 zlib          = require 'zlib'
 
 
-create_authn_request = ->
+create_authn_request = (issuer, destination) ->
   xmlbuilder.create
     AuthnRequest:
       '@xmlns': 'urn:oasis:names:tc:SAML:2.0:protocol'

  sig.loadSignature(signature.toString())
  sig.checkSignature(xml)

module.exports.ServiceProvider =
  class ServiceProvider
    constructor: (@private_key, @certificate) ->

    # -- Required
    # Returns a redirect URL, at which a user can login
    create_login_url: (identity_provider, cb) =>
      zlib.deflateRaw create_authn_request(), (err, deflated) =>
        cb err if err?
        cb null, "#{identity_provider.sso_login_url}?SAMLRequest=" + encodeURIComponent(deflated.toString('base64'))
        #loc = 'https://cleverad.ops.clever.com/adfs/ls/?SAMLRequest=' + encodeURIComponent(deflated.toString('base64')) + "&RelayState=https%3A%2F%2Fsaml.not.clever.com%2Fassert"

    # Returns user object, if the login attempt was valid.
    assert: (identity_provider, request_body, cb) ->
      # Base64 decode
      buf = new Buffer request_body.SAMLResponse, 'base64'
      # Decrypt
      saml_response = (new xmldom.DOMParser()).parseFromString buf.toString()
      encrypted_token = saml_response.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'EncryptedAssertion')[0]
      encrypted_data = encrypted_token.getElementsByTagNameNS('http://www.w3.org/2001/04/xmlenc#', 'EncryptedData')[0]

      xmlenc.decrypt encrypted_data.toString(), (key: @private_key), (err, decrypted_result) ->
        return cb err if err?
        return cb new Error("Error invalid signature!") unless check_saml_signature decrypted_result, "adfs.crt"

        parseString decrypted_result, (err, result) ->
          return cb err if err?
          # Parse it good
          if result['Assertion']?['AttributeStatement']?
            return cb null,
              _.chain(result['Assertion']['AttributeStatement'][0]['Attribute'])
              .map (attr) -> [attr['$']['Name'], attr['AttributeValue']]
              .object()
              .value()
          cb null, user

    # -- Optional

      '@Version': '2.0'
      '@ID': '_e23de96fdd91332b229368086adb655139e24ac6e2'
      '@IssueInstant': (new Date()).toISOString()
      '@Destination': destination
      '@AssertionConsumerServiceURL': 'https://saml.not.clever.com/assert'
      '@ProtocolBinding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
      'saml:Issuer': "https://saml.not.clever.com/metadata.xml"
