text: /*
   * Licensed to the Apache Software Foundation (ASF) under one
   * or more contributor license agreements.  See the NOTICE file
   * distributed with this work for additional information
   * regarding copyright ownership.  The ASF licenses this file
   * to you under the Apache License, Version 2.0 (the
   * "License"); you may not use this file except in compliance
   * with the License.  You may obtain a copy of the License at
   *
   *   http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing,
   * software distributed under the License is distributed on an
   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
   * KIND, either express or implied.  See the License for the
   * specific language governing permissions and limitations
   * under the License.
   */
  
  /* $Rev$ $Date$ */
  
  #ifndef tuscany_openauth_hpp
  #define tuscany_openauth_hpp
  
  /**
   * Tuscany Open auth support utility functions.
   */
  
  #include "string.hpp"
  #include "stream.hpp"
  #include "list.hpp"
  #include "tree.hpp"
  #include "value.hpp"
  #include "monad.hpp"
  #include "../json/json.hpp"
  #include "../http/httpd.hpp"
  #include "../http/http.hpp"
  
  namespace tuscany {
  namespace openauth {
  
  /**
   * Return the session id from a request.
   */
  const char* const cookieName(const char* const cs) {
      if (*cs != ' ')
          return cs;
      return cookieName(cs + 1);
  }
  
  const maybe<string> sessionID(const list<string>& c, const string& key) {
      if (isNull(c))
          return maybe<string>();
      const string cn = cookieName(c_str(car(c)));
      const size_t i = find(cn, "=");
      if (i < length(cn)) {
          const list<string> kv = mklist<string>(substr(cn, 0, i), substr(cn, i+1));
          if (!isNull(kv) && !isNull(cdr(kv))) {
              if (car(kv) == key)
                  return cadr(kv);
          }
      }
      return sessionID(cdr(c), key);
  }
  
  const maybe<string> sessionID(const request_rec* const r, const string& key) {
      const string c = httpd::cookie(r);
      debug(c, "openauth::sessionid::cookies");
      if (length(c) == 0)
          return maybe<string>();
      return sessionID(tokenize(";", c), key);
  }
  
  /**
   * Convert a number of seconds to an expiration date.
   */
  const string expires(const int s) {
      const time_t t = time(NULL) + s;
      char exp[32];
      strftime(exp, 32, "%a, %d-%b-%Y %H:%M:%S GMT", gmtime(&t));
      return string(exp);
  }
  
  /**
   * Convert a session id to a cookie string.
   */
  const string cookie(const string& key, const string& sid, const string& domain) {
      if (length(sid) == 0) {
          const string c = key + string("=") + "; max-age=0; domain=." + httpd::realm(domain) + "; path=/; secure; httponly";
          debug(c, "openauth::cookie");
          return c;
      }
      const string exp = "604800";
      const string c = key + string("=") + sid + (length(exp) != 0? string("; max-age=") + exp : emptyString)  + "; domain=." + httpd::realm(domain) + "; path=/; secure; httponly";
      debug(c, "openauth::cookie");
      return c;
  }
  
  /**
   * Redirect to the configured login page.
   */
  const failable<int> login(const string& page, const value& ref, const value& attempt, request_rec* const r) {
  
      // Don't redirect non-cacheable requests, just respond with an uncacheable 403 response
      const char* cc = apr_table_get(r->headers_in, "X-Cache-Control");
      if(cc != NULL && !strcmp(cc, "no-cache")) {
          apr_table_setn(r->headers_out, "Cache-Control", "no-cache, no-store, must-revalidate, max-age=0");
          apr_table_setn(r->err_headers_out, "Cache-Control", "no-cache, no-store, must-revalidate, max-age=0");
          return HTTP_FORBIDDEN;
      }
  
      // Redirect to the login page
      const list<value> rarg = ref == string("/")? nilListValue : mklist<value>(mklist<value>("openauth_referrer", httpd::escape(httpd::url(isNull(ref)? r->uri : ref, r))));
      const list<value> aarg = isNull(attempt)? nilListValue : mklist<value>(mklist<value>("openauth_attempt", attempt));
      const list<value> largs = append(rarg, aarg);
      const string loc = isNull(largs)? httpd::url(page, r) : httpd::url(page, r) + string("?") + http::queryString(largs);
      debug(loc, "openauth::login::uri");
      return httpd::externalRedirect(loc, r);
  }
  
  /**
   * Report a request auth status.
   */
  const int reportStatus(const failable<int>& authrc, const string& page, const value& attempt, request_rec* const r) {
      debug(authrc, "openauth::reportStatus::authrc");
  
      // Redirect to the login page if not authorized
      if (!hasContent(authrc) && rcode(authrc) == HTTP_UNAUTHORIZED) {
  
          // Clear any auth cookies
          if(hasContent(sessionID(r, "TuscanyOpenAuth")))
              apr_table_set(r->err_headers_out, "Set-Cookie", c_str(cookie("TuscanyOpenAuth", emptyString, httpd::hostName(r))));
          if(hasContent(sessionID(r, "TuscanyOpenIDAuth")))
              apr_table_set(r->err_headers_out, "Set-Cookie", c_str(cookie("TuscanyOpenIDAuth", emptyString, httpd::hostName(r))));
          if(hasContent(sessionID(r, "TuscanyOAuth1")))
              apr_table_set(r->err_headers_out, "Set-Cookie", c_str(cookie("TuscanyOAuth1", emptyString, httpd::hostName(r))));
          if(hasContent(sessionID(r, "TuscanyOAuth2")))
              apr_table_set(r->err_headers_out, "Set-Cookie", c_str(cookie("TuscanyOAuth2", emptyString, httpd::hostName(r))));
  
          return httpd::reportStatus(login(page, string("/"), attempt, r));
      }
  
      return httpd::reportStatus(authrc);
  }
  
  }
  }
  
  #endif /* tuscany_openauth_hpp */
  