/*
    * The contents of this file are subject to the terms of the Common Development and
    * Distribution License (the License). You may not use this file except in compliance with the
    * License.
    *
    * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
    * specific language governing permission and limitations under the License.
    *
    * When distributing Covered Software, include this CDDL Header Notice in each file and include
   * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
   * Header, with the fields enclosed by brackets [] replaced by your own identifying
   * information: "Portions copyright [year] [name of copyright owner]".
   *
   * Copyright 2013-2016 ForgeRock AS.
   */
  
  package org.forgerock.json.jose.jws;
  
  import org.forgerock.json.jose.jwe.CompressionManager;
  import org.forgerock.json.jose.jws.handlers.SigningHandler;
  import org.forgerock.json.jose.jwt.Jwt;
  import org.forgerock.json.jose.jwt.JwtClaimsSet;
  import org.forgerock.json.jose.jwt.Payload;
  import org.forgerock.json.jose.utils.Utils;
  import org.forgerock.util.encode.Base64url;
  
  /**
   * A JWS implementation of the <tt>Jwt</tt> interface.
   * <p>
   * JSON Web Signature (JWS) is a means of representing content secured with digital signatures or Message
   * Authentication Codes (MACs) using JSON based data structures.
   * <p>
   * @see <a href="http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-11">JSON Web Signature Specification</a>
   *
   * @since 2.0.0
   */
  public class SignedJwt implements Jwt, Payload {
  
      private final JwsHeader header;
      private final Payload payload;
  
      private final SigningHandler signingHandler;
  
      private final byte[] signingInput;
      private final byte[] signature;
  
      /**
       * Constructs a fresh, new SignedJwt from the given JwsHeader and JwtClaimsSet.
       * <p>
       * The specified private key will be used in the creation of the JWS signature.
       *
       * @param header The JwsHeader containing the header parameters of the JWS.
       * @param claimsSet The JwtClaimsSet containing the claims of the JWS.
       * @param signingHandler The SigningHandler instance used to sign the JWS.
       */
      public SignedJwt(JwsHeader header, JwtClaimsSet claimsSet, SigningHandler signingHandler) {
          this.header = header;
          this.payload = claimsSet;
          this.signingHandler = signingHandler;
  
          this.signingInput = null;
          this.signature = null;
      }
  
      /**
       * Constructs a reconstructed SignedJwt from its constituent parts, the JwsHeader, JwtClaimsSet, signing input and
       * signature.
       * <p>
       * For use when a signed JWT has been reconstructed from its base64url encoded string representation and the
       * signature needs verifying.
       *
       * @param header The JwsHeader containing the header parameters of the JWS.
       * @param claimsSet The JwsClaimsSet containing the claims of the JWS.
       * @param signingInput The original data that was signed, being the base64url encoding of the JWS header and
       *                     claims set concatenated using a "." character.
       * @param signature The resulting signature of signing the signing input.
       */
      public SignedJwt(JwsHeader header, JwtClaimsSet claimsSet, byte[] signingInput, byte[] signature) {
          this.header = header;
          this.payload = claimsSet;
          this.signingInput = signingInput;
          this.signature = signature;
  
          this.signingHandler = null;
      }
  
      /**
       * Constructs a fresh, new SignedJwt from the given JwsHeader and nested Encrypted JWT.
       * <p>
       * The specified private key will be used in the creation of the JWS signature.
       *
       * @param header The JwsHeader containing the header parameters of the JWS.
       * @param nestedPayload The nested payload that will be the payload of this JWS.
       * @param signingHandler The SigningHandler instance used to sign the JWS.
       */
      protected SignedJwt(JwsHeader header, Payload nestedPayload, SigningHandler signingHandler) {
          this.header = header;
          this.payload = nestedPayload;
          this.signingHandler = signingHandler;
 
         this.signingInput = null;
         this.signature = null;
     }
 
     /**
      * Constructs a reconstructed SignedJwt from its constituent parts, the JwsHeader, nested Encrypted JWT, signing
      * input and signature.
      * <p>
      * For use when a signed nested encrypted JWT has been reconstructed from its base64url encoded string
      * representation and the signature needs verifying.
      *
      * @param header The JwsHeader containing the header parameters of the JWS.
      * @param nestedPayload The nested payload that is the payload of the JWS.
      * @param signingInput The original data that was signed, being the base64url encoding of the JWS header and
      *                     payload concatenated using a "." character.
      * @param signature The resulting signature of signing the signing input.
      */
     protected SignedJwt(JwsHeader header, Payload nestedPayload, byte[] signingInput, byte[] signature) {
         this.header = header;
         this.payload = nestedPayload;
         this.signingInput = signingInput;
         this.signature = signature;
 
         this.signingHandler = null;
     }
 
     /**
      * {@inheritDoc}
      */
     @Override
     public JwsHeader getHeader() {
         return header;
     }
 
     /**
      * {@inheritDoc}
      */
     @Override
     public JwtClaimsSet getClaimsSet() {
         return (JwtClaimsSet) payload;
     }
 
     /**
      * Gets the payload for the JWS, which will either be a JWT Claims Set, {@link #getClaimsSet()}, or a nested
      * EncryptedJwt, {@link org.forgerock.json.jose.jwe.EncryptedJwt}.
      *
      * @return The JWS' payload.
      * @see EncryptedThenSignedJwt
      */
     protected Payload getPayload() {
         return payload;
     }
 
     /**
      * {@inheritDoc}
      */
     @Override
     public String build() {
 
         String jwsHeader = header.build();
         String encodedHeader = Utils.base64urlEncode(jwsHeader);
         String jwsPayload = payload.build();
 
         String encodedClaims = new CompressionManager().compress(header.getCompressionAlgorithm(), jwsPayload);
 
         String signingInput = encodedHeader + "." + encodedClaims;
 
         byte[] signature = signingHandler.sign(header.getAlgorithm(), signingInput);
 
         return signingInput + "." + Base64url.encode(signature);
     }
 
     /**
      * Verifies that the JWS signature is valid for the contents of its payload.
      * <p>
      * The same private key must be given here as was used to create the signature.
      *
      * @param signingHandler The SigningHandler instance used to verify the JWS.
      * @return <code>true</code> if the signature matches the JWS Header and payload.
      */
     public boolean verify(SigningHandler signingHandler) {
         return signingHandler.verify(header.getAlgorithm(), signingInput, signature);
     }
 }