/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.apache.camel.util;

import java.util.ArrayList;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Locale;
import java.util.Map;
import java.util.Set;
import java.util.function.BiPredicate;
import java.util.function.UnaryOperator;

/**
 * Utility for detecting insecure configuration options.
 * <p>
 * The security options map is generated by camel build tools from {@code @Metadata(security=...)} and
 * {@code @UriParam(security=...)} annotations.
 *
 * @since 4.19.0
 */
public final class SecurityUtils {

    public static final String INSECURE_SSL = "insecure:ssl";
    public static final String INSECURE_SERIALIZATION = "insecure:serialization";
    public static final String INSECURE_DEV = "insecure:dev";

    private static final String VALUE_FALSE = "false";

    /**
     * Information about a security-sensitive configuration option.
     *
     * @param category      the security category (e.g., "insecure:ssl", "insecure:serialization", "insecure:dev")
     * @param insecureValue the value that makes this option insecure (e.g., "true" for boolean flags)
     */
    public record SecurityOption(String category, String insecureValue) {
    }

    private static final Map<String, SecurityOption> SECURITY_OPTIONS;

    static {
        Map<String, SecurityOption> map = new HashMap<>();
        // Generated by camel build tools - do NOT edit this map!
        // SECURITY-OPTIONS: START
        map.put("allowjavaserializedobject", new SecurityOption(INSECURE_SERIALIZATION, "true"));
        map.put("allowlocalwebhookurls", new SecurityOption(INSECURE_DEV, "true"));
        map.put("allowserializedheaders", new SecurityOption(INSECURE_SERIALIZATION, "true"));
        map.put("devconsoleenabled", new SecurityOption(INSECURE_DEV, "true"));
        map.put("downloadenabled", new SecurityOption(INSECURE_DEV, "true"));
        map.put("hostnameverification", new SecurityOption(INSECURE_SSL, VALUE_FALSE));
        map.put("httpshostnameverificationenabled", new SecurityOption(INSECURE_SSL, VALUE_FALSE));
        map.put("ignoresslverification", new SecurityOption(INSECURE_SSL, "true"));
        map.put("objectmessageenabled", new SecurityOption(INSECURE_SERIALIZATION, "true"));
        map.put("sendenabled", new SecurityOption(INSECURE_DEV, "true"));
        map.put("skiptlsverify", new SecurityOption(INSECURE_SSL, "true"));
        map.put("stricthostkeychecking", new SecurityOption(INSECURE_SSL, ""));
        map.put("transferexception", new SecurityOption(INSECURE_SERIALIZATION, "true"));
        map.put("transferexchange", new SecurityOption(INSECURE_SERIALIZATION, "true"));
        map.put("trustallcertificates", new SecurityOption(INSECURE_SSL, "true"));
        map.put("trustallpackages", new SecurityOption(INSECURE_SERIALIZATION, "true"));
        map.put("uploadenabled", new SecurityOption(INSECURE_DEV, "true"));
        map.put("usejavamailsessionpropertiesfromheaders", new SecurityOption(INSECURE_SSL, "true"));
        map.put("validateauth", new SecurityOption(INSECURE_DEV, VALUE_FALSE));
        map.put("validatecertificates", new SecurityOption(INSECURE_SSL, VALUE_FALSE));
        map.put("x509hostnameverifier", new SecurityOption(INSECURE_SSL, ""));
        // SECURITY-OPTIONS: END
        SECURITY_OPTIONS = Collections.unmodifiableMap(map);
    }

    private SecurityUtils() {
    }

    /**
     * All the security options (unmodifiable)
     */
    public static Map<String, SecurityOption> getSecurityOptions() {
        return SECURITY_OPTIONS;
    }

    /**
     * Get security information for a configuration property.
     *
     * @param  text the configuration property key (e.g., "camel.component.http.trustAllCertificates")
     * @return      the security option info, or null if the property has no security category
     */
    public static SecurityOption getSecurityOption(String text) {
        int lastPeriod = text.lastIndexOf('.');
        if (lastPeriod >= 0) {
            text = text.substring(lastPeriod + 1);
        }
        text = text.toLowerCase(Locale.ENGLISH);
        text = text.replace("-", "");
        return SECURITY_OPTIONS.get(text);
    }

    /**
     * Whether the given configuration property value is the insecure value for the property.
     *
     * @param  text  the configuration property key
     * @param  value the property value
     * @return       true if the value is the insecure value for this property, false otherwise
     */
    public static boolean isInsecureValue(String text, Object value) {
        SecurityOption option = getSecurityOption(text);
        if (option == null) {
            return false;
        }
        return String.valueOf(value).equalsIgnoreCase(option.insecureValue());
    }

    /**
     * Whether the given property value appears to be a plain-text secret (not using vault, env var, or system property
     * placeholders).
     *
     * @param  value the property value to check
     * @return       true if the value is plain text (not secured via a placeholder mechanism)
     */
    public static boolean isPlainTextSecret(Object value) {
        if (value == null) {
            return false;
        }
        String v = value.toString();
        if (v.isEmpty()) {
            return false;
        }
        // check for known secure value patterns
        // note: RAW() is a URI encoding wrapper, not a security mechanism — RAW(password) is still plain text
        if (v.startsWith("{{") && v.contains("vault:")) {
            return false;
        }
        if (v.startsWith("${env:") || v.startsWith("${ENV:")) {
            return false;
        }
        if (v.startsWith("${sys:") || v.startsWith("${SYS:")) {
            return false;
        }
        // property placeholder - could be pointing to a secure source
        return !(v.startsWith("{{") && v.endsWith("}}"));
    }

    /**
     * Detect security policy violations in a set of configuration properties.
     * <p>
     * This method checks for both plain-text secrets and insecure configuration options based on the security options
     * map and the provided policy resolver.
     *
     * @param  properties     map of property key → value pairs to check
     * @param  secretDetector predicate that returns true if a property key+value pair represents a sensitive secret
     * @param  policyResolver function that resolves the effective policy ("allow", "warn", "fail") for a given security
     *                        category
     * @param  allowedKeys    set of property keys to skip (allowed explicitly by the user)
     * @return                list of violations found (may be empty)
     */
    public static List<SecurityViolation> detectViolations(
            Map<String, Object> properties,
            BiPredicate<String, Object> secretDetector,
            UnaryOperator<String> policyResolver,
            Set<String> allowedKeys) {

        List<SecurityViolation> violations = new ArrayList<>();

        for (Map.Entry<String, Object> entry : properties.entrySet()) {
            String k = entry.getKey();
            Object v = entry.getValue();

            if (shouldSkip(k, allowedKeys)) {
                continue;
            }

            checkPlainTextSecret(k, v, secretDetector, policyResolver, violations);
            checkInsecureOption(k, v, policyResolver, violations);
        }

        return violations;
    }

    private static boolean shouldSkip(String key, Set<String> allowedKeys) {
        return key.startsWith("camel.security.")
                || (allowedKeys != null && allowedKeys.contains(key));
    }

    private static void checkPlainTextSecret(
            String key, Object value,
            BiPredicate<String, Object> secretDetector,
            UnaryOperator<String> policyResolver,
            List<SecurityViolation> violations) {

        if (secretDetector.test(key, value) && isPlainTextSecret(value)) {
            String effectivePolicy = policyResolver.apply("secret");
            if (!"allow".equals(effectivePolicy)) {
                violations.add(new SecurityViolation(
                        "secret", key,
                        "Secret property is configured with plain-text value."
                                       + " Consider using {{vault:...}}, ${env:...}, or {{...}} property placeholders",
                        effectivePolicy));
            }
        }
    }

    private static void checkInsecureOption(
            String key, Object value,
            UnaryOperator<String> policyResolver,
            List<SecurityViolation> violations) {

        SecurityOption secOption = getSecurityOption(key);
        if (secOption != null && isInsecureValue(key, value)) {
            String effectivePolicy = policyResolver.apply(secOption.category());
            if (!"allow".equals(effectivePolicy)) {
                violations.add(new SecurityViolation(
                        secOption.category(), key,
                        "Insecure configuration detected (category: " + secOption.category() + ")",
                        effectivePolicy));
            }
        }
    }
}