//! The phone as a second factor (oxygenhub#356): a P-256 key made in the
//! phone's Keystore, usable only after a fingerprint, face or the device
//! PIN, signs each approval; the browser shows one number and the phone
//! offers three, so a tap without reading approves nothing.

use crate::db::{self, accounts::Account, approvals};
use crate::Shared;
use rand::{seq::SliceRandom, Rng, RngCore};
use ring::signature::{UnparsedPublicKey, ECDSA_P256_SHA256_ASN1};

/// How long a phone has to answer.
pub const APPROVAL_MS: i64 = 2 * 60_000;
/// How long a proved second factor lets a session past the sudo step.
pub const FRESH_MS: i64 = 15 * 60_000;

/// The DER header of a P-256 SubjectPublicKeyInfo (what Android's
/// `PublicKey.getEncoded()` gives), before the 65-byte point.
const P256_SPKI: [u8; 26] = [
    0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01,
    0x07, 0x03, 0x42, 0x00,
];

/// A phone's public key, given as hex of its SubjectPublicKeyInfo or of
/// the bare uncompressed point: the point, as hex. None when it is
/// neither, or not on the curve.
pub fn public_point(hex_key: &str) -> Option<String> {
    let bytes = hex::decode(hex_key.trim()).ok()?;
    let point = match bytes.len() {
        91 if bytes[..26] == P256_SPKI => &bytes[26..],
        65 => &bytes[..],
        _ => return None,
    };
    if point[0] != 0x04 {
        return None;
    }
    // ring checks that the point is on the curve when it verifies, so a
    // bad key only ever fails to verify.
    Some(hex::encode(point))
}

/// What the phone signs to answer approval `id`.
pub fn message(id: &str, number: i64, approve: bool) -> Vec<u8> {
    format!("oxygenhub approval v1\n{id}\n{number}\n{}", if approve { "approve" } else { "deny" }).into_bytes()
}

/// Whether `signature` (DER, as ECDSA gives it) is the phone's over `msg`.
pub fn verify(point_hex: &str, msg: &[u8], signature: &[u8]) -> bool {
    let Ok(point) = hex::decode(point_hex) else { return false };
    UnparsedPublicKey::new(&ECDSA_P256_SHA256_ASN1, point).verify(msg, signature).is_ok()
}

/// Three different two-digit numbers in a random order, and the one the
/// browser shows.
pub fn numbers() -> (i64, [i64; 3]) {
    let mut rng = rand::thread_rng();
    let mut all: Vec<i64> = (10..100).collect();
    all.shuffle(&mut rng);
    let choices = [all[0], all[1], all[2]];
    (choices[rng.gen_range(0..3)], choices)
}

fn new_id() -> String {
    let mut b = [0u8; 16];
    rand::rngs::OsRng.fill_bytes(&mut b);
    hex::encode(b)
}

/// Ask the account's phones to approve `what`: recorded, and sent as an
/// alert where alerts are on (the app also looks when it opens). For a
/// step-up, `session_id` is the browser session it makes fresh.
pub async fn ask(app: &Shared, account: &Account, kind: &str, what: &str, session_id: Option<i64>) -> sqlx::Result<approvals::Approval> {
    let id = new_id();
    let (number, choices) = numbers();
    let choices = choices.iter().map(|n| n.to_string()).collect::<Vec<_>>().join(",");
    let what: String = what.chars().take(200).collect();
    approvals::create(
        &app.db,
        approvals::NewApproval {
            id: &id,
            account_id: account.id,
            kind,
            what: &what,
            number,
            choices: &choices,
            session_id,
            expires_ms: db::now_ms() + APPROVAL_MS,
        },
    )
    .await?;
    crate::push::send(app, account.id, crate::push::Alert { kind: "approval".into(), title: what, url: format!("/approvals/{id}") });
    Ok(approvals::get(&app.db, &id).await?.expect("just made"))
}

#[cfg(test)]
mod tests {
    use super::*;
    use ring::rand::SystemRandom;
    use ring::signature::{EcdsaKeyPair, KeyPair, ECDSA_P256_SHA256_ASN1_SIGNING};

    #[test]
    fn a_phone_signature_verifies_and_nothing_else_does() {
        let rng = SystemRandom::new();
        let pkcs8 = EcdsaKeyPair::generate_pkcs8(&ECDSA_P256_SHA256_ASN1_SIGNING, &rng).unwrap();
        let pair = EcdsaKeyPair::from_pkcs8(&ECDSA_P256_SHA256_ASN1_SIGNING, pkcs8.as_ref(), &rng).unwrap();
        let point = hex::encode(pair.public_key().as_ref());
        let spki = format!("{}{point}", hex::encode(P256_SPKI));
        assert_eq!(public_point(&spki).as_deref(), Some(point.as_str()), "the Keystore's encoding");
        assert_eq!(public_point(&point).as_deref(), Some(point.as_str()), "a bare point");
        assert_eq!(public_point("00ff"), None);
        let m = message("ab", 47, true);
        let sig = pair.sign(&rng, &m).unwrap();
        assert!(verify(&point, &m, sig.as_ref()));
        assert!(!verify(&point, &message("ab", 48, true), sig.as_ref()), "another number");
        assert!(!verify(&point, &message("ab", 47, false), sig.as_ref()), "a denial is not an approval");
        assert!(!verify(&point, &message("ac", 47, true), sig.as_ref()), "another approval");
    }

    #[test]
    fn three_different_numbers_one_shown() {
        for _ in 0..200 {
            let (n, c) = numbers();
            assert!(c.contains(&n));
            assert!(c[0] != c[1] && c[1] != c[2] && c[0] != c[2]);
            assert!(c.iter().all(|x| (10..100).contains(x)));
        }
    }
}