package com.atlassian.asap.core.server.jersey;
   
   import com.atlassian.asap.api.Jwt;
   import com.atlassian.asap.api.exception.AuthenticationFailedException;
   import com.atlassian.asap.api.exception.PermanentAuthenticationFailedException;
   import com.atlassian.asap.api.exception.TransientAuthenticationFailedException;
   import com.atlassian.asap.api.server.http.RequestAuthenticator;
   import com.atlassian.asap.core.keys.KeyProvider;
   import com.atlassian.asap.core.server.AuthenticationContext;
  import com.atlassian.asap.core.server.http.RequestAuthenticatorFactory;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  import javax.annotation.Nullable;
  import javax.annotation.Priority;
  import javax.ws.rs.Priorities;
  import javax.ws.rs.container.ContainerRequestContext;
  import javax.ws.rs.container.ContainerRequestFilter;
  import javax.ws.rs.container.ResourceInfo;
  import javax.ws.rs.core.Context;
  import javax.ws.rs.core.HttpHeaders;
  import javax.ws.rs.ext.Provider;
  import java.io.IOException;
  import java.security.PublicKey;
  import java.util.Optional;
  
  import static com.atlassian.asap.core.server.filter.AbstractRequestAuthenticationFilter.AUTHENTIC_JWT_REQUEST_ATTRIBUTE;
  import static java.util.Objects.requireNonNull;
  
  /**
   * AuthenticationRequestFilter is a {@link ContainerRequestFilter} that authenticates resources with the ASAP protocol
   * if opted-into by using the {@link Asap} annotation on either a resource package, class, or method.
   */
  @Provider
  @Priority(Priorities.AUTHENTICATION)
  public class AuthenticationRequestFilter implements ContainerRequestFilter {
      static final int MAX_TRANSIENT_FAILURES_RETRIES = 10;
  
      static final String ASAP_REQUEST_ATTRIBUTE = "asap.annotation";
  
      private static final Logger LOG = LoggerFactory.getLogger(AuthenticationRequestFilter.class);
  
      @SuppressWarnings("checkstyle:VisibilityModifier")
      @Context
      ResourceInfo resourceInfo;
  
      private final RequestAuthenticator authenticator;
      private final FailureHandler failureHandler;
  
      @SuppressWarnings("WeakerAccess")
      public AuthenticationRequestFilter(RequestAuthenticator authenticator, FailureHandler failureHandler) {
          this.failureHandler = requireNonNull(failureHandler);
          this.authenticator = requireNonNull(authenticator);
      }
  
      @Override
      public void filter(ContainerRequestContext context) throws IOException {
          needsAuthentication().ifPresent(asap ->
                  {
                      context.setProperty(AUTHENTIC_JWT_REQUEST_ATTRIBUTE, authenticateToken(context));
                      context.setProperty(ASAP_REQUEST_ATTRIBUTE, asap);
                  }
          );
      }
  
      @Nullable
      private Jwt authenticateToken(final ContainerRequestContext context) {
          final String authorizationHeader = context.getHeaderString(HttpHeaders.AUTHORIZATION);
  
          for (int tryCounter = 0; tryCounter < MAX_TRANSIENT_FAILURES_RETRIES; tryCounter++) {
              try {
                  Jwt authenticJwt = authenticator.authenticateRequest(authorizationHeader);
                  LOG.trace("Accepting authentic token with identifier '{}'", authenticJwt.getClaims().getJwtId());
                  return authenticJwt;
              } catch (TransientAuthenticationFailedException e) {
                  if (tryCounter >= MAX_TRANSIENT_FAILURES_RETRIES - 1) { // we've done the max number of retries
                      failureHandler.onAuthenticationFailure(context, e);
                      return null;
                  } else {
                      final boolean retry = failureHandler.onTransientAuthenticationFailure(context, e);
                      if (!retry) {
                          return null; // request should have already been aborted by the failure handler
                      }
                  }
              } catch (PermanentAuthenticationFailedException e) {
                  failureHandler.onPermanentAuthenticationFailure(context, e);
                  return null;
              } catch (AuthenticationFailedException e) {
                  failureHandler.onAuthenticationFailure(context, e);
                  return null;
              }
          }
          throw new IllegalStateException();
      }
  
      /**
       * Finds the {@link Asap} token on the resource package, class, or method.
       */
      private Optional<Asap> needsAuthentication() {
         Asap asap = null;
         if (resourceInfo.getResourceMethod().isAnnotationPresent(Asap.class)) {
             asap = resourceInfo.getResourceMethod().getAnnotation(Asap.class);
         } else if (resourceInfo.getResourceClass().isAnnotationPresent(Asap.class)) {
             asap = resourceInfo.getResourceClass().getAnnotation(Asap.class);
         } else if (resourceInfo.getResourceClass().getPackage().isAnnotationPresent(Asap.class)) {
             asap = resourceInfo.getResourceClass().getPackage().getAnnotation(Asap.class);
         }
         return Optional.ofNullable(asap)
                 .filter(Asap::enabled);
     }
 
 
     /**
      * Use this factory method to create a new AuthorizationRequestFilter instance with the specified audience and
      * public key repository URL.
      *
      * @param audience the non-null audience for this filter
      * @param repoUrl  the ASAP public key repository URL
      * @return the new instance
      */
     public static AuthenticationRequestFilter newInstance(String audience, String repoUrl) {
         return newInstance(new AuthenticationContext(audience, repoUrl));
     }
 
     /**
      * Use this factory method to create a new AuthorizationRequestFilter instance with the specified audience and
      * public key repository provider.
      *
      * @param audience    the non-null audience for this filter
      * @param keyProvider the ASAP public key provider
      * @return the new instance
      */
     public static AuthenticationRequestFilter newInstance(String audience, KeyProvider<PublicKey> keyProvider) {
         return newInstance(new AuthenticationContext(audience, keyProvider));
     }
 
     /**
      * Use this factory method to create a new AuthorizationRequestFilter instance with the specified context.
      *
      * @param authenticationContext the non-null authentication context
      * @return the new instance
      */
     public static AuthenticationRequestFilter newInstance(AuthenticationContext authenticationContext) {
         RequestAuthenticatorFactory requestAuthenticatorFactory = new RequestAuthenticatorFactory();
         RequestAuthenticator authenticator = requestAuthenticatorFactory.create(authenticationContext);
 
         return new AuthenticationRequestFilter(authenticator, new EmptyBodyFailureHandler());
     }
 }