package org.eparapher.core.signature;
   
   import java.io.File;
   import java.security.InvalidAlgorithmParameterException;
   import java.security.NoSuchAlgorithmException;
   import java.security.NoSuchProviderException;
   import java.security.cert.CertStore;
   import java.security.cert.CollectionCertStoreParameters;
   import java.security.cert.X509Certificate;
  import java.util.ArrayList;
  
  import org.apache.log4j.Logger;
  import org.bouncycastle.asn1.cms.ContentInfo;
  import org.bouncycastle.cms.CMSProcessable;
  import org.bouncycastle.cms.CMSProcessableByteArray;
  import org.bouncycastle.cms.CMSSignedData;
  import org.bouncycastle.cms.CMSSignedDataGenerator;
  import org.bouncycastle.cms.CMSSignedGenerator;
  import org.bouncycastle.cms.SignerInformationStore;
  import org.bouncycastle.x509.X509Store;
  import org.eparapher.core.EParapherManager;
  import org.eparapher.core.crypto.EPKeystoreManager;
  import org.eparapher.core.crypto.keystore.IUserKeystore;
  import org.eparapher.core.tools.FileUtil;
  
  
  /**
   * inspired from :
   * http://p2p.wrox.com/book-beginning-cryptography-java/61612-bouncycastle-multiple-signatures.html
   * http://www.codefund.com/71/verify-p7s-false-710519.shtm
   * 
   * @author Arnault MICHEL
   *
   */
  public class CMSSigner {
  
  	private static Logger log = Logger.getLogger(CMSSigner.class);
  	
  	private IUserKeystore userpkandcert;
  	private boolean addsignature;
  
  	public CMSSigner() {
  		userpkandcert = EPKeystoreManager.getInstance().getUserkeystore();
  	}
  	
  	public String sign( String original_file, CMSSignatureParameters cmssignparams ) {
  		try {
  			addsignature = false;
  			String signed_file = manageFileBeforeSignature( original_file, cmssignparams.isDetached() );
  			if (signed_file == null) {
  				log.info("User cancel the CMS signature process");
  				return null;
  			}
  			log.info("Generating " + (cmssignparams.isDetached()?"detached":"embedded") +" CMS signature of " +original_file + " in " + signed_file );
  			
  			// Loading file content to sign
  			byte[] content_to_sign = FileUtil.readFile(original_file);
  			
  			// Loading certificates and CRLs
  			CertStore certs = buildCertsAndCRLsListToInsertInCMS(cmssignparams);
  			
  			// Building the CMS Signature
  			CMSSignedDataGenerator signGen = new CMSSignedDataGenerator();
  			signGen.addSigner(userpkandcert.getPrivateKey(), userpkandcert.getX509Certificate(), cmssignparams.getSignatureDigestAlgOID());
  			if (certs!=null)
  				signGen.addCertificatesAndCRLs(certs);
  			
  			CMSSignedData signedData = null;
  			CMSProcessable content=null;
  
  			//Load existing signature
  			if (addsignature) {
  				if (cmssignparams.isDetached())
  					signedData = new CMSSignedData(FileUtil.readFile(signed_file));
  				else
  					signedData = new CMSSignedData(content_to_sign);
  				
  				if (signedData!=null){
  					SignerInformationStore signers = signedData.getSignerInfos();
  					ContentInfo ci = signedData.getContentInfo();
  	
  					CertStore existingCerts=signedData.getCertificatesAndCRLs("Collection", "BC");
  					X509Store x509Store=signedData.getAttributeCertificates("Collection", "BC");
  
  					//add existing certs
  					signGen.addCertificatesAndCRLs(existingCerts);
  					//add existing certs attributes
  					signGen.addAttributeCertificates(x509Store);
  					//add existing signers
  					signGen.addSigners(signers);
  				}
  			}
  			// Load content to sign
  			if ( addsignature && !cmssignparams.isDetached() )
  				content = signedData.getSignedContent();
  			else
  				content = new CMSProcessableByteArray(content_to_sign);
  
  			// Generate CMS/PKCS#7 Signature
 			if (EPKeystoreManager.isCAPICOMUsed() || EPKeystoreManager.isPKCS11Used()) {
 				String provName = userpkandcert.getProviderName();
 				signedData = signGen.generate(CMSSignedGenerator.DATA, content, !cmssignparams.isDetached(), provName);
 			} else
 				signedData = signGen.generate(CMSSignedGenerator.DATA, content, !cmssignparams.isDetached(), "BC");
 			
 			// Ecriture du buffer dans un fichier.
 			FileUtil.writeToFile(signed_file, signedData.getEncoded());
 			
 			return signed_file;
 		} catch (Exception e) {
 			log.error(""+e.getLocalizedMessage(),e);
 		}
 
 		return null;
 	}
 
 	private CertStore buildCertsAndCRLsListToInsertInCMS( CMSSignatureParameters cmssignparams) {
 		ArrayList<X509Certificate> certList = new ArrayList<X509Certificate>();
 		certList.add(userpkandcert.getX509Certificate());
 		// TODO : v0.2, implement CRL Retriever
 		//if (cmssignparams.isInsertCRLs())
 			//certList.add(getCRL);
 		CertStore certstore = null;
 		try {
 			certstore = CertStore.getInstance("Collection", new CollectionCertStoreParameters(certList), "BC");
 		} catch (InvalidAlgorithmParameterException e) {
 			log.error(""+e.getLocalizedMessage(),e);
 		} catch (NoSuchAlgorithmException e) {
 			log.error(""+e.getLocalizedMessage(),e);
 		} catch (NoSuchProviderException e) {
 			log.error(""+e.getLocalizedMessage(),e);
 		}
 		return certstore;
 	}
 
 	private String manageFileBeforeSignature(String original_file, boolean detached) {
 
 		String signed_file, p7sFile, p7mFile;
 		
 		// Generate p7s and p7m filename
 		int dotpos     = original_file.toLowerCase().lastIndexOf(".");
 		int fileseppos = original_file.lastIndexOf(File.separator);
 		if (dotpos>=0 && dotpos>fileseppos) {
 			p7sFile = original_file.substring(0,dotpos) + ".p7s";
 			p7mFile = original_file.substring(0,dotpos) + ".p7m";
 		} else {
 			p7sFile = original_file + ".p7s";
 			p7mFile = original_file + ".p7m";
 		}
 			
 		// Throw an exception if file is empty
 		//if (FileUtil.fileEmpty(original_file)) {
 			//throw new SignatureException("Cannot sign empty file " + original_file);
 		//}
 		if (detached) {
 			if (FileUtil.fileExists(p7sFile)) {
 				//Want a confirmation notification when adding a new signature?
 				//String confirmmsg = "An existing signature (*.p7s) has been found.\nPlease confirm that you want to generate a new signature";
 				//if (EParapherManager.getInstance().getUI().askUserYesNo(confirmmsg)) {
 					log.warn("Detached signature already exists : adding a new signature");
 					addsignature = true;
 				//} else {
 					//return null;
 				//}
 			}
 			signed_file = p7sFile;
 		} else {
 			if (FileUtil.fileExists(p7mFile)) {
 				if (p7mFile.equals(original_file)) {
 					//ask user that he wants to oversign/countersign ( == p7m(p7m) )
 					//EParapherManager.getInstance().getUI().askUserYesNo("An existing signature has been found");
 					log.info("The CMS attached signature file already exists : adding a new signature");
 					addsignature = true;
 				} else {
 					//TODO : compare p7m(content) and original file content : first bytes then hashes
 					//  and if hashes equals : ask if add signature.
 					//  For the moment, ask user if overwrite and loose the other signature?
 					String confirmmsg = "We detect that " + p7mFile + " exists.\nDo you want to overwrite it, and loose old sinatures?";
 					if (EParapherManager.getInstance().getUI().askUserYesNo(confirmmsg)) {
 						log.info("The existing p7m will be overwritten...");
 					} else
 						return null;
 				}
 			}
 			signed_file = p7mFile;
 		}
 		
 		return signed_file;
 	}
 
 }