const Keycloak = require('keycloak-connect');
const Token = require('../node_modules/keycloak-connect/middleware/auth-utils/token');
const session = require('express-session');
const memoryStore = new session.MemoryStore();
const util = require('util');
const keycloakStrategy = require("@exlinc/keycloak-passport");

var requiredOptions = [
    'realm',
    'authServerUrl',
    'callbackURL'
];

module.exports = function(opts) {
    this.keycloakOptions = opts;
    this.rolesMap = new Map();
    for (var i=0;i<requiredOptions.length;i++) {
        if (!opts.hasOwnProperty(requiredOptions[i])) {
            throw new Error("Missing auth option: "+requiredOptions[i]);
        }
    }
    var kcConfig = {
        'realm':  opts.realm,
        'auth-server-url': opts.authServerUrl,
        'clientId': 'smp-nodered'
    };
    keycloak = new Keycloak({store: memoryStore, scope: 'offline_support'}, kcConfig);
    var callbackURL = opts.callbackURL+
        ((opts.callbackURL[opts.callbackURL.length-1] === "/")?"":"/") + "auth/strategy/callback";

    var adminAuth = {
        type: "strategy",
        strategy: {
            name: "Keycloak",
            label: 'Sign in with keycloak',
            icon: "fa-key",
            strategy: keycloakStrategy,
            options: {
                host: opts.authServerUrl,
                realm: opts.realm,
                clientID: 'smp-nodered',
                callbackURL: callbackURL,
                auth_server_url: opts.authServerUrl,
                //This is for keycloak libraries satisfaction. We will work without secret as open client
                clientSecret: 'xx',
                authorizationURL: getAuthURL(opts),
                tokenURL: getTokenURL(opts),
                userInfoURL: getUserInfoURL(opts),
                verify: function(token, tokenSecret, profile, done) {
                    this.keycloakToken = token;
                    //Get token object from string token and see if roles are present.
                    var jwtToken = new Token(token, 'smp-nodered');
                    if (typeof jwtToken.content.realm_access == 'undefined' || isEmptyObject(jwtToken.content.realm_access)) {
                        console.log("No role mapping for user "+profile.username);
                    } else {
                        var roles = jwtToken.content.realm_access.roles;
                        var userName = profile.username;
                        if(userName) {
                            rolesMap.set(userName, roles);
                        }
                    }
                    done(null,profile);
                }
            }
        },
        sessionExpiryTime: opts.sessionExpiryTime,
        users: function(username) {
            return new Promise(function(resolve) {
                var user = {};
                user.username = username;
                user.permissions = rolesMap.get(username);
                resolve(user);
            });
        }
    };
    if (opts.hasOwnProperty('default')) {
        adminAuth.default = opts.default;
    }
    console.log("node-red-auth-keycloak :: adminAuth: ",adminAuth);
    return adminAuth;
};

function isEmptyObject(obj) {
    return Object.keys(obj).length === 0 && obj.constructor === Object
}

function getAuthURL (options) {
    var url = util.format('%s/realms/%s/protocol/openid-connect/auth',
                 options.authServerUrl,
                 encodeURIComponent(options.realm));
    return url;
}

function getTokenURL (options) {
    var url = util.format('%s/realms/%s/protocol/openid-connect/token',
                options.authServerUrl,
                encodeURIComponent(options.realm));
    return url;
}

function getUserInfoURL (options) {
    var url = util.format('%s/realms/%s/protocol/openid-connect/userinfo',
                options.authServerUrl,
                encodeURIComponent(options.realm));
    return url;
}