defmodule Ueberauth.Strategy.Apple do
  @moduledoc """
  Implementation of an Ueberauth Strategy for "Sign In with Apple".

  ## Configuration

  This provider supports the following configuration:

    * **Callback URL**: (Required) The URI to which the authorization redirects. It must include a
      domain name and can’t be an IP address or localhost. Apple will check the provided URL against
      the domains and redirect URIs configured in your Service ID. Defaults to
      `[...]/auth/:provider/callback` according to the configured provider name.

    * **Response mode**: How response information will be sent back to the server during the
      callback phase.. Valid values are `"query"`, `"fragment"`, and `"form_post"`. If you requested
      any scopes, the value must be `form_post`. Defaults to `"query"` if no scopes are requested,
      `"form_post"` otherwise.

    * **Scopes**: The amount of user information requested from Apple. Valid values are `name` and
      `email`, with multiple values separated by spaces. You can request one, both, or none.
      Defaults to no scopes (`""`).

  """
  use Ueberauth.Strategy, uid_field: :uid, default_scope: ""

  alias Ueberauth.Auth.Info
  alias Ueberauth.Auth.Credentials
  alias Ueberauth.Auth.Extra
  alias Ueberauth.Strategy.Apple.OAuth
  alias Ueberauth.Strategy.Apple.Token

  #
  # Request Phase
  #

  @doc """
  Handles initial request for Apple authentication.
  """
  @impl Ueberauth.Strategy
  @spec handle_request!(Plug.Conn.t()) :: Plug.Conn.t()
  def handle_request!(conn) do
    params =
      [response_type: "code id_token"]
      |> with_scopes_and_response_mode(conn)
      |> with_ueberauth_state_as_nonce(conn)

    opts = oauth_client_options_from_conn(conn)

    conn
    |> modify_ueberauth_state_cookie(params)
    |> redirect!(OAuth.authorize_url!(params, opts))
  end

  # If the response_mode is "form_post", then the state cookie must use SameSite=None and Secure;
  @spec modify_ueberauth_state_cookie(Plug.Conn.t(), keyword) :: Plug.Conn.t()
  defp modify_ueberauth_state_cookie(conn, params) do
    if Keyword.get(params, :response_mode) == "form_post" do
      state_cookie = conn.resp_cookies["ueberauth.state_param"]
      modified_cookie = Map.merge(state_cookie, %{same_site: "None", secure: true})

      %{conn | resp_cookies: Map.put(conn.resp_cookies, "ueberauth.state_param", modified_cookie)}
    else
      conn
    end
  end

  @spec with_ueberauth_state_as_nonce(keyword, Plug.Conn.t()) :: keyword
  defp with_ueberauth_state_as_nonce(params, conn) do
    if ueberauth_state = conn.private[:ueberauth_state_param] do
      params
      |> Keyword.put(:nonce, ueberauth_state)
      |> Keyword.put(:state, ueberauth_state)
    else
      params
    end
  end

  #
  # Callback Phase
  #

  @doc """
  Handles the callback from Apple.
  """
  @impl Ueberauth.Strategy
  @spec handle_callback!(Plug.Conn.t()) :: Plug.Conn.t()
  def handle_callback!(%Plug.Conn{params: %{"code" => code, "id_token" => token} = params} = conn) do
    ueberauth_state_or_nil =
      conn
      |> Plug.Conn.fetch_cookies()
      |> Plug.Conn.get_cookies()
      |> Map.get("ueberauth.state_param")

    opts =
      oauth_client_options_from_conn(conn)
      |> with_optional(:public_keys, conn)
      |> with_client_id()
      |> Keyword.put(:nonce, ueberauth_state_or_nil)

    with {:ok, token_payload} <- Token.payload(token, opts),
         user <- Map.merge(extract_user(params), extract_email_and_uid(token_payload)),
         {:ok, token} <- OAuth.get_access_token([code: code], opts) do
      conn
      |> put_private(:apple_token, token)
      |> put_private(:apple_user, user)
    else
      {:error, {error_code, error_description}} ->
        set_errors!(conn, [error(error_code, error_description)])

      {:error, reason} ->
        set_errors!(conn, [error(to_string(reason), "Error while reading authentication token")])
    end
  end

  def handle_callback!(%Plug.Conn{params: %{"error" => error}} = conn) do
    set_errors!(conn, [error("auth_failed", error)])
  end

  def handle_callback!(conn) do
    set_errors!(conn, [error("missing_code", "No code received")])
  end

  # Only the first login callback has user information; subsequent callbacks do not.
  @spec extract_user(map) :: map
  defp extract_user(%{"user" => user}), do: Ueberauth.json_library().decode!(user)
  defp extract_user(_params), do: %{}

  # Apple does not always send the email address
  @spec extract_email_and_uid(map) :: map
  defp extract_email_and_uid(%{"email" => e, "sub" => uid}), do: %{"email" => e, "uid" => uid}
  defp extract_email_and_uid(%{"sub" => uid}), do: %{"uid" => uid}

  #
  # Other Callbacks
  #

  @doc false
  @impl Ueberauth.Strategy
  @spec handle_cleanup!(Plug.Conn.t()) :: Plug.Conn.t()
  def handle_cleanup!(conn) do
    conn
    |> put_private(:apple_user, nil)
    |> put_private(:apple_token, nil)
  end

  @doc """
  Fetches the uid field from the response.
  """
  @impl Ueberauth.Strategy
  @spec uid(Plug.Conn.t()) :: binary | nil
  def uid(conn) do
    uid_field =
      conn
      |> option(:uid_field)
      |> to_string

    conn.private.apple_user[uid_field]
  end

  @doc """
  Includes the credentials from the Apple response.
  """
  @impl Ueberauth.Strategy
  @spec credentials(Plug.Conn.t()) :: Ueberauth.Auth.Credentials.t()
  def credentials(conn) do
    token = conn.private.apple_token
    scope_string = conn.params["scope"] || option(conn, :default_scope)
    scopes = String.split(scope_string, " ")

    %Credentials{
      expires: !!token.expires_at,
      expires_at: token.expires_at,
      scopes: scopes,
      token_type: Map.get(token, :token_type),
      refresh_token: token.refresh_token,
      token: token.access_token
    }
  end

  @doc """
  Fetches the fields to populate the info section of the `Ueberauth.Auth` struct.
  """
  @impl Ueberauth.Strategy
  @spec info(Plug.Conn.t()) :: Ueberauth.Auth.Info.t()
  def info(conn) do
    user = conn.private.apple_user
    name = user["name"]

    %Info{
      email: user["email"],
      first_name: name && name["firstName"],
      last_name: name && name["lastName"]
    }
  end

  @doc """
  Stores the raw information (including the token) obtained from the google callback.
  """
  @impl Ueberauth.Strategy
  @spec extra(Plug.Conn.t()) :: Ueberauth.Auth.Extra.t()
  def extra(conn) do
    %Extra{
      raw_info: %{
        token: conn.private.apple_token,
        user: conn.private.apple_user
      }
    }
  end

  #
  # Configuration Helpers
  #

  # From Apple documentation:
  #
  # response_mode
  #   The type of response mode expected. Valid values are query, fragment, and form_post. If you
  #   requested any scopes, the value must be form_post.
  #
  defp with_scopes_and_response_mode(opts, conn) do
    scopes = conn.params["scope"] || option(conn, :default_scope)

    if scopes != "" do
      Keyword.merge(opts, response_mode: "form_post", scope: scopes)
    else
      with_optional(opts, :response_mode, conn)
    end
  end

  # Temporary: use OAuth client configuration to get client_id.
  # This is done for backwards compatibility with existing configuration.
  defp with_client_id(opts) do
    client_id = OAuth.client(opts) |> Map.get(:client_id)
    Keyword.put(opts, :client_id, client_id)
  end

  defp with_optional(opts, key, conn) do
    if option(conn, key), do: Keyword.put(opts, key, option(conn, key)), else: opts
  end

  defp oauth_client_options_from_conn(conn) do
    base_options = [redirect_uri: callback_url(conn)]
    request_options = conn.private[:ueberauth_request_options].options

    case {request_options[:client_id], request_options[:client_secret]} do
      {nil, _} -> base_options
      {_, nil} -> base_options
      {id, secret} -> [client_id: id, client_secret: secret] ++ base_options
    end
  end

  defp option(conn, key) do
    Keyword.get(options(conn), key, Keyword.get(default_options(), key))
  end
end