path: root/src/http/mod.rs

use crate::config::Config;
use crate::container::ServiceContainer;
use crate::oauth::{OAuthServer, OAuthService};
use std::collections::HashMap;
use std::fs;
use std::io::prelude::*;
use std::net::{TcpListener, TcpStream};
use std::sync::Arc;
use url::Url;

pub struct Server {
    config: Config,
    oauth_server: Option<OAuthServer>,
    oauth_service: Option<Arc<ServiceContainer>>,
}

impl Server {
    pub fn new(config: Config) -> Result<Server, Box<dyn std::error::Error>> {
        Ok(Server {
            oauth_server: Some(
                OAuthServer::new(&config)
                    .map_err(|e| format!("Failed to create OAuth server: {}", e))?,
            ),
            oauth_service: None,
            config,
        })
    }

    pub fn new_with_container(
        config: Config,
        container: Arc<ServiceContainer>,
    ) -> Result<Server, Box<dyn std::error::Error>> {
        Ok(Server {
            oauth_server: None,
            oauth_service: Some(container),
            config,
        })
    }

    pub fn start(&self) {
        let listener = TcpListener::bind(self.config.bind_addr.clone()).unwrap();
        println!("Listening on {}", self.config.bind_addr);

        for stream in listener.incoming() {
            match stream {
                Ok(stream) => self.handle(stream),
                Err(e) => eprintln!("Error accepting connection: {}", e),
            }
        }
    }

    pub fn handle(&self, mut stream: TcpStream) {
        let mut buffer = [0; 8192];
        let bytes_read = stream.read(&mut buffer).unwrap_or(0);
        let request = String::from_utf8_lossy(&buffer[..bytes_read]);

        let lines: Vec<&str> = request.lines().collect();
        if lines.is_empty() {
            self.send_error_response(&mut stream, 400, "Bad Request");
            return;
        }

        let request_line = lines[0];
        let parts: Vec<&str> = request_line.split_whitespace().collect();

        if parts.len() != 3 {
            self.send_error_response(&mut stream, 400, "Bad Request");
            return;
        }

        let method = parts[0];
        let path_and_query = parts[1];

        let url = match Url::parse(&format!("http://localhost{}", path_and_query)) {
            Ok(url) => url,
            Err(_) => {
                self.send_error_response(&mut stream, 400, "Bad Request");
                return;
            }
        };

        let path = url.path();
        let query_params: HashMap<String, String> = url
            .query_pairs()
            .map(|(k, v)| (k.to_string(), v.to_string()))
            .collect();

        // Extract IP address for audit logging
        let ip_address = stream.peer_addr().ok().map(|addr| addr.ip().to_string());

        match (method, path) {
            ("GET", "/") => self.serve_static_file(&mut stream, "./public/index.html"),
            ("GET", "/.well-known/oauth-authorization-server") => self.handle_metadata(&mut stream),
            ("GET", "/jwks") => self.handle_jwks(&mut stream),
            ("GET", "/authorize") => self.handle_authorize(&mut stream, &query_params, ip_address),
            ("POST", "/token") => self.handle_token(&mut stream, &request, ip_address),
            ("POST", "/introspect") => self.handle_introspect(&mut stream, &request),
            ("POST", "/revoke") => self.handle_revoke(&mut stream, &request),
            _ => self.send_error_response(&mut stream, 404, "Not Found"),
        }
    }

    fn serve_static_file(&self, stream: &mut TcpStream, filename: &str) {
        match fs::read_to_string(filename) {
            Ok(contents) => {
                let content_type = if filename.ends_with(".json") {
                    "application/json"
                } else {
                    "text/html"
                };

                let response = format!(
                    "HTTP/1.1 200 OK\r\nContent-Type: {}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
                    content_type,
                    contents.len(),
                    contents
                );
                let _ = stream.write_all(response.as_bytes());
                let _ = stream.flush();
            }
            Err(_) => self.send_error_response(stream, 404, "Not Found"),
        }
    }

    fn send_error_response(&self, stream: &mut TcpStream, status: u16, message: &str) {
        let response = format!(
            "HTTP/1.1 {} {}\r\nContent-Type: text/plain\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
            status,
            message,
            message.len(),
            message
        );
        let _ = stream.write_all(response.as_bytes());
        let _ = stream.flush();
    }

    fn send_json_response(
        &self,
        stream: &mut TcpStream,
        status: u16,
        status_text: &str,
        json: &str,
    ) {
        let response = format!(
            "HTTP/1.1 {} {}\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
            status,
            status_text,
            json.len(),
            json
        );
        let _ = stream.write_all(response.as_bytes());
        let _ = stream.flush();
    }

    fn send_empty_response(&self, stream: &mut TcpStream, status: u16, status_text: &str) {
        let security_headers = self.get_security_headers();
        let response = format!(
            "HTTP/1.1 {} {}\r\nContent-Length: 0\r\nConnection: close\r\n{}\r\n",
            status, status_text, security_headers
        );
        let _ = stream.write_all(response.as_bytes());
        let _ = stream.flush();
    }

    fn get_security_headers(&self) -> String {
        let cors_origin = if self.config.cors_allowed_origins.contains(&"*".to_string()) {
            "*".to_string()
        } else {
            self.config
                .cors_allowed_origins
                .first()
                .unwrap_or(&"*".to_string())
                .clone()
        };

        format!(
            "Access-Control-Allow-Origin: {}\r\n\
             Access-Control-Allow-Methods: GET, POST, OPTIONS\r\n\
             Access-Control-Allow-Headers: Content-Type, Authorization\r\n\
             X-Content-Type-Options: nosniff\r\n\
             X-Frame-Options: DENY\r\n\
             X-XSS-Protection: 1; mode=block\r\n\
             Strict-Transport-Security: max-age=31536000; includeSubDomains\r\n\
             Content-Security-Policy: default-src 'self'; frame-ancestors 'none'\r\n\
             Referrer-Policy: strict-origin-when-cross-origin",
            cors_origin
        )
    }

    fn handle_metadata(&self, stream: &mut TcpStream) {
        let metadata = serde_json::json!({
            "issuer": self.config.issuer_url,
            "authorization_endpoint": format!("{}/authorize", self.config.issuer_url),
            "token_endpoint": format!("{}/token", self.config.issuer_url),
            "jwks_uri": format!("{}/jwks", self.config.issuer_url),
            "introspection_endpoint": format!("{}/introspect", self.config.issuer_url),
            "revocation_endpoint": format!("{}/revoke", self.config.issuer_url),
            "scopes_supported": ["openid", "profile", "email"],
            "response_types_supported": ["code"],
            "grant_types_supported": ["authorization_code", "refresh_token"],
            "token_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post"],
            "code_challenge_methods_supported": ["plain", "S256"],
            "response_modes_supported": ["query"],
            "subject_types_supported": ["public"],
            "id_token_signing_alg_values_supported": ["RS256"],
            "claims_supported": ["sub", "iss", "aud", "exp", "iat", "scope"],
            "introspection_endpoint_auth_methods_supported": ["client_secret_basic"],
            "revocation_endpoint_auth_methods_supported": ["client_secret_basic"]
        });
        self.send_json_response(stream, 200, "OK", &metadata.to_string());
    }

    fn handle_jwks(&self, stream: &mut TcpStream) {
        let jwks = if let Some(ref oauth_server) = self.oauth_server {
            oauth_server.get_jwks()
        } else if let Some(ref container) = self.oauth_service {
            container.get_jwks()
        } else {
            "{\"keys\":[]}".to_string()
        };
        self.send_json_response(stream, 200, "OK", &jwks);
    }

    fn handle_authorize(
        &self,
        stream: &mut TcpStream,
        params: &HashMap<String, String>,
        ip_address: Option<String>,
    ) {
        let result = if let Some(ref oauth_server) = self.oauth_server {
            oauth_server.handle_authorize(params, ip_address)
        } else if let Some(ref container) = self.oauth_service {
            let oauth_service = OAuthService::new(container.clone());
            oauth_service.handle_authorize(params, ip_address)
        } else {
            Err("{\"error\": \"server_error\", \"error_description\": \"No OAuth service available\"}".to_string())
        };

        match result {
            Ok(redirect_url) => {
                let security_headers = self.get_security_headers();
                let response = format!(
                    "HTTP/1.1 302 Found\r\nLocation: {}\r\nContent-Length: 0\r\nConnection: close\r\n{}\r\n",
                    redirect_url, security_headers
                );
                let _ = stream.write_all(response.as_bytes());
                let _ = stream.flush();
            }
            Err(error_response) => {
                self.send_json_response(stream, 400, "Bad Request", &error_response);
            }
        }
    }

    fn handle_token(&self, stream: &mut TcpStream, request: &str, ip_address: Option<String>) {
        let body = self.extract_body(request);
        let form_params = self.parse_form_data(&body);

        // Extract Authorization header from request
        let auth_header = self.extract_auth_header(request);

        let result = if let Some(ref oauth_server) = self.oauth_server {
            oauth_server.handle_token(&form_params, auth_header.as_deref(), ip_address)
        } else if let Some(ref container) = self.oauth_service {
            let oauth_service = OAuthService::new(container.clone());
            oauth_service.handle_token(&form_params, auth_header.as_deref(), ip_address)
        } else {
            Err("{\"error\": \"server_error\", \"error_description\": \"No OAuth service available\"}".to_string())
        };

        match result {
            Ok(token_response) => {
                self.send_json_response(stream, 200, "OK", &token_response);
            }
            Err(error_response) => {
                self.send_json_response(stream, 400, "Bad Request", &error_response);
            }
        }
    }

    fn handle_introspect(&self, stream: &mut TcpStream, request: &str) {
        let body = self.extract_body(request);
        let form_params = self.parse_form_data(&body);
        let auth_header = self.extract_auth_header(request);

        let result = if let Some(ref oauth_server) = self.oauth_server {
            oauth_server.handle_token_introspection(&form_params, auth_header.as_deref())
        } else if let Some(ref container) = self.oauth_service {
            let oauth_service = OAuthService::new(container.clone());
            oauth_service.handle_token_introspection(&form_params, auth_header.as_deref())
        } else {
            Err("{\"error\": \"server_error\", \"error_description\": \"No OAuth service available\"}".to_string())
        };

        match result {
            Ok(introspection_response) => {
                self.send_json_response(stream, 200, "OK", &introspection_response);
            }
            Err(error_response) => {
                self.send_json_response(stream, 400, "Bad Request", &error_response);
            }
        }
    }

    fn handle_revoke(&self, stream: &mut TcpStream, request: &str) {
        let body = self.extract_body(request);
        let form_params = self.parse_form_data(&body);
        let auth_header = self.extract_auth_header(request);

        let result = if let Some(ref oauth_server) = self.oauth_server {
            oauth_server.handle_token_revocation(&form_params, auth_header.as_deref())
        } else if let Some(ref container) = self.oauth_service {
            let oauth_service = OAuthService::new(container.clone());
            oauth_service.handle_token_revocation(&form_params, auth_header.as_deref())
        } else {
            Err("{\"error\": \"server_error\", \"error_description\": \"No OAuth service available\"}".to_string())
        };

        match result {
            Ok(_) => {
                self.send_empty_response(stream, 200, "OK");
            }
            Err(error_response) => {
                self.send_json_response(stream, 400, "Bad Request", &error_response);
            }
        }
    }

    fn extract_body(&self, request: &str) -> String {
        if let Some(pos) = request.find("\r\n\r\n") {
            request[pos + 4..].to_string()
        } else {
            String::new()
        }
    }

    fn parse_form_data(&self, body: &str) -> HashMap<String, String> {
        body.split('&')
            .filter_map(|pair| {
                let mut split = pair.splitn(2, '=');
                if let (Some(key), Some(value)) = (split.next(), split.next()) {
                    Some((
                        urlencoding::decode(key).unwrap_or_default().to_string(),
                        urlencoding::decode(value).unwrap_or_default().to_string(),
                    ))
                } else {
                    None
                }
            })
            .collect()
    }

    fn extract_auth_header(&self, request: &str) -> Option<String> {
        let lines: Vec<&str> = request.lines().collect();
        for line in lines.iter().skip(1) {
            // Skip the request line
            if line.to_lowercase().starts_with("authorization:") {
                return Some(line[14..].trim().to_string()); // Skip "Authorization: "
            }
        }
        None
    }
}