/*

 * Copyright (c) 2019, Red Hat, Inc.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.krb5.internal;

import java.io.IOException;

import sun.security.krb5.Asn1Exception;

import sun.security.krb5.internal.util.KerberosFlags;

import sun.security.util.DerOutputStream;

import sun.security.util.DerValue;

/**

 * Implements the ASN.1 PA-PAC-OPTIONS type.

 *

 * <pre>{@code

 * PA-PAC-OPTIONS ::= SEQUENCE {

 * KerberosFlags

 *   -- Claims (0)

 *   -- Branch Aware (1)

 *   -- Forward to Full DC (2)

 * }

 * Note: KerberosFlags   ::= BIT STRING (SIZE (32..MAX))

 *         -- minimum number of bits shall be sent, but no fewer than 32

 *

 * PA-PAC-OPTIONS ::= KerberosFlags

 *   -- resource-based constrained delegation (3)

 * }</pre>

 *

 * This definition reflects MS-KILE (section 2.2.10)

 * and MS-SFU (section 2.2.5).

 */

public class PaPacOptions {

    private static final int CLAIMS = 0;

    private static final int BRANCH_AWARE = 1;

    private static final int FORWARD_TO_FULL_DC = 2;

    private static final int RESOURCE_BASED_CONSTRAINED_DELEGATION = 3;

    private KerberosFlags flags;

    public PaPacOptions() {

        this.flags = new KerberosFlags(Krb5.AP_OPTS_MAX + 1);

    }

    /**

     * Constructs a PA-PAC-OPTIONS object from a DER encoding.

     * @param encoding the ASN.1 encoded input

     * @throws Asn1Exception if invalid DER

     * @throws IOException if there is an error reading the DER value

     */

    public PaPacOptions(DerValue encoding) throws Asn1Exception, IOException {

        if (encoding.getTag() != DerValue.tag_Sequence) {

            throw new Asn1Exception(Krb5.ASN1_BAD_ID);

        }

        DerValue der = encoding.getData().getDerValue();

        if ((der.getTag() & 0x1F) == 0x00) {

            flags = new KDCOptions(

                    der.getData().getDerValue());

        } else {

            throw new Asn1Exception(Krb5.ASN1_BAD_ID);

        }

    }

    /**

     * Setter for the claims flag

     * @param value whether the claims flag is set or not

     * @return the same PaPacOptions instance

     */

    public PaPacOptions setClaims(boolean value) {

        flags.set(CLAIMS, value);

        return this;

    }

    /**

     * Getter for the claims flag

     * @return the claims flag value

     */

    public boolean getClaims() {

        return flags.get(CLAIMS);

    }

    /**

     * Setter for the branch-aware flag

     * @param value whether the branch-aware flag is set or not

     * @return the same PaPacOptions instance

     */

    public PaPacOptions setBranchAware(boolean value) {

        flags.set(BRANCH_AWARE, value);

        return this;

    }

    /**

     * Getter for the branch-aware flag

     * @return the branch-aware flag value

     */

    public boolean getBranchAware() {

        return flags.get(BRANCH_AWARE);

    }

    /**

     * Setter for the forward-to-full-DC flag

     * @param value whether the forward-to-full-DC flag is set or not

     * @return the same PaPacOptions instance

     */

    public PaPacOptions setForwardToFullDC(boolean value) {

        flags.set(FORWARD_TO_FULL_DC, value);

        return this;

    }

    /**

     * Getter for the forward-to-full-DC flag

     * @return the forward-to-full-DC flag value

     */

    public boolean getForwardToFullDC() {

        return flags.get(FORWARD_TO_FULL_DC);

    }

    /**

     * Setter for the resource-based-constrained-delegation flag

     * @param value whether the resource-based-constrained-delegation

     *        is set or not

     * @return the same PaPacOptions instance

     */

    public PaPacOptions setResourceBasedConstrainedDelegation(boolean value) {

        flags.set(RESOURCE_BASED_CONSTRAINED_DELEGATION, value);

        return this;

    }

    /**

     * Getter for the resource-based-constrained-delegation flag

     * @return the resource-based-constrained-delegation flag value

     */

    public boolean getResourceBasedConstrainedDelegation() {

        return flags.get(RESOURCE_BASED_CONSTRAINED_DELEGATION);

    }

    /**

     * Encodes this PaPacOptions instance.

     * @return an ASN.1 encoded PaPacOptions byte array

     * @throws IOException if an I/O error occurs while encoding this

     *         PaPacOptions instance

     */

    public byte[] asn1Encode() throws IOException {

        byte[] bytes = null;

        try(DerOutputStream temp = new DerOutputStream()) {

            temp.write(

                    DerValue.createTag(DerValue.TAG_CONTEXT, true, (byte)0x00),

                    flags.asn1Encode());

            bytes = temp.toByteArray();

        }

        try(DerOutputStream temp = new DerOutputStream()) {

            temp.write(DerValue.tag_Sequence, bytes);

            return temp.toByteArray();

        }

    }

    @Override

    public String toString() {

        return flags.toString();

    }

}