content: /*
   *  Licensed to the Apache Software Foundation (ASF) under one
   *  or more contributor license agreements.  See the NOTICE file
   *  distributed with this work for additional information
   *  regarding copyright ownership.  The ASF licenses this file
   *  to you under the Apache License, Version 2.0 (the
   *  "License"); you may not use this file except in compliance
   *  with the License.  You may obtain a copy of the License at
   *
   *        http://www.apache.org/licenses/LICENSE-2.0
   *
   *  Unless required by applicable law or agreed to in writing,
   *  software distributed under the License is distributed on an
   *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
   *  KIND, either express or implied.  See the License for the
   *  specific language governing permissions and limitations
   *  under the License.
   */
  package org.apache.causeway.viewer.wicket.viewer.wicketapp;
  
  import java.security.SecureRandom;
  import java.security.spec.KeySpec;
  import java.util.Random;
  
  import javax.crypto.SecretKey;
  import javax.crypto.SecretKeyFactory;
  import javax.crypto.spec.PBEKeySpec;
  import javax.crypto.spec.SecretKeySpec;
  
  import org.apache.wicket.core.random.DefaultSecureRandomSupplier;
  import org.apache.wicket.core.random.ISecureRandomSupplier;
  import org.apache.wicket.core.util.crypt.AESCrypt;
  import org.apache.wicket.util.crypt.ICrypt;
  import org.apache.wicket.util.crypt.NoCrypt;
  import org.apache.wicket.util.crypt.SunJceCrypt;
  
  import org.apache.causeway.commons.internal.os._OsUtil;
  
  import lombok.SneakyThrows;
  import lombok.experimental.UtilityClass;
  
  @UtilityClass
  class _CryptFactory {
  
      static final String FIXED_SALT_FOR_PROTOTYPING = "PrototypingEncryptionKey";
  
      ICrypt sunJceCrypt(final String encryptionKey) {
          final byte[] salt = getSalt(8, encryptionKey);
          var crypt = new SunJceCrypt(salt, 1000);
          crypt.setKey(encryptionKey);
          return crypt;
      }
  
      @SneakyThrows
      ICrypt aesCrypt(final String encryptionKey) {
  
          final byte[] salt = getSalt(8, encryptionKey);
  
          SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
          KeySpec spec = new PBEKeySpec(encryptionKey.toCharArray(), salt, 65536, 256);
          SecretKey tmp = factory.generateSecret(spec);
          SecretKey secret = new SecretKeySpec(tmp.getEncoded(), "AES");
  
          ISecureRandomSupplier rGen = new DefaultSecureRandomSupplier();
  
          return new AESCrypt(secret, rGen);
      }
  
      ICrypt noCrypt(final String encryptionKey) {
          return new NoCrypt();
      }
  
      //XXX what about BCryptPasswordEncoder (Spring);
  
      // -- HELPER
  
      /**
       * @param size
       *      must be 8 bytes - for anything else PBES1Core throws
       *      InvalidAlgorithmParameterException: Salt must be 8 bytes long
       */
      private byte[] getSalt(final int size, final String encryptionKey) {
          final byte[] salt = FIXED_SALT_FOR_PROTOTYPING.equals(encryptionKey)
                  ? machineFixedSalt(size)
                  : secureSalt(size);
          return salt;
      }
  
      /**
       * Cloned from {@link SunJceCrypt#randomSalt()},
       * but using {@link SecureRandom} instead of {@link Random}.
       */
      private byte[] secureSalt(final int size) {
          var salt = new byte[size];
          new SecureRandom().nextBytes(salt);
          return salt;
      }
  
      private byte[] machineFixedSalt(final int size) {
          var machineFixedSeed = _OsUtil.machineId();
          if(machineFixedSeed.isEmpty()){
              return secureSalt(size);
          }
          var salt = new byte[size];
          /*sonar-ignore-on*/
          new Random(machineFixedSeed.getAsLong()).nextBytes(salt); // not required to be secure
          /*sonar-ignore-off*/
          return salt;
      }
  
  }
  