package org.eparapher.core.signature;
   
   import java.io.File;
   import java.io.FileInputStream;
   import java.io.FileNotFoundException;
   import java.io.FileOutputStream;
   import java.io.IOException;
   import java.io.OutputStream;
   import java.io.StringReader;
  import java.security.InvalidAlgorithmParameterException;
  import java.security.NoSuchAlgorithmException;
  import java.security.cert.X509Certificate;
  import java.util.ArrayList;
  import java.util.Collections;
  import java.util.List;
  
  import javax.xml.crypto.MarshalException;
  import javax.xml.crypto.XMLStructure;
  import javax.xml.crypto.dom.DOMStructure;
  import javax.xml.crypto.dsig.CanonicalizationMethod;
  import javax.xml.crypto.dsig.DigestMethod;
  import javax.xml.crypto.dsig.Reference;
  import javax.xml.crypto.dsig.SignatureMethod;
  import javax.xml.crypto.dsig.SignedInfo;
  import javax.xml.crypto.dsig.Transform;
  import javax.xml.crypto.dsig.XMLObject;
  import javax.xml.crypto.dsig.XMLSignature;
  import javax.xml.crypto.dsig.XMLSignatureException;
  import javax.xml.crypto.dsig.XMLSignatureFactory;
  import javax.xml.crypto.dsig.dom.DOMSignContext;
  import javax.xml.crypto.dsig.keyinfo.KeyInfo;
  import javax.xml.crypto.dsig.keyinfo.KeyInfoFactory;
  import javax.xml.crypto.dsig.keyinfo.X509Data;
  import javax.xml.crypto.dsig.spec.C14NMethodParameterSpec;
  import javax.xml.crypto.dsig.spec.TransformParameterSpec;
  import javax.xml.crypto.dsig.spec.XPathFilter2ParameterSpec;
  import javax.xml.crypto.dsig.spec.XPathFilterParameterSpec;
  import javax.xml.crypto.dsig.spec.XPathType;
  import javax.xml.crypto.dsig.spec.XSLTTransformParameterSpec;
  import javax.xml.parsers.DocumentBuilder;
  import javax.xml.parsers.DocumentBuilderFactory;
  import javax.xml.parsers.ParserConfigurationException;
  import javax.xml.transform.OutputKeys;
  import javax.xml.transform.Transformer;
  import javax.xml.transform.TransformerException;
  import javax.xml.transform.TransformerFactory;
  import javax.xml.transform.dom.DOMSource;
  import javax.xml.transform.stream.StreamResult;
  
  import org.apache.log4j.Logger;
  import org.eparapher.core.EParapherManager;
  import org.eparapher.core.crypto.EPKeystoreManager;
  import org.eparapher.core.crypto.keystore.IUserKeystore;
  
  import org.w3c.dom.Document;
  import org.w3c.dom.Element;
  import org.xml.sax.InputSource;
  import org.xml.sax.SAXException;
  import org.xml.sax.EntityResolver;
  
  public class XMLSigner {
  	
  	private static Logger log = Logger.getLogger(XMLSigner.class);
  	
  	private IUserKeystore userpkandcert;
  
  	private Document document;
  
  	public XMLSigner() {
  
  	}
  	/**
  	 * Sign an xml file from eparapher signature settings object
  	 * 
  	 * @param xmlSourceFile
  	 * @param cmssignparams
  	 * @return signedfile path to the file
  	 */
  	public String sign( String xmlSourceFile, XMLSignatureParameters xmlsignparams ) {
  		
  		userpkandcert = EPKeystoreManager.getInstance().getUserkeystore();
  		
  		if ( loadXmlSourceFile(xmlSourceFile,xmlsignparams) )
  			if ( signXMLDoc(xmlsignparams) )
  				return saveSignedXmlFile(xmlSourceFile, xmlsignparams);
  		return null;
  	}
  
  	/**
  	 * Save XML Document
  	 */
  	private String saveSignedXmlFile( String xmlSourceFile, XMLSignatureParameters xmlsignparams ) {
  		String xmlDestFile;
  		
  		//Determine where to save file.
  		if ( EParapherManager.getInstance().getSettings().isXMLSignatureReplaceFile() ) {
  			File original = new File(xmlSourceFile);
  			//TODO : 4 Undo/Redo : move to temporary dir
  			original.delete();
 			xmlDestFile = xmlSourceFile ;
 		} else {
 			xmlDestFile= xmlSourceFile + ".signed.xml";
 		}
 		
     	// output the resulting document
 		log.info("Saving Signed XML document to " + xmlDestFile);
     	OutputStream os = null;
         try {
 			os = new FileOutputStream(xmlDestFile);
 		} catch (FileNotFoundException e) {
 			String msg = " Cannot write in file : " + xmlDestFile;
 			EParapherManager.getInstance().getUI().errorMessage(msg,e);
 			log.error(msg, e);
 			
 			log.error(" Output signed xml to console : ");
 			os = System.out;
 		}
     	
     	
     	TransformerFactory tf = TransformerFactory.newInstance();
     	Transformer trans;
     	try {
     		trans = tf.newTransformer();
     		trans.setOutputProperty(OutputKeys.INDENT, "yes");
 			trans.transform(new DOMSource(document), new StreamResult(os));
 		} catch (TransformerException e) {
 			log.error(""+e.getLocalizedMessage(),e);
 		}
 		if (os!=null){
 			try {
 				os.flush();
 				os.close();
 				return xmlDestFile;
 			} catch (IOException e) {
 				log.error(""+e.getLocalizedMessage(),e);
 			}
 		}
 		return null;
 	}
 
 	private boolean loadXmlSourceFile(String xmlSourceFile, XMLSignatureParameters xmlsignparams) {
 		
 		// Instantiate the document to be validated
 		log.info("Loading XML document to sign : " + xmlSourceFile);
 		DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
 		dbf.setNamespaceAware(false);
 		dbf.setValidating(false);
 		try {
 			DocumentBuilder db = dbf.newDocumentBuilder();
 
 			// Disable DTD Validation
 			if (!xmlsignparams.isDTDValidation())
 				db.setEntityResolver( new DTDVerificationDisabled() );
 			
 			document = db.parse(new FileInputStream(xmlSourceFile));
 			
 			return true;
 		} catch (FileNotFoundException e) {
 			log.error(""+e.getLocalizedMessage(),e);
 		} catch (SAXException e) {
 			log.error(""+e.getLocalizedMessage(),e);
 		} catch (IOException e) {
 			log.error(""+e.getLocalizedMessage(),e);
 		} catch (ParserConfigurationException e) {
 			log.error(""+e.getLocalizedMessage(),e);
 		}
 		return false;
 	}
 	
 	private boolean signXMLDoc(XMLSignatureParameters xmlsignparams) {
 		
 		//FIXME : Enveloping + XSLT Transform + Base 64
         // Create a DOM XMLSignatureFactory that will be used to generate the enveloped signature
 		log.debug("Preparing XML Signature");
 		XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");
 
 	    // Create a Reference to the enveloped document and
 		// also specify the digest algorithm and the ENVELOPED Transform.
 		Reference ref = null;
 		XMLObject obj = null;
 		try {
 			DigestMethod digest = fac.newDigestMethod(xmlsignparams.getDigestAlg(), null);
 			if (xmlsignparams.isEnveloped()) {
 				//in this case we are signing the whole document, so a URI of "" signifies that)
 				List listTransform = Collections.singletonList(fac.newTransform(xmlsignparams.getTransform(), getTransformParameterSpec(xmlsignparams.getTransform()) ));
 				//TODO : select a document part/reference
 				String reference="";
 				ref = fac.newReference(reference, digest, listTransform, null, null);
 			} else if (xmlsignparams.isEnveloping()) {
 		        // Next, create a Reference to a same-document URI that is an Object
 		        // element and specify the digest algorithm
 				String refe = "#"+xmlsignparams.getObjectIds();
 		        ref = fac.newReference( refe, digest );
 		        Element el = document.getElementById(xmlsignparams.getObjectIds());
 		    	XMLStructure content = new DOMStructure(el);
 		    	obj = fac.newXMLObject (Collections.singletonList(content), xmlsignparams.getObjectIds(), null, null);
 			} else if (xmlsignparams.isDetached()) {
 				ref = fac.newReference( "http://www.w3.org/TR/xml-stylesheet", digest);
 			} else {
 				log.error("The XML Signature isn't enveloped, enveloping or detached!!!???");
 				return false;
 			}
 
 			// Create the SignedInfo
 			CanonicalizationMethod canonMethod = fac.newCanonicalizationMethod(xmlsignparams.getCanonical(), (C14NMethodParameterSpec) null);
 			SignatureMethod        signMethod  = fac.newSignatureMethod(xmlsignparams.getSignatureAlg(), null);
 			SignedInfo             si          = fac.newSignedInfo( canonMethod, signMethod, Collections.singletonList(ref) );
 
 			
 			// Create a KeyValue containing the RSA PublicKey that was generated
 			X509Certificate[] signercertchain = userpkandcert.getX509CertificateChain();
 			KeyInfoFactory kif = fac.getKeyInfoFactory();
 			// Insert the certificate
 			List certs = new ArrayList();
 			for ( int i=0; i<signercertchain.length; i++ ) {
 				certs.add(signercertchain[i].getSubjectX500Principal().getName());
 				//certs.add(signercertchain[i].getIssuerX500Principal().getName());
 				//certs.add(signercertchain[i].getSubjectAlternativeNames());
 				certs.add(signercertchain[i]);
 			}
 			
 			// charger les donnees du certificat
 			X509Data data = kif.newX509Data(certs);
 			List dataList = Collections.singletonList(data);
 			KeyInfo ki = kif.newKeyInfo(dataList);
 			
 			//TODO : v0.2, Download CRLs and insert them in the Signature
 			
 			log.info("XML Signer do not download and insert CRL from X.509 CDP");
 			
 			//TODO : Timestamp 
 			log.info("XML Signer do not Timestamp in this release, sorry!");
 			
 			//Insert the Public Key
 			//KeyValue kv = kif.newKeyValue(signercert.getPublicKey());
 			// Create a KeyInfo and add the KeyValue to it
 	        //KeyInfo ki = kif.newKeyInfo(Collections.singletonList(kv));
 			
 			XMLSignature signature = null;
 			Document signedxmldoc = null;
 			DOMSignContext dsc = null;
 			
 			if (xmlsignparams.isEnveloping()) {
 				// Create the XMLSignature (but don't sign it yet)
 				signature = fac.newXMLSignature(si, ki, Collections.singletonList(obj), null, null); 
 
 			    // Create a DOMSignContext and specify the DSA PrivateKey for signing
 				// and the document location of the XMLSignature
 			    dsc = new DOMSignContext(userpkandcert.getPrivateKey(),  document);
 			} else {
 				// Create the XMLSignature (but don't sign it yet)
 				signature = fac.newXMLSignature(si, ki);
 				
 				if (xmlsignparams.isDetached()) {
 
 					// Create the Document that will hold the resulting XMLSignature
 					DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
 					dbf.setNamespaceAware(true); // must be set
 					try {
 						signedxmldoc = dbf.newDocumentBuilder().newDocument();
 					} catch (ParserConfigurationException e) {
 						log.error(""+e.getLocalizedMessage(),e);
 					}
 
 					// Create a DOMSignContext and set the signing Key to the DSA 
 				    // PrivateKey and specify where the XMLSignature should be inserted 
 					// in the target document (in this case, the document root)
 					dsc = new DOMSignContext(userpkandcert.getPrivateKey(), signedxmldoc);
 
 				}
 				if (xmlsignparams.isEnveloped()) {
 				    // Create a DOMSignContext and specify the PrivateKey and
 				    // location of the resulting XMLSignature's parent element
 					dsc = new DOMSignContext(userpkandcert.getPrivateKey(), document.getDocumentElement());
 				}
 			}
 
 	        // Marshal, generate (and sign) the enveloped signature
 			log.debug("Processing XML Signature");
 	        signature.sign(dsc);
 	        
 	        if (xmlsignparams.isDetached())
 	        	document = signedxmldoc;
 	        
 	        return true;
 		} catch (NoSuchAlgorithmException e) {
 			log.error(e.getLocalizedMessage(),e);
 		} catch (InvalidAlgorithmParameterException e) {
 			log.error(e.getLocalizedMessage(),e);
 		} catch (MarshalException e) {
 			log.error(e.getLocalizedMessage(),e);
 		} catch (XMLSignatureException e) {
 			log.error(e.getLocalizedMessage(),e);
 		} catch (Exception e) {
 			log.error(e.getLocalizedMessage(),e);
 		}
 		return false;
 	}
 	private TransformParameterSpec getTransformParameterSpec(String transform) {
 	    TransformParameterSpec params = null;
 	    if (transform.equals(Transform.XPATH))
 	    	params = new XPathFilterParameterSpec("xPath");
 	    else if (transform.equals(Transform.XPATH2))
 	    	params = new XPathFilter2ParameterSpec(Collections.singletonList(new XPathType("xPath2", XPathType.Filter.INTERSECT)));
 	    else if (transform.equals(Transform.XSLT))
 	    	params = new XSLTTransformParameterSpec(new XSLTStructure());
 	    return params;
 
 	}
 	//TODO : move
 	private static class XSLTStructure implements XMLStructure {
 		public boolean isFeatureSupported(String feature) { return false; }
 	}
 	
 	private static class DTDVerificationDisabled implements EntityResolver {
 
         public InputSource resolveEntity(String publicId, String systemId)
                 throws SAXException, IOException {
             log.info("Ignoring " + publicId + ", " + systemId);
             return new InputSource(new StringReader(""));
         }
     }
 
 }