// Copyright (C) 2017 The Qt Company Ltd.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GPL-3.0-only
// Qt-Security score:critical reason:authorization-protocol

#include "qoauthoobreplyhandler.h"
#include "qoauthoobreplyhandler_p.h"

#include <QtCore/qurlquery.h>
#include <QtCore/qjsonobject.h>
#include <QtCore/qjsondocument.h>
#include <QtCore/qloggingcategory.h>

#include <QtNetwork/qnetworkreply.h>
#include <QtNetwork/qrestreply.h>

QT_BEGIN_NAMESPACE

using namespace Qt::StringLiterals;

QOAuthOobReplyHandler::QOAuthOobReplyHandler(QObject *parent)
    : QAbstractOAuthReplyHandler(parent)
{}

/*! \internal */
QOAuthOobReplyHandler::QOAuthOobReplyHandler(QOAuthOobReplyHandlerPrivate &d, QObject *parent)
    : QAbstractOAuthReplyHandler(d, parent)
{}

QOAuthOobReplyHandler::~QOAuthOobReplyHandler()
    = default; // must be empty until Qt 7 (was inline until Qt 6.8)

QString QOAuthOobReplyHandler::callback() const
{
    return QStringLiteral("oob");
}

void QOAuthOobReplyHandler::networkReplyFinished(QNetworkReply *reply)
{
    QRestReply restReply(reply);

    if (restReply.hasError()) {
        emit tokenRequestErrorOccurred(QAbstractOAuth::Error::NetworkError, reply->errorString());
        return;
    }
    const bool isHttpStatusSuccess = restReply.isHttpStatusSuccess();
    if (reply->header(QNetworkRequest::ContentTypeHeader).isNull()) {
        emit tokenRequestErrorOccurred(QAbstractOAuth::Error::ServerError,
                                       u"Empty Content-type header"_s);
        return;
    }
    const QString contentType = reply->header(QNetworkRequest::ContentTypeHeader).isNull() ?
                QStringLiteral("text/html") :
                reply->header(QNetworkRequest::ContentTypeHeader).toString();
    const QByteArray data = reply->readAll();
    if (data.isEmpty()) {
        emit tokenRequestErrorOccurred(QAbstractOAuth::Error::ServerError, u"No data received"_s);
        return;
    }

    Q_EMIT replyDataReceived(data);

    QVariantMap ret;

    if (contentType.startsWith(QStringLiteral("text/html")) ||
            contentType.startsWith(QStringLiteral("application/x-www-form-urlencoded"))) {
        ret = parseResponse(data);
    } else if (contentType.startsWith(QStringLiteral("application/json"))
               || contentType.startsWith(QStringLiteral("text/javascript"))) {
        const QJsonDocument document = QJsonDocument::fromJson(data);
        if (!document.isObject()) {
            emit tokenRequestErrorOccurred(QAbstractOAuth::Error::ServerError,
                          u"Received data is not a JSON object: %1"_s.arg(QString::fromUtf8(data)));
            return;
        }
        const QJsonObject object = document.object();
        if (object.isEmpty()) {
            emit tokenRequestErrorOccurred(QAbstractOAuth::Error::ServerError,
                                           u"Received an empty JSON object"_s);
            return;
        }
        ret = object.toVariantMap();
    } else {
        emit tokenRequestErrorOccurred(QAbstractOAuth::Error::ServerError,
                               u"Unknown Content-type %1"_s.arg(contentType));
        return;
    }

    // RFC 6749 section 5.2 specifies that token endpoint errors are typically
    // returned with HTTP status 400. Let tokensReceived() handler report
    // the error if it's an actual sever-side reported error. Otherwise error out here
    if (!isHttpStatusSuccess && !ret.contains(u"error"_s)) {
        emit tokenRequestErrorOccurred(QAbstractOAuth::Error::ServerError, reply->errorString());
        return;
    }

    Q_EMIT tokensReceived(ret);
}

QVariantMap QOAuthOobReplyHandler::parseResponse(const QByteArray &response)
{
    QVariantMap ret;
    QUrlQuery query(QString::fromUtf8(response));
    const auto queryItems = query.queryItems(QUrl::FullyDecoded);
    for (auto it = queryItems.begin(), end = queryItems.end(); it != end; ++it)
        ret.insert(it->first, it->second);
    return ret;
}

QT_END_NAMESPACE

#include "moc_qoauthoobreplyhandler.cpp"
