// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License. See License.txt in the project root for license information.

import { ApplicationTokenCredentials } from "./applicationTokenCredentials";
import { ApplicationTokenCertificateCredentials } from "./applicationTokenCertificateCredentials";
import { DeviceTokenCredentials } from "./deviceTokenCredentials";
import { MSIAppServiceTokenCredentials } from "./msiAppServiceTokenCredentials";
import { MSITokenCredentials } from "./msiTokenCredentials";
import { MSIVmTokenCredentials } from "./msiVmTokenCredentials";
import { TokenCredentialsBase } from "./tokenCredentialsBase";
import { UserTokenCredentials } from "./userTokenCredentials";
import { AuthenticationContext, TokenResponse, ErrorResponse } from "adal-node";
import { Authenticator } from "@azure/ms-rest-js";

export function createAuthenticator(credentials: MSITokenCredentials): Authenticator {
  const convertedCredentials = _convert(credentials);
  const authenticator = _createAuthenticatorMapper(convertedCredentials);

  return authenticator;
}

function _convert(credentials: MSITokenCredentials): MSITokenCredentials {
  if (credentials instanceof MSIAppServiceTokenCredentials) {
    return new MSIAppServiceTokenCredentials({
      msiEndpoint: credentials.msiEndpoint,
      msiSecret: credentials.msiSecret,
      msiApiVersion: credentials.msiApiVersion,
      resource: credentials.resource
    });
  } else if (credentials instanceof MSIVmTokenCredentials) {
    return new MSIVmTokenCredentials({
      resource: credentials.resource,
      msiEndpoint: credentials.msiEndpoint
    });
  } else if (credentials instanceof MSITokenCredentials) {
    throw new Error("MSI-credentials not one of: MSIVmTokenCredentials, MSIAppServiceTokenCredentials");
  } else {
    return credentials;
  }
}

function _createAuthenticatorMapper(credentials: MSITokenCredentials): Authenticator {
  return (challenge: any) => new Promise((resolve, reject) => {
    // Function to take token Response and format a authorization value
    const _formAuthorizationValue = (err: Error, tokenResponse: TokenResponse | ErrorResponse) => {
      if (err) {
        return reject(err);
      }

      if (tokenResponse.error) {
        return reject(tokenResponse.error);
      }

      tokenResponse = tokenResponse as TokenResponse;
      // Calculate the value to be set in the request's Authorization header and resume the call.
      const authorizationValue = tokenResponse.tokenType + " " + tokenResponse.accessToken;
      return resolve(authorizationValue);
    };

    // Create a new authentication context.
    if (credentials instanceof TokenCredentialsBase) {
      const context = new AuthenticationContext(challenge.authorization, true, credentials.authContext && credentials.authContext.cache);
      if (credentials instanceof ApplicationTokenCredentials) {
        return context.acquireTokenWithClientCredentials(
          challenge.resource, credentials.clientId, credentials.secret, _formAuthorizationValue);
      } else if (credentials instanceof ApplicationTokenCertificateCredentials) {
        return context.acquireTokenWithClientCertificate(
          challenge.resource, credentials.clientId, credentials.certificate, credentials.thumbprint, _formAuthorizationValue);
      } else if (credentials instanceof UserTokenCredentials) {
        return context.acquireTokenWithUsernamePassword(
          challenge.resource, credentials.username, credentials.password, credentials.clientId, _formAuthorizationValue);
      } else if (credentials instanceof DeviceTokenCredentials) {
        return context.acquireToken(
          challenge.resource, credentials.username, credentials.clientId, _formAuthorizationValue);
      }
    } else if (credentials instanceof MSITokenCredentials) {
      return credentials.getToken();
    } else {
      return reject(new Error("credentials must be one of: ApplicationTokenCredentials, UserTokenCredentials, " +
        "DeviceTokenCredentials, MSITokenCredentials"));
    }
  });
}