//! Handle the middle document of an onion service descriptor.

use std::sync::LazyLock;

use subtle::ConstantTimeEq;

use tor_hscrypto::pk::{HsBlindId, HsClientDescEncSecretKey, HsSvcDescEncKey};

use tor_hscrypto::{RevisionCounter, Subcredential};

use tor_llcrypto::pk::curve25519;

use tor_llcrypto::util::ct::CtByteArray;

use crate::doc::hsdesc::desc_enc::build_descriptor_cookie_key;

use crate::parse::tokenize::{Item, NetDocReader};

use crate::parse::{keyword::Keyword, parser::SectionRules};

use crate::types::misc::B64;

use crate::{Pos, Result};

use super::HsDescError;

use super::desc_enc::{

    HS_DESC_CLIENT_ID_LEN, HS_DESC_ENC_NONCE_LEN, HS_DESC_IV_LEN, HsDescEncNonce, HsDescEncryption,

};

/// The only currently recognized `desc-auth-type`.

//

// TODO: In theory this should be an enum, if we ever add a second value here.

pub(super) const HS_DESC_AUTH_TYPE: &str = "x25519";

/// A more-or-less verbatim representation of the middle document of an onion

/// service descriptor.

#[derive(Debug, Clone)]

pub struct HsDescMiddle {

    /// A public key used by authorized clients to decrypt the key used to

    /// decrypt the encryption layer and decode the inner document.  This is

    /// ignored if restricted discovery is not in use.

    ///

    /// This is `KP_hss_desc_enc`, and appears as `desc-auth-ephemeral-key` in

    /// the document format; It is used along with `KS_hsc_desc_enc` to perform

    /// a diffie-hellman operation and decrypt the encryption layer.

    svc_desc_enc_key: HsSvcDescEncKey,

    /// One or more authorized clients, and the key exchange information that

    /// they use to compute shared keys for decrypting the encryption layer.

    ///

    /// Each of these is parsed from a `auth-client` line.

    auth_clients: Vec<AuthClient>,

    /// The (encrypted) inner document of the onion service descriptor.

    encrypted: Vec<u8>,

}

impl HsDescMiddle {

    /// Decrypt the encrypted inner document contained within this middle

    /// document.

    ///

    /// If present, `key` is an authorization key, and we assume that the

    /// decryption is nontrivial.

    ///

    /// A failure may mean either that the encryption was corrupted, or that we

    /// didn't have the right key.

                // Work around a bug in an implementation we presume to be

                // OnionBalance: it doesn't NL-terminate the final line of the

                // inner document.

            }

            },

        }

    /// Use a `ClientDescAuthSecretKey` (`KS_hsc_desc_enc`) to see if there is any `auth-client`

    /// entry for us (a client who holds that secret key) in this descriptor.

    /// If so, decrypt it and return its

    /// corresponding "Descriptor Cookie" (`N_hs_desc_enc`)

    ///

    /// If no such `N_hs_desc_enc` is found, then either we do not have

    /// permission to decrypt the encryption layer, OR no permission is required.

    ///

    /// (The protocol makes it intentionally impossible to distinguish any error

    /// conditions here other than "no cookie for you.")

        use cipher::{KeyIvInit, StreamCipher};

        use tor_llcrypto::cipher::aes::Aes256Ctr as Cipher;

        use tor_llcrypto::util::ct::ct_lookup;

        // See whether there is any matching client_id in self.auth_ids.

        // We found an auth client entry: Take and decrypt the cookie `N_hs_desc_enc` at last.

}

/// Information that a single authorized client can use to decrypt the onion

/// service descriptor.

#[derive(Debug, Clone)]

pub(super) struct AuthClient {

    /// A check field that clients can use to see if this [`AuthClient`] entry corresponds

    /// to a key they hold.

    ///

    /// This is the first part of the `auth-client` line.

    pub(super) client_id: CtByteArray<HS_DESC_CLIENT_ID_LEN>,

    /// An IV used to decrypt `encrypted_cookie`.

    ///

    /// This is the second item on the `auth-client` line.

    pub(super) iv: [u8; HS_DESC_IV_LEN],

    /// An encrypted value used to find the descriptor cookie `N_hs_desc_enc`,

    /// which in turn is

    /// needed to decrypt the [HsDescMiddle]'s `encrypted_body`.

    ///

    /// This is the third item on the `auth-client` line.  When decrypted, it

    /// reveals a `DescEncEncryptionCookie` (`N_hs_desc_enc`, not yet so named

    /// in the spec).

    pub(super) encrypted_cookie: [u8; HS_DESC_ENC_NONCE_LEN],

}

impl AuthClient {

    /// Try to extract an AuthClient from a single AuthClient item.

        use crate::NetdocErrorKind as EK;

}

decl_keyword! {

    pub(crate) HsMiddleKwd {

        "desc-auth-type" => DESC_AUTH_TYPE,

        "desc-auth-ephemeral-key" => DESC_AUTH_EPHEMERAL_KEY,

        "auth-client" => AUTH_CLIENT,

        "encrypted" => ENCRYPTED,

    }

}

/// Rules about how keywords appear in the middle document of an onion service

/// descriptor.

    use HsMiddleKwd::*;

impl HsDescMiddle {

    /// Try to parse the middle document of an onion service descriptor from a provided

    /// string.

    /// Extract an HsDescMiddle from a reader.

    ///

    /// The reader must contain a single HsDescOuter; we return an error if not.

        use crate::NetdocErrorKind as EK;

        use HsMiddleKwd::*;

        // Check for the only currently recognized `desc-auth-type`

        {

        }

        // Extract `KP_hss_desc_enc` from DESC_AUTH_EPHEMERAL_KEY

        };

        // Parse all the auth-client lines.

        // The encrypted body is taken verbatim.

}

#[cfg(test)]

mod test {

    // @@ begin test lint list maintained by maint/add_warning @@

    #![allow(clippy::bool_assert_comparison)]

    #![allow(clippy::clone_on_copy)]

    #![allow(clippy::dbg_macro)]

    #![allow(clippy::mixed_attributes_style)]

    #![allow(clippy::print_stderr)]

    #![allow(clippy::print_stdout)]

    #![allow(clippy::single_char_pattern)]

    #![allow(clippy::unwrap_used)]

    #![allow(clippy::unchecked_time_subtraction)]

    #![allow(clippy::useless_vec)]

    #![allow(clippy::needless_pass_by_value)]

    //! <!-- @@ end test lint list maintained by maint/add_warning @@ -->

    use hex_literal::hex;

    use tor_checkable::{SelfSigned, Timebound};

    use super::*;

    use crate::doc::hsdesc::{

        outer::HsDescOuter,

        test_data::{TEST_DATA, TEST_SUBCREDENTIAL},

    };

    #[test]

    fn parse_good() -> Result<()> {

        let desc = HsDescOuter::parse(TEST_DATA)?

            .dangerously_assume_wellsigned()

            .dangerously_assume_timely();

        let subcred = TEST_SUBCREDENTIAL.into();

        let body = desc.decrypt_body(&subcred).unwrap();

        let body = std::str::from_utf8(&body[..]).unwrap();

        let middle = HsDescMiddle::parse(body)?;

        assert_eq!(

            middle.svc_desc_enc_key.as_bytes(),

            &hex!("161090571E6DB517C0C8591CE524A56DF17BAE3FF8DCD50735F9AEB89634073E")

        );

        assert_eq!(middle.auth_clients.len(), 16);

        // Here we make sure that decryption "works" minimally and returns some

        // bytes for a descriptor with no HsClientDescEncSecretKey.

        //

        // We make sure that the actual decrypted value is reasonable elsewhere,

        // in the tests in inner.rs.

        //

        // We test the case where a HsClientDescEncSecretKey is needed

        // elsewhere, in `hsdesc::test::parse_desc_auth_good`.

        let _inner_body = middle

            .decrypt_inner(&desc.blinded_id(), desc.revision_counter(), &subcred, None)

            .unwrap();

        Ok(())

    }

}