//-----------------------------------------------------------------------
// <copyright file="SecurityTokenHandlerConfiguration.cs" company="Microsoft">
//     Copyright (c) Microsoft Corporation.  All rights reserved.
// </copyright>
//-----------------------------------------------------------------------

namespace System.IdentityModel.Tokens
{
    using System;
    using System.IdentityModel;
    using System.IdentityModel.Configuration;
    using System.IdentityModel.Selectors;
    using System.Security.Cryptography.X509Certificates;
    using System.ServiceModel.Security;

    /// <summary>
    /// Configuration common to all SecurityTokenHandlers.
    /// </summary>
    public class SecurityTokenHandlerConfiguration
    {
        // 

#pragma warning disable 1591
        /// <summary>
        /// Gets a value indicating whether or not to detect replay tokens by default.
        /// </summary>
        public static readonly bool DefaultDetectReplayedTokens; // false

        /// <summary>
        /// Gets the default issuer name registry.
        /// </summary>
        public static readonly IssuerNameRegistry DefaultIssuerNameRegistry = new ConfigurationBasedIssuerNameRegistry();

        /// <summary>
        /// Gets the default issuer token resolver.
        /// </summary>
        public static readonly SecurityTokenResolver DefaultIssuerTokenResolver = System.IdentityModel.Tokens.IssuerTokenResolver.DefaultInstance;

        /// <summary>
        /// Gets the default maximum clock skew.
        /// </summary>
        public static readonly TimeSpan DefaultMaxClockSkew = new TimeSpan(0, 5, 0); // 5 minutes

        /// <summary>
        /// Gets a value indicating whether or not to save bootstrap tokens by default.
        /// </summary>
        public static readonly bool DefaultSaveBootstrapContext; // false;

        /// <summary>
        /// Gets the default token replay cache expiration period.
        /// </summary>
        public static readonly TimeSpan DefaultTokenReplayCacheExpirationPeriod = TimeSpan.MaxValue;

        // The below 3 defaults were moved from  IdentityConfiguration class as we can not have service configuration in IdentityModel.

        /// <summary>
        /// Gets the default X.509 certificate validation mode.
        /// </summary>
        public static readonly X509CertificateValidationMode DefaultCertificateValidationMode = IdentityConfiguration.DefaultCertificateValidationMode;

        /// <summary>
        /// Gets the default X.509 certificate revocation validation mode.
        /// </summary>
        public static readonly X509RevocationMode DefaultRevocationMode = IdentityConfiguration.DefaultRevocationMode;

        /// <summary>
        /// Gets the default X.509 certificate trusted store location.
        /// </summary>
        public static readonly StoreLocation DefaultTrustedStoreLocation = IdentityConfiguration.DefaultTrustedStoreLocation;

        StoreLocation trustedStoreLocation = DefaultTrustedStoreLocation;
        X509RevocationMode revocationMode = DefaultRevocationMode;
        X509CertificateValidationMode certificateValidationMode = DefaultCertificateValidationMode;

        /// <summary>
        /// Gets the default X.509 certificate validator instance.
        /// </summary>
        public static readonly X509CertificateValidator DefaultCertificateValidator = X509Util.CreateCertificateValidator(DefaultCertificateValidationMode, DefaultRevocationMode, DefaultTrustedStoreLocation);
#pragma warning restore 1591

        private AudienceRestriction audienceRestriction = new AudienceRestriction();
        private X509CertificateValidator certificateValidator = DefaultCertificateValidator;
        private bool detectReplayedTokens = DefaultDetectReplayedTokens;
        private IssuerNameRegistry issuerNameRegistry = DefaultIssuerNameRegistry;
        private SecurityTokenResolver issuerTokenResolver = DefaultIssuerTokenResolver;
        private TimeSpan maxClockSkew = DefaultMaxClockSkew;
        private bool saveBootstrapContext = DefaultSaveBootstrapContext;
        private SecurityTokenResolver serviceTokenResolver = EmptySecurityTokenResolver.Instance;
        private TimeSpan tokenReplayCacheExpirationPeriod = DefaultTokenReplayCacheExpirationPeriod;
        private IdentityModelCaches caches = new IdentityModelCaches();
                
        /// <summary>
        /// Creates an instance of <see cref="SecurityTokenHandlerConfiguration"/>
        /// </summary>
        public SecurityTokenHandlerConfiguration()
        {
        }

        /// <summary>
        /// Gets or sets the AudienceRestriction.
        /// </summary>
        public AudienceRestriction AudienceRestriction
        {
            get
            {
                return this.audienceRestriction;
            }

            set
            {
                if (value == null)
                {
                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("value");
                }

                this.audienceRestriction = value;
            }
        }

        /// <summary>
        /// Gets or sets the certificate validator used by handlers to validate issuer certificates
        /// </summary>
        public X509CertificateValidator CertificateValidator
        {
            get
            {
                return this.certificateValidator;
            }

            set
            {
                if (value == null)
                {
                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("value");
                }

                this.certificateValidator = value;
            }
        }

        public X509RevocationMode RevocationMode
        {
            get { return revocationMode; }
            set { revocationMode = value; }
        }

        /// <summary>
        /// Gets or sets the trusted store location used by handlers to validate issuer certificates
        /// </summary>
        public StoreLocation TrustedStoreLocation
        {
            get { return trustedStoreLocation; }
            set { trustedStoreLocation = value; }
        }

        /// <summary>
        /// Gets or sets the certificate validation mode used by handlers to validate issuer certificates
        /// </summary>
        public X509CertificateValidationMode CertificateValidationMode
        {
            get { return certificateValidationMode; }
            set { certificateValidationMode = value; }
        }
        
        /// <summary>
        /// Gets or sets a value indicating whether to detect replaying of tokens by handlers in this configuration.
        /// </summary>
        public bool DetectReplayedTokens
        {
            get { return this.detectReplayedTokens; }
            set { this.detectReplayedTokens = value; }
        }

        /// <summary>
        /// Gets or sets the IssuerNameRegistry.
        /// </summary>
        public IssuerNameRegistry IssuerNameRegistry
        {
            get 
            {
                return this.issuerNameRegistry; 
            }

            set
            {
                if (value == null)
                {
                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("value");
                }

                this.issuerNameRegistry = value;
            }
        }

        /// <summary>
        /// Gets or sets the IssuerTokenResolver.
        /// </summary>
        public SecurityTokenResolver IssuerTokenResolver
        {
            get 
            {
                return this.issuerTokenResolver; 
            }

            set
            {
                if (value == null)
                {
                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("value");
                }

                this.issuerTokenResolver = value;
            }
        }

        /// <summary>
        /// Gets or sets the maximum clock skew for handlers using this config.
        /// </summary>
        public TimeSpan MaxClockSkew
        {
            get 
            {
                return this.maxClockSkew; 
            }

            set
            {
                if (value < TimeSpan.Zero)
                {
                    throw DiagnosticUtility.ThrowHelperArgumentOutOfRange("value", value, SR.GetString(SR.ID2070));
                }

                this.maxClockSkew = value;
            }
        }

        /// <summary>
        /// Gets or sets a value indicating whether BootstrapContext is saved in the ClaimsIdentity and Sessions after token validation.
        /// </summary>
        public bool SaveBootstrapContext
        {
            get { return this.saveBootstrapContext; }
            set { this.saveBootstrapContext = value; }
        }

        /// <summary>
        /// Gets or sets the TokenResolver that resolves Service tokens.
        /// </summary>
        public SecurityTokenResolver ServiceTokenResolver
        {
            get 
            {
                return this.serviceTokenResolver; 
            }

            set
            {
                if (value == null)
                {
                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("value");
                }

                this.serviceTokenResolver = value;
            }
        }

        /// <summary>
        /// Gets or sets the Caches that are used.
        /// </summary>
        public IdentityModelCaches Caches
        {
            get 
            {
                return this.caches; 
            }

            set
            {
                if (value == null)
                {
                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("value");
                }

                this.caches = value;
            }
        }

        /// <summary>
        /// Gets or sets the expiration period for items placed in the TokenReplayCache.
        /// </summary>
        public TimeSpan TokenReplayCacheExpirationPeriod
        {
            get 
            {
                return this.tokenReplayCacheExpirationPeriod; 
            }

            set
            {
                if (value <= TimeSpan.Zero)
                {
                    throw DiagnosticUtility.ThrowHelperArgumentOutOfRange("value", value, SR.GetString(SR.ID0016));
                }

                this.tokenReplayCacheExpirationPeriod = value;
            }
        }
    }
}