content: /*
   * Licensed to the Apache Software Foundation (ASF) under one or more
   * contributor license agreements.  See the NOTICE file distributed with
   * this work for additional information regarding copyright ownership.
   * The ASF licenses this file to You under the Apache License, Version 2.0
   * (the "License"); you may not use this file except in compliance with
   * the License.  You may obtain a copy of the License at
   *
   *    http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  package org.apache.arrow.driver.jdbc.client.utils;
  
  import java.io.ByteArrayInputStream;
  import java.io.IOException;
  import java.io.InputStream;
  import java.io.StringWriter;
  import java.nio.charset.StandardCharsets;
  import java.nio.file.Files;
  import java.nio.file.Path;
  import java.nio.file.Paths;
  import java.security.GeneralSecurityException;
  import java.security.KeyStore;
  import java.security.KeyStoreException;
  import java.security.NoSuchAlgorithmException;
  import java.security.cert.Certificate;
  import java.security.cert.CertificateException;
  import java.util.ArrayList;
  import java.util.Arrays;
  import java.util.Collection;
  import java.util.Enumeration;
  import java.util.List;
  import org.apache.arrow.flight.CallOption;
  import org.apache.arrow.flight.FlightClient;
  import org.apache.arrow.flight.auth2.BasicAuthCredentialWriter;
  import org.apache.arrow.flight.auth2.ClientIncomingAuthHeaderMiddleware;
  import org.apache.arrow.flight.grpc.CredentialCallOption;
  import org.apache.arrow.util.Preconditions;
  import org.apache.arrow.util.VisibleForTesting;
  import org.bouncycastle.openssl.jcajce.JcaPEMWriter;
  
  /** Utils for {@link FlightClientHandler} authentication. */
  public final class ClientAuthenticationUtils {
  
    private ClientAuthenticationUtils() {
      // Prevent instantiation.
    }
  
    /**
     * Gets the {@link CredentialCallOption} for the provided authentication info.
     *
     * @param client the client.
     * @param credential the credential as CallOptions.
     * @param options the {@link CallOption}s to use.
     * @return the credential call option.
     */
    public static CredentialCallOption getAuthenticate(
        final FlightClient client,
        final CredentialCallOption credential,
        final CallOption... options) {
  
      final List<CallOption> theseOptions = new ArrayList<>();
      theseOptions.add(credential);
      theseOptions.addAll(Arrays.asList(options));
      client.handshake(theseOptions.toArray(new CallOption[0]));
  
      return (CredentialCallOption) theseOptions.get(0);
    }
  
    /**
     * Gets the {@link CredentialCallOption} for the provided authentication info.
     *
     * @param client the client.
     * @param username the username.
     * @param password the password.
     * @param factory the {@link ClientIncomingAuthHeaderMiddleware.Factory} to use.
     * @param options the {@link CallOption}s to use.
     * @return the credential call option.
     */
    public static CredentialCallOption getAuthenticate(
        final FlightClient client,
        final String username,
        final String password,
        final ClientIncomingAuthHeaderMiddleware.Factory factory,
        final CallOption... options) {
  
      return getAuthenticate(
          client,
          new CredentialCallOption(new BasicAuthCredentialWriter(username, password)),
          factory,
          options);
    }
  
    private static CredentialCallOption getAuthenticate(
        final FlightClient client,
        final CredentialCallOption token,
        final ClientIncomingAuthHeaderMiddleware.Factory factory,
        final CallOption... options) {
      final List<CallOption> theseOptions = new ArrayList<>();
      theseOptions.add(token);
      theseOptions.addAll(Arrays.asList(options));
      client.handshake(theseOptions.toArray(new CallOption[0]));
      return factory.getCredentialCallOption();
    }
  
    @VisibleForTesting
    static KeyStore getKeyStoreInstance(String instance)
        throws KeyStoreException, CertificateException, IOException, NoSuchAlgorithmException {
      KeyStore keyStore = KeyStore.getInstance(instance);
      keyStore.load(null, null);
  
      return keyStore;
    }
  
    @VisibleForTesting
    static KeyStore getDefaultKeyStoreInstance(String password)
        throws KeyStoreException, CertificateException, NoSuchAlgorithmException, IOException {
      try (InputStream fileInputStream = getKeystoreInputStream()) {
        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        keyStore.load(fileInputStream, password == null ? null : password.toCharArray());
        return keyStore;
      }
    }
  
    static String getOperatingSystem() {
      return System.getProperty("os.name");
    }
  
    /**
     * Check if the operating system running the software is Windows.
     *
     * @return whether is the windows system.
     */
    public static boolean isWindows() {
      return getOperatingSystem().contains("Windows");
    }
  
    /**
     * Check if the operating system running the software is Mac.
     *
     * @return whether is the mac system.
     */
    public static boolean isMac() {
      return getOperatingSystem().contains("Mac");
    }
  
    /**
     * It gets the trusted certificate based on the operating system and loads all the certificate
     * into a {@link InputStream}.
     *
     * @return An input stream with all the certificates.
     * @throws KeyStoreException if a key store could not be loaded.
     * @throws CertificateException if a certificate could not be found.
     * @throws IOException if it fails reading the file.
     */
    public static InputStream getCertificateInputStreamFromSystem(String password)
        throws KeyStoreException, CertificateException, IOException, NoSuchAlgorithmException {
  
      List<KeyStore> keyStoreList = new ArrayList<>();
      if (isWindows()) {
        keyStoreList.add(getKeyStoreInstance("Windows-ROOT"));
        keyStoreList.add(getKeyStoreInstance("Windows-MY"));
      } else if (isMac()) {
        keyStoreList.add(getKeyStoreInstance("KeychainStore"));
        keyStoreList.add(getDefaultKeyStoreInstance(password));
      } else {
        keyStoreList.add(getDefaultKeyStoreInstance(password));
      }
  
      return getCertificatesInputStream(keyStoreList);
    }
  
    @VisibleForTesting
    static InputStream getKeystoreInputStream() throws IOException {
      Path path = Paths.get(System.getProperty("java.home"), "lib", "security", "cacerts");
      if (Files.notExists(path)) {
        // for JDK8
        path = Paths.get(System.getProperty("java.home"), "jre", "lib", "security", "cacerts");
      }
      return Files.newInputStream(path);
    }
  
    @VisibleForTesting
    static void getCertificatesInputStream(KeyStore keyStore, JcaPEMWriter pemWriter)
        throws IOException, KeyStoreException {
      Enumeration<String> aliases = keyStore.aliases();
      while (aliases.hasMoreElements()) {
        String alias = aliases.nextElement();
        if (keyStore.isCertificateEntry(alias)) {
          pemWriter.writeObject(keyStore.getCertificate(alias));
        }
      }
      pemWriter.flush();
    }
  
    @VisibleForTesting
    static InputStream getCertificatesInputStream(Collection<KeyStore> keyStores)
        throws IOException, KeyStoreException {
      try (final StringWriter writer = new StringWriter();
          final JcaPEMWriter pemWriter = new JcaPEMWriter(writer)) {
  
        for (KeyStore keyStore : keyStores) {
          getCertificatesInputStream(keyStore, pemWriter);
        }
  
        return new ByteArrayInputStream(writer.toString().getBytes(StandardCharsets.UTF_8));
      }
    }
  
    /**
     * Generates an {@link InputStream} that contains certificates for a private key.
     *
     * @param keyStorePath The path of the KeyStore.
     * @param keyStorePass The password of the KeyStore.
     * @return a new {code InputStream} containing the certificates.
     * @throws GeneralSecurityException on error.
     * @throws IOException on error.
     */
    public static InputStream getCertificateStream(
        final String keyStorePath, final String keyStorePass)
        throws GeneralSecurityException, IOException {
      Preconditions.checkNotNull(keyStorePath, "KeyStore path cannot be null!");
      Preconditions.checkNotNull(keyStorePass, "KeyStorePass cannot be null!");
      final KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
  
      try (final InputStream keyStoreStream = Files.newInputStream(Paths.get(keyStorePath))) {
        keyStore.load(keyStoreStream, keyStorePass.toCharArray());
      }
  
      return getSingleCertificateInputStream(keyStore);
    }
  
    /**
     * Generates an {@link InputStream} that contains certificates for path-based TLS Root
     * Certificates.
     *
     * @param tlsRootsCertificatesPath The path of the TLS Root Certificates.
     * @return a new {code InputStream} containing the certificates.
     * @throws GeneralSecurityException on error.
     * @throws IOException on error.
     */
    public static InputStream getTlsRootCertificatesStream(final String tlsRootsCertificatesPath)
        throws GeneralSecurityException, IOException {
      Preconditions.checkNotNull(
          tlsRootsCertificatesPath, "TLS Root certificates path cannot be null!");
  
      return Files.newInputStream(Paths.get(tlsRootsCertificatesPath));
    }
  
    /**
     * Generates an {@link InputStream} that contains certificates for a path-based mTLS Client
     * Certificate.
     *
     * @param clientCertificatePath The path of the mTLS Client Certificate.
     * @return a new {code InputStream} containing the certificates.
     * @throws GeneralSecurityException on error.
     * @throws IOException on error.
     */
    public static InputStream getClientCertificateStream(final String clientCertificatePath)
        throws GeneralSecurityException, IOException {
      Preconditions.checkNotNull(clientCertificatePath, "Client certificate path cannot be null!");
  
      return Files.newInputStream(Paths.get(clientCertificatePath));
    }
  
    /**
     * Generates an {@link InputStream} that contains certificates for a path-based mTLS Client Key.
     *
     * @param clientKeyPath The path of the mTLS Client Key.
     * @return a new {code InputStream} containing the certificates.
     * @throws GeneralSecurityException on error.
     * @throws IOException on error.
     */
    public static InputStream getClientKeyStream(final String clientKeyPath)
        throws GeneralSecurityException, IOException {
      Preconditions.checkNotNull(clientKeyPath, "Client key path cannot be null!");
  
      return Files.newInputStream(Paths.get(clientKeyPath));
    }
  
    private static InputStream getSingleCertificateInputStream(KeyStore keyStore)
        throws KeyStoreException, IOException, CertificateException {
      final Enumeration<String> aliases = keyStore.aliases();
  
      while (aliases.hasMoreElements()) {
        final String alias = aliases.nextElement();
        if (keyStore.isCertificateEntry(alias)) {
          return toInputStream(keyStore.getCertificate(alias));
        }
      }
  
      throw new CertificateException("Keystore did not have a certificate.");
    }
  
    private static InputStream toInputStream(final Certificate certificate) throws IOException {
  
      try (final StringWriter writer = new StringWriter();
          final JcaPEMWriter pemWriter = new JcaPEMWriter(writer)) {
  
        pemWriter.writeObject(certificate);
        pemWriter.flush();
        return new ByteArrayInputStream(writer.toString().getBytes(StandardCharsets.UTF_8));
      }
    }
  }
  