package webutility

  
  import (

  	"crypto/rand"

  	"crypto/sha256"

  	"encoding/hex"

  	"errors"

  	"net/http"

  	"strings"
  	"time"

  	"github.com/dgrijalva/jwt-go"

  )

  var _issuer = "webutility"
  var _secret = "webutility"

  // TokenClaims are JWT token claims.

  type TokenClaims struct {

  	// extending a struct
  	jwt.StandardClaims
  
  	// custom claims

  	Token     string `json:"access_token"`
  	TokenType string `json:"token_type"`
  	Username  string `json:"username"`

  	RoleName  string `json:"role"`

  	RoleID    int64  `json:"role_id"`

  	ExpiresIn int64  `json:"expires_in"`

  }

  // InitJWT ...

  func InitJWT(issuer, secret string) {
  	_issuer = issuer
  	_secret = secret

  }

  // ValidateHash hashes pass and salt and returns comparison result with resultHash
  func ValidateHash(pass, salt, resultHash string) (bool, error) {

  	hash, _, err := CreateHash(pass, salt)

  	if err != nil {

  		return false, err

  	}

  	res := hash == resultHash
  	return res, nil

  }

  // CreateHash hashes str using SHA256.
  // If the presalt parameter is not provided CreateHash will generate new salt string.
  // Returns hash and salt strings or an error if it fails.
  func CreateHash(str, presalt string) (hash, salt string, err error) {

  	// chech if message is presalted
  	if presalt == "" {

  		salt, err = randomSalt()

  		if err != nil {
  			return "", "", err
  		}
  	} else {
  		salt = presalt
  	}
  
  	// convert strings to raw byte slices

  	rawstr := []byte(str)

  	rawsalt, err := hex.DecodeString(salt)
  	if err != nil {
  		return "", "", err
  	}

  	rawdata := make([]byte, len(rawstr)+len(rawsalt))

  	rawdata = append(rawdata, rawstr...)

  	rawdata = append(rawdata, rawsalt...)
  
  	// hash message + salt
  	hasher := sha256.New()
  	hasher.Write(rawdata)
  	rawhash := hasher.Sum(nil)

  	hash = hex.EncodeToString(rawhash)
  	return hash, salt, nil
  }

  // CreateAuthToken returns JWT token with encoded username, role, expiration date and issuer claims.

  // It returns an error if it fails.

  func CreateAuthToken(username string, roleName string, roleID int64) (TokenClaims, error) {

  	t0 := (time.Now()).Unix()

  	t1 := (time.Now().Add(time.Hour * 24 * 7)).Unix()

  	claims := TokenClaims{

  		TokenType: "Bearer",
  		Username:  username,

  		RoleName:  roleName,
  		RoleID:    roleID,

  		ExpiresIn: t1 - t0,

  	}

  	// initialize jwt.StandardClaims fields (anonymous struct)
  	claims.IssuedAt = t0
  	claims.ExpiresAt = t1

  	claims.Issuer = _issuer

  
  	jwtToken := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

  	token, err := jwtToken.SignedString([]byte(_secret))

  	if err != nil {

  		return TokenClaims{}, err

  	}

  	claims.Token = token
  	return claims, nil

  }

  // RefreshAuthToken returns new JWT token with same claims contained in tok but with prolonged expiration date.
  // It returns an error if it fails.

  func RefreshAuthToken(tok string) (TokenClaims, error) {
  	token, err := jwt.ParseWithClaims(tok, &TokenClaims{}, secretFunc)

  	if err != nil {

  		if validation, ok := err.(*jwt.ValidationError); ok {

  			// don't return error if token is expired, just extend it

  			if !(validation.Errors&jwt.ValidationErrorExpired != 0) {
  				return TokenClaims{}, err
  			}
  		} else {
  			return TokenClaims{}, err
  		}

  	}
  
  	// type assertion
  	claims, ok := token.Claims.(*TokenClaims)

  	if !ok {

  		return TokenClaims{}, errors.New("token is not valid")

  	}

  	// extend token expiration date

  	return CreateAuthToken(claims.Username, claims.RoleName, claims.RoleID)

  }

  // AuthCheck ...

  func AuthCheck(req *http.Request, roles string) (*TokenClaims, error) {

  	// validate token and check expiration date
  	claims, err := GetTokenClaims(req)
  	if err != nil {

  		return claims, err
  	}
  
  	if roles == "" {
  		return claims, nil

  	}

  	// check if token has expired
  	if claims.ExpiresAt < (time.Now()).Unix() {

  		return claims, errors.New("token has expired")

  	}

  	if roles == "*" {

  		return claims, nil

  	}
  
  	parts := strings.Split(roles, ",")

  	for i := range parts {

  		r := strings.Trim(parts[i], " ")

  		if claims.RoleName == r {

  			return claims, nil

  		}
  	}

  	return claims, errors.New("unauthorized role access")

  }

  // GetTokenClaims extracts JWT claims from Authorization header of req.

  // Returns token claims or an error.
  func GetTokenClaims(req *http.Request) (*TokenClaims, error) {
  	// check for and strip 'Bearer' prefix
  	var tokstr string
  	authHead := req.Header.Get("Authorization")
  	if ok := strings.HasPrefix(authHead, "Bearer "); ok {

  		tokstr = strings.TrimPrefix(authHead, "Bearer ")

  	} else {

  		return &TokenClaims{}, errors.New("authorization header is incomplete")

  	}

  	token, err := jwt.ParseWithClaims(tokstr, &TokenClaims{}, secretFunc)

  	if err != nil {
  		return &TokenClaims{}, err
  	}
  
  	// type assertion

  	claims, ok := token.Claims.(*TokenClaims)
  	if !ok || !token.Valid {

  		return &TokenClaims{}, errors.New("token is not valid")
  	}

  	return claims, nil

  }

  func DecodeJWT(secret, token string) (*TokenClaims, error) {
  	secretfunc := func(*jwt.Token) (interface{}, error) {
  		return []byte(secret), nil
  	}
  
  	tok, err := jwt.ParseWithClaims(token, &TokenClaims{}, secretfunc)
  	if err != nil {
  		if validation, ok := err.(*jwt.ValidationError); ok {
  			// don't return error if token is expired
  			if !(validation.Errors&jwt.ValidationErrorExpired != 0) {
  				return nil, err
  			}
  		} else {
  			return nil, err
  		}
  	}
  
  	// type assertion
  	claims, ok := tok.Claims.(*TokenClaims)
  	if !ok {
  		return &TokenClaims{}, errors.New("token is not valid")
  	}
  
  	return claims, nil
  }

  // randomSalt returns a string of 32 random characters.

  func randomSalt() (s string, err error) {

  	const saltSize = 32

  	rawsalt := make([]byte, saltSize)

  	_, err = rand.Read(rawsalt)

  	if err != nil {

  		return "", err

  	}

  	s = hex.EncodeToString(rawsalt)
  	return s, nil

  }

  // secretFunc returns byte slice of API secret keyword.
  func secretFunc(token *jwt.Token) (interface{}, error) {

  	return []byte(_secret), nil

  }