package net.lulli.certsigner.util;

import net.lulli.certsigner.Settings;
import net.lulli.certsigner.ca.CertificateIssue;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.pkcs.PKCS10CertificationRequest;
import org.bouncycastle.util.encoders.Base64;

import java.io.*;
import java.security.*;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;

public class FileCAUtils {

    public static void initializeCa(
            String rootSubject,
            String dirName,
            String keystorePassword
    ) {
        try {
            Security.addProvider(new BouncyCastleProvider());

            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(Settings.KEY_ALGORITHM, Settings.BC_PROVIDER);
            keyPairGenerator.initialize(2048);
            KeyPair rootKeyPair = keyPairGenerator.generateKeyPair();

            X509Certificate rootCert = CertificateIssue.rootCertificate(rootKeyPair.getPublic(), rootKeyPair.getPrivate(), rootSubject);

            certToPemFile(rootCert, dirName + "/root-cert.pem");
            keyPairToKeystore(rootKeyPair, rootCert, "root-cert", dirName, "PKCS12", keystorePassword);
            String pemCertificate = PemUtil.toString(rootCert);

        } catch (Exception e) {
            throw new IllegalStateException(e.getMessage());
        }
    }

    public static String signCertificateWithRootKeystore(
            String rootKeystoreFileName,
            String rootKeystorePassword,
            PKCS10CertificationRequest csr,
            String rootSubject,
            String certificateTargetDir,
            String commonName
    ) {
        try {
            System.out.println(certificateTargetDir);
            Security.addProvider(new BouncyCastleProvider());
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(Settings.KEY_ALGORITHM, Settings.BC_PROVIDER);

            KeyStore ks = KeyStore.getInstance("pkcs12");
            System.out.println("rootKeystoreFileName:" + rootKeystoreFileName);
            ks.load(new FileInputStream(rootKeystoreFileName), rootKeystorePassword.toCharArray());

            X509Certificate rootCert = (X509Certificate) ks.getCertificate("root-cert");

            KeyPair issuedCertKeyPair = keyPairGenerator.generateKeyPair();
            X509Certificate issuedCert = CertificateIssue.clientCertificate(
                    issuedCertKeyPair.getPrivate(), rootSubject, rootCert, csr);

            issuedCert.verify(issuedCertKeyPair.getPublic(), Settings.BC_PROVIDER);

            certToPemFile(issuedCert, certificateTargetDir + "/" + commonName + ".pem");
            keyPairToKeystore(issuedCertKeyPair, issuedCert, commonName, certificateTargetDir, "PKCS12", "pass");

            Serde.toFile(issuedCertKeyPair.getPrivate(), certificateTargetDir + "/" + commonName + ".key");

            return PemUtil.toString(issuedCert);
        } catch (Exception e) {
            throw new IllegalStateException(e.getMessage());
        }
    }


    public static void signCertificate(
            String rootCaPublicKeyFileName,
            String rootCertFileName,
            PKCS10CertificationRequest csr,
            String rootSubject,
            String dirName,
            String commonName
    ) {
        try {
            Security.addProvider(new BouncyCastleProvider());
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(Settings.KEY_ALGORITHM, Settings.BC_PROVIDER);

            PublicKey caPublicKey = Serde.publicKeyFromFile(rootCaPublicKeyFileName);
            X509Certificate rootCert = Serde.certificateFromFile(rootCertFileName);

            KeyPair issuedCertKeyPair = keyPairGenerator.generateKeyPair();
            X509Certificate issuedCert = CertificateIssue.clientCertificate(
                    issuedCertKeyPair.getPrivate(),
                    rootSubject,
                    rootCert,
                    csr);

            issuedCert.verify(caPublicKey, Settings.BC_PROVIDER);

            //writeCertToFileBase64Encoded(issuedCert, commonName + ".cer");
            //exportKeyPairToKeystoreFile(issuedCertKeyPair, issuedCert, commonName, commonName + ".p12", "PKCS12", "pass");
            Serde.toFile(issuedCertKeyPair.getPrivate(), dirName + "/" + commonName + ".key");
        } catch (Exception e) {
            throw new IllegalStateException(e.getMessage());
        }
    }





    static void keyPairToKeystore(KeyPair keyPair, Certificate certificate, String alias, String dirName, String storeType, String storePass) {
        try {
            KeyStore sslKeyStore = KeyStore.getInstance(storeType, Settings.BC_PROVIDER);
            sslKeyStore.load(null, null);
            sslKeyStore.setKeyEntry(alias, keyPair.getPrivate(), null, new java.security.cert.Certificate[]{certificate});
            FileOutputStream keyStoreOs = new FileOutputStream(dirName + "/" + alias + ".p12");
            sslKeyStore.store(keyStoreOs, storePass.toCharArray());
        } catch (Exception e) {
            throw new IllegalStateException(e.getMessage());
        }
    }

    static void certToPemFile(Certificate certificate, String fileName) throws Exception {
        FileOutputStream certificateOut = new FileOutputStream(fileName);
        certificateOut.write("-----BEGIN CERTIFICATE-----\n".getBytes());
        certificateOut.write(Base64.encode(certificate.getEncoded()));
        certificateOut.write("-----END CERTIFICATE-----\n".getBytes());
        certificateOut.close();
    }
}