//! Sealed alerts (oxygenhub-android#16): what a phone is told about a job,
//! encrypted to a key the phone made, so the push service that carries it
//! (Firebase Cloud Messaging) sees only ciphertext.
//!
//! The phone keeps an X25519 secret and gives the hub its public key. For
//! each alert the hub makes a fresh X25519 key, agrees a secret with the
//! phone's key, derives a ChaCha20-Poly1305 key with HKDF-SHA256 (salted
//! with both public keys) and encrypts once under it with a zero nonce:
//! the key is never used twice. A sealed alert is the fresh public key (32
//! bytes) followed by the ciphertext and its tag.

use curve25519_dalek::montgomery::MontgomeryPoint;
use ring::aead::{Aad, LessSafeKey, Nonce, UnboundKey, CHACHA20_POLY1305};
use ring::hkdf;
use ring::rand::{SecureRandom, SystemRandom};

/// What HKDF binds the key to, so a key for anything else never fits.
const INFO: &[u8] = b"oxygenhub alert v1";

/// A new X25519 secret, for a phone to keep.
pub fn new_secret() -> [u8; 32] {
    let mut s = [0u8; 32];
    SystemRandom::new().fill(&mut s).expect("the system's random source");
    s
}

/// The public key of `secret`, for the hub.
pub fn public_key(secret: &[u8; 32]) -> [u8; 32] {
    MontgomeryPoint::mul_base_clamped(*secret).to_bytes()
}

fn key(shared: &MontgomeryPoint, ephemeral: &[u8; 32], recipient: &[u8; 32]) -> Option<LessSafeKey> {
    // An all-zero agreement means a low-order point was given: refuse it.
    if shared.to_bytes() == [0u8; 32] {
        return None;
    }
    let mut salt = [0u8; 64];
    salt[..32].copy_from_slice(ephemeral);
    salt[32..].copy_from_slice(recipient);
    let prk = hkdf::Salt::new(hkdf::HKDF_SHA256, &salt).extract(shared.as_bytes());
    let okm = prk.expand(&[INFO], &CHACHA20_POLY1305).ok()?;
    let mut bytes = [0u8; 32];
    okm.fill(&mut bytes).ok()?;
    Some(LessSafeKey::new(UnboundKey::new(&CHACHA20_POLY1305, &bytes).ok()?))
}

/// Seal `message` to the phone whose public key is `recipient`; `None`
/// when that key is unusable.
pub fn seal(recipient: &[u8; 32], message: &[u8]) -> Option<Vec<u8>> {
    let e = new_secret();
    let ephemeral = public_key(&e);
    let shared = MontgomeryPoint(*recipient).mul_clamped(e);
    let key = key(&shared, &ephemeral, recipient)?;
    let mut sealed = message.to_vec();
    key.seal_in_place_append_tag(Nonce::assume_unique_for_key([0u8; 12]), Aad::empty(), &mut sealed).ok()?;
    let mut out = ephemeral.to_vec();
    out.extend(sealed);
    Some(out)
}

/// Open an alert sealed to the phone whose secret is `secret`; `None` when
/// it was not sealed to it or was changed on the way.
pub fn open(secret: &[u8; 32], sealed: &[u8]) -> Option<Vec<u8>> {
    if sealed.len() < 32 + CHACHA20_POLY1305.tag_len() {
        return None;
    }
    let ephemeral: [u8; 32] = sealed[..32].try_into().ok()?;
    let shared = MontgomeryPoint(ephemeral).mul_clamped(*secret);
    let key = key(&shared, &ephemeral, &public_key(secret))?;
    let mut body = sealed[32..].to_vec();
    let plain = key.open_in_place(Nonce::assume_unique_for_key([0u8; 12]), Aad::empty(), &mut body).ok()?;
    Some(plain.to_vec())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn a_sealed_alert_opens_only_with_its_phones_key() {
        let phone = new_secret();
        let sealed = seal(&public_key(&phone), b"run #5: test passed").unwrap();
        assert_eq!(open(&phone, &sealed).as_deref(), Some(&b"run #5: test passed"[..]));
        // Each alert has its own key: the same message seals differently.
        assert_ne!(seal(&public_key(&phone), b"run #5: test passed").unwrap(), sealed);
        assert!(open(&new_secret(), &sealed).is_none(), "another phone");
        let mut changed = sealed.clone();
        *changed.last_mut().unwrap() ^= 1;
        assert!(open(&phone, &changed).is_none(), "changed on the way");
        assert!(open(&phone, &sealed[..40]).is_none(), "cut short");
        // A low-order public key (all zeros) is refused, not sealed to.
        assert!(seal(&[0u8; 32], b"x").is_none());
    }
}