/*
 * Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation. Oracle designates this
 * particular file as subject to the "Classpath" exception as provided
 * by Oracle in the LICENSE file that accompanied this code.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

package java.net;

import java.util.Map;
import java.util.List;
import java.util.Collections;
import java.util.Comparator;
import java.io.IOException;
import sun.util.logging.PlatformLogger;

/**
 * CookieManager provides a concrete implementation of {@link CookieHandler},
 * which separates the storage of cookies from the policy surrounding accepting
 * and rejecting cookies. A CookieManager is initialized with a {@link CookieStore}
 * which manages storage, and a {@link CookiePolicy} object, which makes
 * policy decisions on cookie acceptance/rejection.
 *
 * <p> The HTTP cookie management in java.net package looks like:
 * <blockquote>
 * <pre>{@code
 * use
 * CookieHandler <------- HttpURLConnection
 * ^
 * | impl
 * | use
 * CookieManager -------> CookiePolicy
 * | use
 * |--------> HttpCookie
 * | ^
 * | | use
 * | use |
 * |--------> CookieStore
 * ^
 * | impl
 * |
 * Internal in-memory implementation
 * }</pre>
 * <ul>
 * <li>
 * CookieHandler is at the core of cookie management. User can call
 * CookieHandler.setDefault to set a concrete CookieHandler implementation
 * to be used.
 * </li>
 * <li>
 * CookiePolicy.shouldAccept will be called by CookieManager.put to see whether
 * or not one cookie should be accepted and put into cookie store. User can use
 * any of three pre-defined CookiePolicy, namely ACCEPT_ALL, ACCEPT_NONE and
 * ACCEPT_ORIGINAL_SERVER, or user can define his own CookiePolicy implementation
 * and tell CookieManager to use it.
 * </li>
 * <li>
 * CookieStore is the place where any accepted HTTP cookie is stored in.
 * If not specified when created, a CookieManager instance will use an internal
 * in-memory implementation. Or user can implements one and tell CookieManager
 * to use it.
 * </li>
 * <li>
 * Currently, only CookieStore.add(URI, HttpCookie) and CookieStore.get(URI)
 * are used by CookieManager. Others are for completeness and might be needed
 * by a more sophisticated CookieStore implementation, e.g. a NetscapeCookieStore.
 * </li>
 * </ul>
 * </blockquote>
 *
 * <p>There're various ways user can hook up his own HTTP cookie management behavior, e.g.
 * <blockquote>
 * <ul>
 * <li>Use CookieHandler.setDefault to set a brand new {@link CookieHandler} implementation
 * <li>Let CookieManager be the default {@link CookieHandler} implementation,
 * but implement user's own {@link CookieStore} and {@link CookiePolicy}
 * and tell default CookieManager to use them:
 * <blockquote><pre>
 * // this should be done at the beginning of an HTTP session
 * CookieHandler.setDefault(new CookieManager(new MyCookieStore(), new MyCookiePolicy()));
 * </pre></blockquote>
 * <li>Let CookieManager be the default {@link CookieHandler} implementation, but
 * use customized {@link CookiePolicy}:
 * <blockquote><pre>
 * // this should be done at the beginning of an HTTP session
 * CookieHandler.setDefault(new CookieManager());
 * // this can be done at any point of an HTTP session
 * ((CookieManager)CookieHandler.getDefault()).setCookiePolicy(new MyCookiePolicy());
 * </pre></blockquote>
 * </ul>
 * </blockquote>
 *
 * <p>The implementation conforms to <a href="http://www.ietf.org/rfc/rfc2965.txt">RFC 2965</a>, section 3.3.
 *
 * @see CookiePolicy
 * @author Edward Wang
 * @since 1.6
 */
public class CookieManager extends CookieHandler
{
 /* ---------------- Fields -------------- */

 private CookiePolicy policyCallback;


 private CookieStore cookieJar = null;


 /* ---------------- Ctors -------------- */

 /**
 * Create a new cookie manager.
 *
 * <p>This constructor will create new cookie manager with default
 * cookie store and accept policy. The effect is same as
 * {@code CookieManager(null, null)}.
 */
 public CookieManager() {
 this(null, null);
 }


 /**
 * Create a new cookie manager with specified cookie store and cookie policy.
 *
 * @param store a {@code CookieStore} to be used by cookie manager.
 * if {@code null}, cookie manager will use a default one,
 * which is an in-memory CookieStore implementation.
 * @param cookiePolicy a {@code CookiePolicy} instance
 * to be used by cookie manager as policy callback.
 * if {@code null}, ACCEPT_ORIGINAL_SERVER will
 * be used.
 */
 public CookieManager(CookieStore store,
 CookiePolicy cookiePolicy)
 {
 // use default cookie policy if not specify one
 policyCallback = (cookiePolicy == null) ? CookiePolicy.ACCEPT_ORIGINAL_SERVER
 : cookiePolicy;

 // if not specify CookieStore to use, use default one
 if (store == null) {
 cookieJar = new InMemoryCookieStore();
 } else {
 cookieJar = store;
 }
 }


 /* ---------------- Public operations -------------- */

 /**
 * To set the cookie policy of this cookie manager.
 *
 * <p> A instance of {@code CookieManager} will have
 * cookie policy ACCEPT_ORIGINAL_SERVER by default. Users always
 * can call this method to set another cookie policy.
 *
 * @param cookiePolicy the cookie policy. Can be {@code null}, which
 * has no effects on current cookie policy.
 */
 public void setCookiePolicy(CookiePolicy cookiePolicy) {
 if (cookiePolicy != null) policyCallback = cookiePolicy;
 }


 /**
 * To retrieve current cookie store.
 *
 * @return the cookie store currently used by cookie manager.
 */
 public CookieStore getCookieStore() {
 return cookieJar;
 }


 public Map<String, List<String>>
 get(URI uri, Map<String, List<String>> requestHeaders)
 throws IOException
 {
 // pre-condition check
 if (uri == null || requestHeaders == null) {
 throw new IllegalArgumentException("Argument is null");
 }

 // if there's no default CookieStore, no way for us to get any cookie
 if (cookieJar == null)
 return Map.of();

 boolean secureLink = "https".equalsIgnoreCase(uri.getScheme());
 List<HttpCookie> cookies = new java.util.ArrayList<>();
 String path = uri.getPath();
 if (path == null || path.isEmpty()) {
 path = "/";
 }
 for (HttpCookie cookie : cookieJar.get(uri)) {
 // apply path-matches rule (RFC 2965 sec. 3.3.4)
 // and check for the possible "secure" tag (i.e. don't send
 // 'secure' cookies over unsecure links)
 if (pathMatches(path, cookie.getPath()) &&
 (secureLink || !cookie.getSecure())) {
 // Enforce httponly attribute
 if (cookie.isHttpOnly()) {
 String s = uri.getScheme();
 if (!"http".equalsIgnoreCase(s) && !"https".equalsIgnoreCase(s)) {
 continue;
 }
 }
 // Let's check the authorize port list if it exists
 String ports = cookie.getPortlist();
 if (ports != null && !ports.isEmpty()) {
 int port = uri.getPort();
 if (port == -1) {
 port = "https".equals(uri.getScheme()) ? 443 : 80;
 }
 if (isInPortList(ports, port)) {
 cookies.add(cookie);
 }
 } else {
 cookies.add(cookie);
 }
 }
 }

 // apply sort rule (RFC 2965 sec. 3.3.4)
 List<String> cookieHeader = sortByPathAndAge(cookies);

 return Map.of("Cookie", cookieHeader);
 }

 public void
 put(URI uri, Map<String, List<String>> responseHeaders)
 throws IOException
 {
 // pre-condition check
 if (uri == null || responseHeaders == null) {
 throw new IllegalArgumentException("Argument is null");
 }


 // if there's no default CookieStore, no need to remember any cookie
 if (cookieJar == null)
 return;

 PlatformLogger logger = PlatformLogger.getLogger("java.net.CookieManager");
 for (String headerKey : responseHeaders.keySet()) {
 // RFC 2965 3.2.2, key must be 'Set-Cookie2'
 // we also accept 'Set-Cookie' here for backward compatibility
 if (headerKey == null
 || !(headerKey.equalsIgnoreCase("Set-Cookie2")
 || headerKey.equalsIgnoreCase("Set-Cookie")
 )
 )
 {
 continue;
 }

 for (String headerValue : responseHeaders.get(headerKey)) {
 try {
 List<HttpCookie> cookies;
 try {
 cookies = HttpCookie.parse(headerValue);
 } catch (IllegalArgumentException e) {
 // Bogus header, make an empty list and log the error
 cookies = java.util.Collections.emptyList();
 if (logger.isLoggable(PlatformLogger.Level.SEVERE)) {
 logger.severe("Invalid cookie for " + uri + ": " + headerValue);
 }
 }
 for (HttpCookie cookie : cookies) {
 if (cookie.getPath() == null) {
 // If no path is specified, then by default
 // the path is the directory of the page/doc
 String path = uri.getPath();
 if (!path.endsWith("/")) {
 int i = path.lastIndexOf('/');
 if (i > 0) {
 path = path.substring(0, i + 1);
 } else {
 path = "/";
 }
 }
 cookie.setPath(path);
 }

 // As per RFC 2965, section 3.3.1:
 // Domain Defaults to the effective request-host. (Note that because
 // there is no dot at the beginning of effective request-host,
 // the default Domain can only domain-match itself.)
 if (cookie.getDomain() == null) {
 String host = uri.getHost();
 if (host != null && !host.contains("."))
 host += ".local";
 cookie.setDomain(host);
 }
 String ports = cookie.getPortlist();
 if (ports != null) {
 int port = uri.getPort();
 if (port == -1) {
 port = "https".equals(uri.getScheme()) ? 443 : 80;
 }
 if (ports.isEmpty()) {
 // Empty port list means this should be restricted
 // to the incoming URI port
 cookie.setPortlist("" + port );
 if (shouldAcceptInternal(uri, cookie)) {
 cookieJar.add(uri, cookie);
 }
 } else {
 // Only store cookies with a port list
 // IF the URI port is in that list, as per
 // RFC 2965 section 3.3.2
 if (isInPortList(ports, port) &&
 shouldAcceptInternal(uri, cookie)) {
 cookieJar.add(uri, cookie);
 }
 }
 } else {
 if (shouldAcceptInternal(uri, cookie)) {
 cookieJar.add(uri, cookie);
 }
 }
 }
 } catch (IllegalArgumentException e) {
 // invalid set-cookie header string
 // no-op
 }
 }
 }
 }


 /* ---------------- Private operations -------------- */

 // to determine whether or not accept this cookie
 private boolean shouldAcceptInternal(URI uri, HttpCookie cookie) {
 try {
 return policyCallback.shouldAccept(uri, cookie);
 } catch (Exception ignored) { // protect against malicious callback
 return false;
 }
 }


 private static boolean isInPortList(String lst, int port) {
 int i = lst.indexOf(',');
 int val = -1;
 while (i > 0) {
 try {
 val = Integer.parseInt(lst, 0, i, 10);
 if (val == port) {
 return true;
 }
 } catch (NumberFormatException numberFormatException) {
 }
 lst = lst.substring(i+1);
 i = lst.indexOf(',');
 }
 if (!lst.isEmpty()) {
 try {
 val = Integer.parseInt(lst);
 if (val == port) {
 return true;
 }
 } catch (NumberFormatException numberFormatException) {
 }
 }
 return false;
 }

 /*
 * path-matches algorithm, as defined by RFC 2965
 */
 private boolean pathMatches(String path, String pathToMatchWith) {
 if (path == pathToMatchWith)
 return true;
 if (path == null || pathToMatchWith == null)
 return false;
 if (path.startsWith(pathToMatchWith))
 return true;

 return false;
 }


 /*
 * sort cookies with respect to their path and age: those with more longer Path attributes
 * precede those with shorter, as defined in RFC 6265. Cookies with the same length
 * path are distinguished by creation time (older first). Method made PP to enable testing.
 */
 static List<String> sortByPathAndAge(List<HttpCookie> cookies) {
 Collections.sort(cookies, new CookieComparator());

 List<String> cookieHeader = new java.util.ArrayList<>();
 for (HttpCookie cookie : cookies) {
 // Netscape cookie spec and RFC 2965 have different format of Cookie
 // header; RFC 2965 requires a leading $Version="1" string while Netscape
 // does not.
 // The workaround here is to add a $Version="1" string in advance
 if (cookies.indexOf(cookie) == 0 && cookie.getVersion() > 0) {
 cookieHeader.add("$Version=\"1\"");
 }

 cookieHeader.add(cookie.toString());
 }
 return cookieHeader;
 }


 // Comparator compares the length of the path. Longer paths should precede shorter ones.
 // As per rfc6265 cookies with equal path lengths sort on creation time.

 static class CookieComparator implements Comparator<HttpCookie> {
 public int compare(HttpCookie c1, HttpCookie c2) {
 if (c1 == c2) return 0;
 if (c1 == null) return -1;
 if (c2 == null) return 1;

 String p1 = c1.getPath();
 String p2 = c2.getPath();
 p1 = (p1 == null) ? "" : p1;
 p2 = (p2 == null) ? "" : p2;
 int len1 = p1.length();
 int len2 = p2.length();
 if (len1 > len2)
 return -1;
 if (len2 > len1)
 return 1;

 // Check creation time. Sort older first
 long creation1 = c1.getCreationTime();
 long creation2 = c2.getCreationTime();
 if (creation1 < creation2) {
 return -1;
 }
 if (creation1 > creation2) {
 return 1;
 }
 return 0;
 }
 }
}