// Copyright 2023 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "chromeos/ash/components/osauth/impl/cryptohome_core_impl.h"

#include <memory>
#include <optional>
#include <utility>

#include "base/check.h"
#include "base/check_op.h"
#include "base/functional/bind.h"
#include "base/logging.h"
#include "base/task/sequenced_task_runner.h"
#include "chromeos/ash/components/dbus/userdataauth/userdataauth_client.h"
#include "chromeos/ash/components/login/auth/auth_factor_editor.h"
#include "chromeos/ash/components/login/auth/auth_performer.h"
#include "chromeos/ash/components/login/auth/public/auth_session_intent.h"
#include "chromeos/ash/components/login/auth/public/authentication_error.h"
#include "chromeos/ash/components/login/auth/public/user_context.h"
#include "chromeos/ash/components/osauth/public/auth_session_storage.h"
#include "chromeos/ash/components/osauth/public/common_types.h"
#include "components/user_manager/user_manager.h"

namespace ash {

namespace {

AuthSessionIntent MapPurposeToIntent(AuthPurpose purpose) {
  switch (purpose) {
    case AuthPurpose::kLogin:
    case AuthPurpose::kAuthSettings:
      return AuthSessionIntent::kDecrypt;
    case AuthPurpose::kWebAuthN:
      return AuthSessionIntent::kWebAuthn;
    case AuthPurpose::kUserVerification:
    case AuthPurpose::kScreenUnlock:
      return AuthSessionIntent::kVerifyOnly;
  }
}

}  // namespace

CryptohomeCoreImpl::CryptohomeCoreImpl(UserDataAuthClient* client)
    : dbus_client_(client),
      performer_(std::make_unique<AuthPerformer>(dbus_client_)),
      editor_(std::make_unique<AuthFactorEditor>(dbus_client_)) {}

CryptohomeCoreImpl::~CryptohomeCoreImpl() = default;

void CryptohomeCoreImpl::WaitForService(ServiceAvailabilityCallback callback) {
  dbus_client_->WaitForServiceToBeAvailable(
      base::BindOnce(&CryptohomeCoreImpl::OnServiceStatus,
                     weak_factory_.GetWeakPtr(), std::move(callback)));
}

void CryptohomeCoreImpl::OnServiceStatus(ServiceAvailabilityCallback callback,
                                         bool service_is_available) {
  std::move(callback).Run(service_is_available);
}

void CryptohomeCoreImpl::StartAuthSession(const AuthAttemptVector& attempt,
                                          Client* client) {
  if (current_attempt_.has_value()) {
    CHECK(attempt == *current_attempt_)
        << "Cryptohome core does not support parallel attempts";
  } else {
    current_attempt_ = attempt;
    was_authenticated_ = false;
    performer_->InvalidateCurrentAttempts();
  }
  DCHECK(!clients_.contains(client));

  if (current_stage_ == Stage::kAuthSessionRequested ||
      current_stage_ == Stage::kAuthFactorConfigurationRequested) {
    // All events would be sent in OnGetAuthFactorsConfiguration.
    clients_.insert(client);
    return;
  }

  if (current_stage_ == Stage::kFinished) {
    if (auth_session_started_) {
      clients_.insert(client);
      client->OnCryptohomeAuthSessionStarted();
    } else {
      client->OnAuthSessionStartFailure();
    }
    return;
  }

  CHECK_EQ(current_stage_, Stage::kIdle);
  current_stage_ = Stage::kAuthSessionRequested;
  CHECK(!auth_session_started_);

  clients_.insert(client);

  const user_manager::User* user =
      user_manager::UserManager::Get()->FindUser(attempt.account);
  CHECK(user) << "Cryptohome core should only be used for existing users";
  context_ = std::make_unique<UserContext>(user->GetType(), attempt.account);
  bool ephemeral = user_manager::UserManager::Get()->IsEphemeralUser(user);

  performer_->StartAuthSession(
      std::move(context_), ephemeral, MapPurposeToIntent(attempt.purpose),
      base::BindOnce(&CryptohomeCoreImpl::OnAuthSessionStarted,
                     weak_factory_.GetWeakPtr()));
}

void CryptohomeCoreImpl::OnAuthSessionStarted(
    bool user_exists,
    std::unique_ptr<UserContext> context,
    std::optional<AuthenticationError> error) {
  CHECK_EQ(current_stage_, Stage::kAuthSessionRequested);
  current_stage_ = Stage::kAuthFactorConfigurationRequested;
  if (!user_exists) {
    // Somehow user home directory does not exist.
    LOG(ERROR) << "Cryptohome Core: user does not exist";
    for (auto& client : clients_) {
      client->OnAuthSessionStartFailure();
    }
    clients_.clear();
    return;
  }

  if (error.has_value()) {
    // Error is already logged by Authenticator.
    for (auto& client : clients_) {
      client->OnAuthSessionStartFailure();
    }
    clients_.clear();
    return;
  }

  // Next step after starting the session is to load the factor configuration.
  editor_->GetAuthFactorsConfiguration(
      std::move(context),
      base::BindOnce(&CryptohomeCoreImpl::OnGetAuthFactorsConfiguration,
                     weak_factory_.GetWeakPtr()));
}

void CryptohomeCoreImpl::OnGetAuthFactorsConfiguration(
    std::unique_ptr<UserContext> context,
    std::optional<AuthenticationError> error) {
  CHECK_EQ(current_stage_, Stage::kAuthFactorConfigurationRequested);
  current_stage_ = Stage::kFinished;
  if (error.has_value()) {
    // Error is already logged by Authenticator.
    for (auto& client : clients_) {
      client->OnAuthSessionStartFailure();
    }
    clients_.clear();
    return;
  }

  // Everything is now fully started and loaded, signal all the clients.
  context_ = std::move(context);
  auth_session_started_ = true;
  for (auto& client : clients_) {
    client->OnCryptohomeAuthSessionStarted();
  }
}

void CryptohomeCoreImpl::EndAuthSession(Client* client) {
  DCHECK(clients_.contains(client));
  DCHECK(!clients_being_removed_.contains(client));
  clients_.erase(client);
  clients_being_removed_.insert(client);
  if (!clients_.empty()) {
    // Wait for all clients to issue EndAuthSession.
    return;
  }

  CHECK_NE(current_stage_, Stage::kIdle);
  if (current_stage_ == Stage::kAuthSessionRequested) {
    performer_->InvalidateCurrentAttempts();
  }
  current_stage_ = Stage::kIdle;
  auth_session_started_ = false;
  if (context_) {
    performer_->InvalidateAuthSession(
        std::move(context_),
        base::BindOnce(&CryptohomeCoreImpl::OnInvalidateAuthSession,
                       weak_factory_.GetWeakPtr()));
    return;
  }
  // We should have no context only when session is authorized and
  // one of the clients requested `StoreAuthenticatedContext`.
  CHECK(was_authenticated_);
  EndAuthSessionImpl();
}

void CryptohomeCoreImpl::OnInvalidateAuthSession(
    std::unique_ptr<UserContext> context,
    std::optional<AuthenticationError> error) {
  if (error.has_value()) {
    LOG(ERROR) << "Error during authsession invalidation";
  }
  EndAuthSessionImpl();
}

void CryptohomeCoreImpl::EndAuthSessionImpl() {
  // Remove elements as we go, as calling
  // `OnCryptohomeAuthSessionFinished` might result
  // in engines being deleted and raw_ptr becoming
  // dangling.
  while (!clients_being_removed_.empty()) {
    auto it = clients_being_removed_.begin();
    Client* client = it->get();
    clients_being_removed_.erase(it);
    client->OnCryptohomeAuthSessionFinished();
  }
  CHECK(clients_being_removed_.empty());
  CHECK(clients_.empty());
  current_attempt_ = std::nullopt;
  was_authenticated_ = false;
}

AuthPerformer* CryptohomeCoreImpl::GetAuthPerformer() const {
  CHECK(performer_);
  return performer_.get();
}

UserContext* CryptohomeCoreImpl::GetCurrentContext() const {
  CHECK(context_);
  return context_.get();
}

AuthProofToken CryptohomeCoreImpl::StoreAuthenticationContext() {
  CHECK(context_);
  was_authenticated_ = true;
  return AuthSessionStorage::Get()->Store(std::move(context_));
}

void CryptohomeCoreImpl::BorrowContext(BorrowContextCallback callback) {
  if (!context_) {
    borrow_callback_queue_.emplace(std::move(callback));
    return;
  }
  BorrowContextAndRun(std::move(callback));
  return;
}

void CryptohomeCoreImpl::ReturnContext(std::unique_ptr<UserContext> context) {
  CHECK(!context_);
  context_ = std::move(context);
  if (!borrow_callback_queue_.empty()) {
    auto callback = std::move(borrow_callback_queue_.front());
    borrow_callback_queue_.pop();
    BorrowContextAndRun(std::move(callback));
    return;
  }
}

void CryptohomeCoreImpl::BorrowContextAndRun(BorrowContextCallback callback) {
  CHECK(context_);
  base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
      FROM_HERE, base::BindOnce(std::move(callback), std::move(context_)));
}

}  // namespace ash