/**
    * This file Copyright (c) 2016 Magnolia International
    * Ltd.  (http://www.magnolia-cms.com). All rights reserved.
    *
    *
    * This file is dual-licensed under both the Magnolia
    * Network Agreement and the GNU General Public License.
    * You may elect to use one or the other of these licenses.
    *
   * This file is distributed in the hope that it will be
   * useful, but AS-IS and WITHOUT ANY WARRANTY; without even the
   * implied warranty of MERCHANTABILITY or FITNESS FOR A
   * PARTICULAR PURPOSE, TITLE, or NONINFRINGEMENT.
   * Redistribution, except as permitted by whichever of the GPL
   * or MNA you select, is prohibited.
   *
   * 1. For the GPL license (GPL), you can redistribute and/or
   * modify this file under the terms of the GNU General
   * Public License, Version 3, as published by the Free Software
   * Foundation.  You should have received a copy of the GNU
   * General Public License, Version 3 along with this program;
   * if not, write to the Free Software Foundation, Inc., 51
   * Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
   *
   * 2. For the Magnolia Network Agreement (MNA), this file
   * and the accompanying materials are made available under the
   * terms of the MNA which accompanies this distribution, and
   * is available at http://www.magnolia-cms.com/mna.html
   *
   * Any modifications to this file must keep this entire header
   * intact.
   *
   */
  package info.magnolia.cms.security.auth.login;
  
  import info.magnolia.cms.security.SecuritySupportBase;
  import info.magnolia.cms.security.auth.callback.CredentialsCallbackHandler;
  import info.magnolia.cms.security.auth.callback.PlainTextCallbackHandler;
  
  import java.nio.charset.StandardCharsets;
  import java.util.Set;
  
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  
  import org.apache.commons.lang3.StringUtils;
  import org.apache.http.NameValuePair;
  import org.apache.http.client.utils.URLEncodedUtils;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  import com.google.common.collect.ImmutableSet;
  
  /**
   * Uses the the {@value #PARAMETER_USER_ID} and  {@value #PARAMETER_PSWD} parameters to login.
   */
  public class FormLogin extends LoginHandlerBase implements LoginHandler {
  
      private static final Logger log = LoggerFactory.getLogger(FormLogin.class);
  
      public static final String PARAMETER_USER_ID = "mgnlUserId";
  
      public static final String PARAMETER_PSWD = "mgnlUserPSWD";
  
      public static final String PARAMETER_REALM = "mgnlRealm";
  
      public static final String PARAMETER_RETURN_TO = "mgnlReturnTo";
  
      public static final Set<String> AUTHENTICATION_ATTRIBUTES = ImmutableSet.of(PARAMETER_USER_ID, PARAMETER_REALM, PARAMETER_PSWD);
  
      /**
       * The JAAS chain/module to use.
       */
      private String jaasChain = SecuritySupportBase.DEFAULT_JAAS_LOGIN_CHAIN;
  
      @Override
      public LoginResult handle(HttpServletRequest request, HttpServletResponse response) {
          String userid = request.getParameter(PARAMETER_USER_ID);
          log.debug("handle login for {}", userid);
          if (StringUtils.isNotEmpty(userid)) {
              String pswd = StringUtils.defaultString(request.getParameter(PARAMETER_PSWD));
              String realm = StringUtils.defaultString(request.getParameter(PARAMETER_REALM));
  
              CredentialsCallbackHandler callbackHandler = new PlainTextCallbackHandler(userid, pswd.toCharArray(), realm);
              LoginResult result = authenticate(callbackHandler, getJaasChain());
  
              if (result.getStatus() == LoginResult.STATUS_SUCCEEDED && requiresRedirect(request)) {
                  return new LoginResult(LoginResult.STATUS_SUCCEEDED_REDIRECT_REQUIRED, result.getSubject());
              }
              return result;
          }
          return LoginResult.NOT_HANDLED;
      }
  
      /**
       * We can assume that a redirect is needed in case the following criteria is met:
       * <ul>
       * <li>We are dealing with a {@code POST} http request</li>
       * <li>Request query string does not contain any of the authentication parameters, because otherwise
      * we are probably dealing with e.g. some <i>XHR</i> (e.g. a <i>Vaadin</i> request in <i>AdminCentral</i> web-app) and
      * authentication was triggered just because the attributes leaked into the request's attribute map
      * via query string => demanding redirect in such case only might cause some damage.
      * </li>
      * </ul>
      */
     protected boolean requiresRedirect(HttpServletRequest request) {
         if (!request.getMethod().equalsIgnoreCase("POST")) {
             return false;
         }
 
         for (final NameValuePair queryParameter : URLEncodedUtils.parse(request.getQueryString(), StandardCharsets.UTF_8)) {
             if (AUTHENTICATION_ATTRIBUTES.contains(queryParameter.getName())) {
                 return false;
             }
         }
 
         return true;
     }
 
     public String getJaasChain() {
         return this.jaasChain;
     }
 
 
     public void setJaasChain(String jaasChain) {
         this.jaasChain = jaasChain;
     }
 
 }