http://www.w3.org/TR/html4/loose.dtd\">\n" +
    "<html>\n" +
    "<head>\n" +
    "<title>Close this window</title>\n" +
    "</head>\n" +
    "<body>\n" +
    "<script type='text/javascript'>\n" +
    "try {\n" +
    "  window.opener.gadgets.io.oauthReceivedCallbackUrl_ = document.location.href;\n" +
    "} catch (e) {\n" +
    "}\n" +
    "window.close();\n" +
    "</script>\n" +
    "Close this window.\n" +
    "</body>\n" +
    "</html>\n";

  private transient BlobCrypter stateCrypter;

  @Inject
  public void setStateCrypter(@Named(OAuthFetcherConfig.OAUTH_STATE_CRYPTER) BlobCrypter stateCrypter) {
    checkInitialized();
    this.stateCrypter = stateCrypter;
  }

  @Override
  protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
    OAuthCallbackState callbackState = new OAuthCallbackState(stateCrypter,
        req.getParameter(CALLBACK_STATE_PARAM));
    if (callbackState.getRealCallbackUrl() != null) {
      // Copy the query parameters from this URL over to the real URL.
      UriBuilder realUri = UriBuilder.parse(callbackState.getRealCallbackUrl());
      Map<String, List<String>> params = UriBuilder.splitParameters(req.getQueryString());
      for (Map.Entry<String, List<String>> entry : params.entrySet()) {
        realUri.putQueryParameter(entry.getKey(), entry.getValue());
      }
      realUri.removeQueryParameter(CALLBACK_STATE_PARAM);
      HttpUtil.setCachingHeaders(resp, ONE_HOUR_IN_SECONDS, true);
      resp.sendRedirect(realUri.toString());
      return;
    }
    HttpUtil.setCachingHeaders(resp, ONE_HOUR_IN_SECONDS, true);
    resp.setContentType("text/html; charset=UTF-8");
    resp.getWriter().write(RESP_BODY);
  }
}