using System;
using System.Data;
using System.Web;
using System.Web.Configuration;
using System.Web.Security;
using System.Linq;
using System.Xml.Linq;
using Neo.Afx.Utilities;
using DPUruNet;

namespace Neo.Afx.Security
{
    /// <summary>
    /// Manages authentication to a <see cref="DomainMembershipProvider"/>.
    /// </summary>
    public static class DomainAuthenticationProvider
    {
        private const int DPFJ_PROBABILITY_ONE = 0x7fffffff;
        const string EventSource = "DomainAuthenticationProvider";
        //const string ExceptionMessage = "An exception occurred. Please check the log.";

        #region AuthenticationMode

        /// <summary>
        /// Gets the<see cref="AuthenticationMode"/>.
        /// </summary>
        public static AuthenticationMode AuthenticationMode
        {
            get
            {
                var authType = HttpContext.Current.User.Identity.AuthenticationType;
                return (string.IsNullOrEmpty(authType) || authType == "Forms") ? AuthenticationMode.Forms : AuthenticationMode.Windows;
            }
        }

        #endregion

        #region DefaultUrl

        /// <summary>
        /// Gets the default URL.
        /// </summary>
        public static string DefaultUrl
        {
            get
            {
                return FormsAuthentication.DefaultUrl.TrimStart('/');
            }
        }

        #endregion

        #region Signout

        /// <summary>
        /// Sign the user out if the user was signed in using forms authentication.
        /// </summary>
        public static void Signout()
        {
            if(AuthenticationMode == AuthenticationMode.Forms)
            {
                // Destroy the user's authentication cookie.
                FormsAuthentication.SignOut();

                // abandon a session and clear the session ID cookie.
                HttpContext.Current.Session.Abandon();
                HttpContext.Current.Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", ""));
            }
        }

        #endregion

        #region SetAuthCookie

        /// <summary>
        /// Sets the auth cookie.
        /// </summary>
        /// <param name="userName">The name of the user.</param>
        /// <param name="persistent"><code>true</code> if [persistent]; <code>false</code> otherwise.</param>
        /// <param name="data">The data to be stored in the ticket.</param>
        public static void SetAuthCookie(string userName, bool persistent, string data = null)
        {
            // Notice that this cookie will have all the attributes according to 
            // the ones in the config file setting.      
            var cookie = FormsAuthentication.GetAuthCookie(userName, persistent);
            var ticket = FormsAuthentication.Decrypt(cookie.Value);

            // Store the Guid inside the Forms Ticket with all the attributes 
            // aligned with the config Forms section.
            var newticket = new FormsAuthenticationTicket(
                ticket.Version,
                ticket.Name,
                ticket.IssueDate,
                ticket.Expiration,
                persistent,
                data,
                ticket.CookiePath);

            var encryptedTicket = FormsAuthentication.Encrypt(newticket);

            FormsAuthentication.SetAuthCookie(userName, persistent);            
        }

        #endregion

        #region GetUserID

        /// <summary>
        /// Gets the ID of the current user.
        /// </summary>
        /// <returns>The ID of the user; -1 if not found.</returns>
        public static long GetUserID()
        {
            return GetUserID(HttpContext.Current.User.Identity.Name);
        }

        /// <summary>
        /// Gets the user ID.
        /// </summary>
        /// <param name="userName">The name of the user to retrieved.</param>
        /// <returns>The ID of the user; -1 if not found.</returns>
        public static long GetUserID(string userName)
        {
            var membershipProvider = (DomainMembershipProvider)Membership.Provider;
            return membershipProvider.GetUserID(userName, AuthenticationMode);
        }

        #endregion

        #region ValidateWindowsUser

        /// <summary>
        /// Verifies that the current windows user is authenticated and valid; if so, sets the forms auth cookie.
        /// </summary>
        /// <returns><code>true</code> if the windows user is authenticated and valid; <code>false</code> otherwise.</returns>
        public static bool ValidateWindowsUser()
        {
            var context = HttpContext.Current;
            if(context.User.Identity.IsAuthenticated)
            {
                var membershipProvider = (DomainMembershipProvider)Membership.Provider;
                try
                {
                    var wi = context.Request.LogonUserIdentity;
                    if(wi != null)
                    {
                        var userName = membershipProvider.GetUserName(wi.Name);
                        if(userName != null)
                        {
                            SetAuthCookie(userName, false, "AuthType=Windows");
                            return true;
                        }
                    }
                }
                // ReSharper disable EmptyGeneralCatchClause
                catch
                // ReSharper restore EmptyGeneralCatchClause
                {
                    // DomainMembershipProvider writes exception to event log
                }
            }
            return false;
        }

        #endregion

        #region ValidateUser

        #region ValidateUser(string userName, string password, bool rememberMe)
        /// <summary>
        /// Verifies that the given user name and password are valid.
        /// </summary>
        /// <param name="userName">The user name to be verified.</param>
        /// <param name="password">The password to be verified.</param>
        /// <param name="rememberMe"><code>true</code> if the authentication cookie should be persisted; <code>false</code> otherwise.</param>
        /// <returns><code>true</code> if the user name and password are valid; <code>false</code> otherwise.</returns>
        public static bool ValidateUser(string userName, string password, bool rememberMe)
        {
            var membershipProvider = (DomainMembershipProvider)Membership.Provider;
            try
            {
                var token = membershipProvider.GetToken(userName);
                if(token != null)
                {
                    var challengeToken = XElement.Parse(token);
                    var credentials = SecurePassword.CreateSecureCredentials(challengeToken, password);

                    if(Membership.ValidateUser(userName, credentials))
                    {
                        SetAuthCookie(userName, rememberMe, "AuthType=Forms");
                        return true;
                    }
                }
            }
            // ReSharper disable EmptyGeneralCatchClause
            catch
            // ReSharper restore EmptyGeneralCatchClause
            {
                // DomainMembershipProvider writes exception to event log
            }
            return false;
        }
        #endregion

        #region ValidateUser(string fingerPrint, bool rememberMe, ref string userName)
        /// <summary>
        /// Verifies that the given fingerprint is valid
        /// </summary>
        /// <param name="fingerPrint">The fingerprint to be verified.</param>
        /// <param name="rememberMe"><code>true</code> if the authentication cookie should be persisted; <code>false</code> otherwise.</param>
        /// <returns><code>true</code> if the fingerprint valid; <code>false</code> otherwise.</returns>
        public static bool ValidateUser(string fingerPrint, bool rememberMe, ref string userName)
        {
            return ValidateUser(fingerPrint, rememberMe, 0, ref userName);
        }
        #endregion

        #region  ValidateUser(string fingerPrint, bool rememberMe, long userID, ref string userName)
        /// <summary>
        /// Verifies that the given fingerprint is valid
        /// </summary>
        /// <param name="fingerPrint">The fingerprint to be verified.</param>
        /// <param name="rememberMe"><code>true</code> if the authentication cookie should be persisted; <code>false</code> otherwise.</param>
        /// <returns><code>true</code> if the fingerprint valid; <code>false</code> otherwise.</returns>
        public static bool ValidateUser(string fingerPrint, bool rememberMe, long userID, ref string userName)
        {
            var validUserFound = false;
            int thresholdScore = DPFJ_PROBABILITY_ONE * 1 / 100000;
            var membershipProvider = (DomainMembershipProvider)Membership.Provider;

            try
            {
                var fingerprintBytes = Convert.FromBase64String(fingerPrint);
                Fmd fmd = new Fmd(fingerprintBytes, (int)Constants.Formats.Fmd.DP_VERIFICATION, "1.0.0");
               
                using (var fingerPrintTable = membershipProvider.GetUserFingerprintTemplates())
                {
                    if (fingerPrintTable.Rows.Count > 0)
                    {
                        //If a userid was provided, check if you can find the id in the list and check that fingerprint first
                        if (userID > 0)
                        {
                            var r = fingerPrintTable.AsEnumerable().Where(a => a.Field<long>("UserID") == userID).FirstOrDefault();
                            if (r != null)
                            {                                
                                Fmd[] fmds = new Fmd[1];
                                fmds[0] = new Fmd((Byte[])r.Field<dynamic>("FingerprintTemplate"), (int)Constants.Formats.Fmd.DP_REGISTRATION, "1.0.0");       
                                                               
                                IdentifyResult identifyResult = Comparison.Identify(fmd, 0, fmds, thresholdScore, 2);
                                if (identifyResult.ResultCode == Constants.ResultCode.DP_SUCCESS)
                                {
                                    if (identifyResult.Indexes.Length == 1)
                                    { 
                                        SetAuthCookie(r.Field<string>("Email").ToString(), rememberMe, "AuthType=Forms");
                                        userName = r.Field<string>("Email").ToString();
                                        validUserFound = true;    
                                    }
                                }                                                                        
                            }
                        }

                        //if the specified user was not found, check all the other users
                        if (!validUserFound)
                        {
                            foreach (DataRow r in fingerPrintTable.Rows)
                            {
                                Fmd[] fmds = new Fmd[1];
                                fmds[0] = new Fmd((Byte[])r.Field<dynamic>("FingerprintTemplate"), (int)Constants.Formats.Fmd.DP_REGISTRATION, "1.0.0");       
                                                               
                                IdentifyResult identifyResult = Comparison.Identify(fmd, 0, fmds, thresholdScore, 2);
                                if (identifyResult.ResultCode == Constants.ResultCode.DP_SUCCESS)
                                {
                                    if (identifyResult.Indexes.Length == 1)
                                    { 
                                        SetAuthCookie(r.Field<string>("Email").ToString(), rememberMe, "AuthType=Forms");
                                        userName = r.Field<string>("Email").ToString();
                                        validUserFound = true;   
                                        break;
                                    }
                                }         
                            }
                        }
                    }
                }
            }
            // ReSharper disable EmptyGeneralCatchClause
            catch (Exception ex)
            // ReSharper restore EmptyGeneralCatchClause
            {
                // DomainMembershipProvider writes exception to event log
            }

            return validUserFound;
        }
        #endregion

        #endregion

        #region GetResetQuestion

        /// <summary>
        /// Gets the password question for the user.
        /// </summary>
        /// <param name="userName">The user name to be queried.</param>
        /// <returns>The password question for the user.</returns>
        public static string GetResetQuestion(string userName)
        {
            var membershipProvider = (DomainMembershipProvider)Membership.Provider;
            return membershipProvider.GetPasswordQuestion(userName);
        }

        #endregion

        #region ResetPassword

        /// <summary>
        /// Resets a user's password to a new, automatically generated password.
        /// </summary>
        /// <param name="userName">The user to reset the password for.</param>
        /// <param name="question">The password question for the specified user.</param>
        /// <param name="answer">The password answer for the specified user.</param>
        /// <returns>The new password for the specified user.</returns>
        public static bool ResetPassword(string userName, string question, string answer)
        {
            var membershipProvider = (DomainMembershipProvider)Membership.Provider;
            try
            {
                var token = membershipProvider.GetResetToken(userName);
                if(token != null)
                {
                    var challengeToken = XElement.Parse(token);
                    if(challengeToken.Value == question)
                    {
                        var credentials = SecurePassword.CreateSecureCredentials(challengeToken, answer);
                        membershipProvider.ResetPassword(userName, credentials);
                        return true;
                    }
                }
            }
            // ReSharper disable EmptyGeneralCatchClause
            catch
            // ReSharper restore EmptyGeneralCatchClause
            {
                // DomainMembershipProvider writes exception to event log
            }
            return false;
        }

        #endregion

    }
}