// This file is part of the CircuitPython project: https://circuitpython.org
//
// SPDX-FileCopyrightText: Copyright (c) 2020 Scott Shawcroft for Adafruit Industries
//
// SPDX-License-Identifier: MIT

#include <stdio.h>
#include <string.h>

#include "extmod/vfs.h"
#include "py/objtuple.h"
#include "py/objlist.h"
#include "py/objproperty.h"
#include "py/runtime.h"
#include "py/mperrno.h"

#include "shared-bindings/ssl/SSLContext.h"

//| class SSLContext:
//|     """Settings related to SSL that can be applied to a socket by wrapping it.
//|     This is useful to provide SSL certificates to specific connections
//|     rather than all of them."""
//|

static mp_obj_t ssl_sslcontext_make_new(const mp_obj_type_t *type, size_t n_args, size_t n_kw, const mp_obj_t *args) {
    mp_arg_check_num(n_args, n_kw, 0, 1, false);

    ssl_sslcontext_obj_t *s = mp_obj_malloc(ssl_sslcontext_obj_t, &ssl_sslcontext_type);

    common_hal_ssl_sslcontext_construct(s);

    return MP_OBJ_FROM_PTR(s);
}

//|     def load_cert_chain(self, certfile: str, keyfile: str) -> None:
//|         """Load a private key and the corresponding certificate.
//|
//|         The certfile string must be the path to a single file in PEM format
//|         containing the certificate as well as any number of CA certificates
//|         needed to establish the certificate's authenticity.  The keyfile string
//|         must point to a file containing the private key.
//|         """
//|

static void get_file_contents(mp_obj_t name_obj, mp_buffer_info_t *bufinfo) {
    mp_obj_t file = mp_call_function_2(MP_OBJ_FROM_PTR(&mp_builtin_open_obj), name_obj, MP_OBJ_NEW_QSTR(MP_QSTR_rb));
    mp_obj_t dest[2];
    mp_load_method(file, MP_QSTR_read, dest);
    mp_obj_t result = mp_call_method_n_kw(0, 0, dest);
    mp_get_buffer_raise(result, bufinfo, MP_BUFFER_READ);
}

static mp_obj_t ssl_sslcontext_load_cert_chain(size_t n_args, const mp_obj_t *pos_args, mp_map_t *kw_args) {
    enum { ARG_certfile, ARG_keyfile };
    static const mp_arg_t allowed_args[] = {
        { MP_QSTR_certfile, MP_ARG_REQUIRED | MP_ARG_OBJ, {.u_obj = mp_const_none} },
        { MP_QSTR_keyfile, MP_ARG_OBJ, {.u_obj = mp_const_none} },
    };
    ssl_sslcontext_obj_t *self = MP_OBJ_TO_PTR(pos_args[0]);

    mp_arg_val_t args[MP_ARRAY_SIZE(allowed_args)];
    mp_arg_parse_all(n_args - 1, pos_args + 1, kw_args, MP_ARRAY_SIZE(allowed_args), allowed_args, args);

    mp_buffer_info_t cert_buf, key_buf;
    get_file_contents(args[ARG_certfile].u_obj, &cert_buf);
    if (args[ARG_keyfile].u_obj != mp_const_none) {
        get_file_contents(args[ARG_keyfile].u_obj, &key_buf);
    } else {
        key_buf = cert_buf;
    }

    common_hal_ssl_sslcontext_load_cert_chain(self, &cert_buf, &key_buf);
    return mp_const_none;
}
static MP_DEFINE_CONST_FUN_OBJ_KW(ssl_sslcontext_load_cert_chain_obj, 1, ssl_sslcontext_load_cert_chain);

//|     def load_verify_locations(
//|         self,
//|         cafile: Optional[str] = None,
//|         capath: Optional[str] = None,
//|         cadata: Optional[str] = None,
//|     ) -> None:
//|         """
//|         Load a set of certification authority (CA) certificates used to validate
//|         other peers' certificates.
//|
//|         :param str cafile: path to a file of contcatenated CA certificates in PEM format. **Not implemented**.
//|         :param str capath: path to a directory of CA certificate files in PEM format. **Not implemented**.
//|         :param str cadata: A single CA certificate in PEM format. **Limitation**: CPython allows one
//|           or more certificates, but this implementation is limited to one.
//|         """
//|
static mp_obj_t ssl_sslcontext_load_verify_locations(size_t n_args, const mp_obj_t *pos_args, mp_map_t *kw_args) {
    enum { ARG_cafile, ARG_capath, ARG_cadata };
    static const mp_arg_t allowed_args[] = {
        { MP_QSTR_cafile, MP_ARG_OBJ, {.u_obj = mp_const_none} },
        { MP_QSTR_capath, MP_ARG_OBJ, {.u_obj = mp_const_none} },
        { MP_QSTR_cadata, MP_ARG_OBJ, {.u_obj = mp_const_none} },
    };
    ssl_sslcontext_obj_t *self = MP_OBJ_TO_PTR(pos_args[0]);

    mp_arg_val_t args[MP_ARRAY_SIZE(allowed_args)];
    mp_arg_parse_all(n_args - 1, pos_args + 1, kw_args, MP_ARRAY_SIZE(allowed_args), allowed_args, args);

    if (args[ARG_cafile].u_obj != mp_const_none) {
        mp_raise_NotImplementedError_varg(MP_ERROR_TEXT("%q"), MP_QSTR_cafile);
    }

    if (args[ARG_capath].u_obj != mp_const_none) {
        mp_raise_NotImplementedError_varg(MP_ERROR_TEXT("%q"), MP_QSTR_capath);
    }

    const char *cadata = mp_obj_str_get_str(args[ARG_cadata].u_obj);

    common_hal_ssl_sslcontext_load_verify_locations(self, cadata);
    return mp_const_none;
}
static MP_DEFINE_CONST_FUN_OBJ_KW(ssl_sslcontext_load_verify_locations_obj, 1, ssl_sslcontext_load_verify_locations);

//|     def set_default_verify_paths(self) -> None:
//|         """Load a set of default certification authority (CA) certificates."""
//|

static mp_obj_t ssl_sslcontext_set_default_verify_paths(size_t n_args, const mp_obj_t *pos_args, mp_map_t *kw_args) {
    ssl_sslcontext_obj_t *self = MP_OBJ_TO_PTR(pos_args[0]);

    common_hal_ssl_sslcontext_set_default_verify_paths(self);
    return mp_const_none;
}
static MP_DEFINE_CONST_FUN_OBJ_KW(ssl_sslcontext_set_default_verify_paths_obj, 1, ssl_sslcontext_set_default_verify_paths);

//|     check_hostname: bool
//|     """Whether to match the peer certificate's hostname."""
//|

static mp_obj_t ssl_sslcontext_get_check_hostname(mp_obj_t self_in) {
    ssl_sslcontext_obj_t *self = MP_OBJ_TO_PTR(self_in);

    return mp_obj_new_bool(common_hal_ssl_sslcontext_get_check_hostname(self));
}
static MP_DEFINE_CONST_FUN_OBJ_1(ssl_sslcontext_get_check_hostname_obj, ssl_sslcontext_get_check_hostname);

static mp_obj_t ssl_sslcontext_set_check_hostname(mp_obj_t self_in, mp_obj_t value) {
    ssl_sslcontext_obj_t *self = MP_OBJ_TO_PTR(self_in);

    common_hal_ssl_sslcontext_set_check_hostname(self, mp_obj_is_true(value));
    return mp_const_none;
}
static MP_DEFINE_CONST_FUN_OBJ_2(ssl_sslcontext_set_check_hostname_obj, ssl_sslcontext_set_check_hostname);

MP_PROPERTY_GETSET(ssl_sslcontext_check_hostname_obj,
    (mp_obj_t)&ssl_sslcontext_get_check_hostname_obj,
    (mp_obj_t)&ssl_sslcontext_set_check_hostname_obj);

//|     def wrap_socket(
//|         self,
//|         sock: socketpool.Socket,
//|         *,
//|         server_side: bool = False,
//|         server_hostname: Optional[str] = None,
//|     ) -> ssl.SSLSocket:
//|         """Wraps the socket into a socket-compatible class that handles SSL negotiation.
//|         The socket must be of type SOCK_STREAM."""
//|
//|

static mp_obj_t ssl_sslcontext_wrap_socket(size_t n_args, const mp_obj_t *pos_args, mp_map_t *kw_args) {
    enum { ARG_sock, ARG_server_side, ARG_server_hostname };
    static const mp_arg_t allowed_args[] = {
        { MP_QSTR_sock, MP_ARG_OBJ | MP_ARG_REQUIRED },
        { MP_QSTR_server_side, MP_ARG_KW_ONLY | MP_ARG_BOOL, {.u_bool = false} },
        { MP_QSTR_server_hostname, MP_ARG_KW_ONLY | MP_ARG_OBJ, {.u_obj = mp_const_none} },
    };
    ssl_sslcontext_obj_t *self = MP_OBJ_TO_PTR(pos_args[0]);

    mp_arg_val_t args[MP_ARRAY_SIZE(allowed_args)];
    mp_arg_parse_all(n_args - 1, pos_args + 1, kw_args, MP_ARRAY_SIZE(allowed_args), allowed_args, args);

    const char *server_hostname = NULL;
    if (args[ARG_server_hostname].u_obj != mp_const_none) {
        server_hostname = mp_obj_str_get_str(args[ARG_server_hostname].u_obj);
    }
    bool server_side = args[ARG_server_side].u_bool;
    if (server_side && server_hostname != NULL) {
        mp_raise_ValueError(MP_ERROR_TEXT("Server side context cannot have hostname"));
    }

    mp_obj_t sock_obj = args[ARG_sock].u_obj;

    return common_hal_ssl_sslcontext_wrap_socket(self, sock_obj, server_side, server_hostname);
}
static MP_DEFINE_CONST_FUN_OBJ_KW(ssl_sslcontext_wrap_socket_obj, 1, ssl_sslcontext_wrap_socket);

static const mp_rom_map_elem_t ssl_sslcontext_locals_dict_table[] = {
    { MP_ROM_QSTR(MP_QSTR_wrap_socket), MP_ROM_PTR(&ssl_sslcontext_wrap_socket_obj) },
    { MP_ROM_QSTR(MP_QSTR_load_cert_chain), MP_ROM_PTR(&ssl_sslcontext_load_cert_chain_obj) },
    { MP_ROM_QSTR(MP_QSTR_load_verify_locations), MP_ROM_PTR(&ssl_sslcontext_load_verify_locations_obj) },
    { MP_ROM_QSTR(MP_QSTR_set_default_verify_paths), MP_ROM_PTR(&ssl_sslcontext_set_default_verify_paths_obj) },
    { MP_ROM_QSTR(MP_QSTR_check_hostname), MP_ROM_PTR(&ssl_sslcontext_check_hostname_obj) },
};

static MP_DEFINE_CONST_DICT(ssl_sslcontext_locals_dict, ssl_sslcontext_locals_dict_table);

MP_DEFINE_CONST_OBJ_TYPE(
    ssl_sslcontext_type,
    MP_QSTR_SSLContext,
    MP_TYPE_FLAG_HAS_SPECIAL_ACCESSORS,
    make_new, ssl_sslcontext_make_new,
    locals_dict, &ssl_sslcontext_locals_dict
    );