#
# Copyright 2018-2020 NXP
# SPDX-License-Identifier: Apache-2.0
#
#

"""License text"""

import os
import ctypes
import logging
import binascii
from . import sss_api as apis
from .keystore import KeyStore
from .keyobject import KeyObject
from .asymmetric import Asymmetric
from .const import HASH
from .util import hash_convert, hash_convert_raw, parse_signature, \
    load_certificate, transform_key_to_list

log = logging.getLogger(__name__)


class Verify:  # pylint: disable=too-few-public-methods
    """
    Verify operation
    """

    def __init__(self, session_obj):
        """
        Constructor
        :param session_obj: Instance of session
        """
        self._session = session_obj
        self._ctx_ks = KeyStore(self._session)
        self._ctx_key = KeyObject(self._ctx_ks)
        self.hash_algo = apis.kAlgorithm_None

    def do_verification(self, key_id, input_file, signature_file,  # pylint: disable=too-many-locals, too-many-arguments
                        encode_format="", hash_algo=''):
        """
        Do verify operation
        :param key_id: Key index
        :param input_file: Input data to verify with signature
        :param signature_file: Input signed data to verify with raw data
        :param encode_format: file Encode format. Eg: PEM, DER
        :param hash_algo: hash algorithm for verify
        :return: Status
        """

        status, object_type, cipher_type = self._ctx_key.get_handle(key_id)  # pylint: disable=unused-variable
        if status != apis.kStatus_SSS_Success:
            return status

        if hash_algo == '':
            # Default hash algorithm
            if cipher_type in [apis.kSSS_CipherType_RSA, apis.kSSS_CipherType_RSA_CRT]:
                log.debug("Considering Algorithm_SSS_RSASSA_PKCS1_PSS_MGF1_SHA256"
                          " as Default hash algorithm for RSA")
                self.hash_algo = apis.kAlgorithm_SSS_RSASSA_PKCS1_PSS_MGF1_SHA256
            elif cipher_type in [apis.kSSS_CipherType_EC_TWISTED_ED]:
                log.debug("Considering Algorithm_SSS_SHA512 as Default hash algorithm")
                self.hash_algo = apis.kAlgorithm_SSS_SHA512
            else:
                log.debug("Considering Algorithm_SSS_SHA256 as Default hash algorithm")
                self.hash_algo = apis.kAlgorithm_SSS_SHA256
        else:
            # Take hash algorithm from user
            self.hash_algo = HASH[hash_algo]
        try:
            if not os.path.isfile(input_file):
                raise Exception("Incorrect input file, try verifying with correct input file !!")

            if cipher_type in [apis.kSSS_CipherType_EC_TWISTED_ED]:
                digest, digest_len = load_certificate(input_file)

            else:
                (digest, digest_len) = hash_convert(input_file, encode_format, self.hash_algo)

        except Exception as exc:  # pylint: disable=broad-except
            # If input data is not certificate, then load it as binary data
            if 'Unable to load certificate' in str(exc):
                if os.path.isfile(input_file):
                    with open(input_file, 'rb') as raw_data:
                        src_data = raw_data.read()
                    if cipher_type in [apis.kSSS_CipherType_EC_TWISTED_ED]:
                        cert_hex = binascii.hexlify(src_data)
                        digest = transform_key_to_list(cert_hex)
                        digest_len = len(digest)
                    else:
                        (digest, digest_len) = hash_convert_raw(src_data, self.hash_algo)
                else:
                    raise Exception("Incorrect input file, try verifying with correct input file !!")
            else:
                raise exc
        try:
            (signature, signature_len) = parse_signature(signature_file, encode_format)
        except IOError as exc:
            log.error(exc)
            return apis.kStatus_SSS_Fail
        digest_ctype = (ctypes.c_ubyte * digest_len)(*digest)
        mode = apis.kMode_SSS_Verify
        signature_ctype = (ctypes.c_uint8 * signature_len)(*signature)
        signature_len_ctype = ctypes.c_size_t(signature_len)

        ctx_asymm = Asymmetric(self._session, self._ctx_key, self.hash_algo, mode)
        if cipher_type in [apis.kSSS_CipherType_EC_TWISTED_ED]:
            status = ctx_asymm.se05x_verify(
                digest_ctype, digest_len, signature_ctype, signature_len_ctype)
        else:
            status = ctx_asymm.verify(
                digest_ctype, digest_len, signature_ctype, signature_len_ctype)
        return status