//
//  SFHFKeychainUtils.m
//
//  Created by Buzz Andersen on 10/20/08.
//  Based partly on code by Jonathan Wight, Jon Crosby, and Mike Malone.
//  Copyright 2008 Sci-Fi Hi-Fi. All rights reserved.
//
//  Permission is hereby granted, free of charge, to any person
//  obtaining a copy of this software and associated documentation
//  files (the "Software"), to deal in the Software without
//  restriction, including without limitation the rights to use,
//  copy, modify, merge, publish, distribute, sublicense, and/or sell
//  copies of the Software, and to permit persons to whom the
//  Software is furnished to do so, subject to the following
//  conditions:
//
//  The above copyright notice and this permission notice shall be
//  included in all copies or substantial portions of the Software.
//
//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
//  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
//  OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
//  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
//  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
//  WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
//  FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
//  OTHER DEALINGS IN THE SOFTWARE.
//

#import "SFHFKeychainUtils.h"
#import <Security/Security.h>

static NSString *SFHFKeychainUtilsErrorDomain = @"SFHFKeychainUtilsErrorDomain";

#if __IPHONE_OS_VERSION_MIN_REQUIRED < 30000 && TARGET_IPHONE_SIMULATOR
@interface SFHFKeychainUtils (PrivateMethods)
+ (SecKeychainItemRef)getKeychainItemReferenceForUsername:(NSString *)username
                                            andServerName:(NSString *)serverName
                                                    error:(NSError **)error;
@end
#endif

@implementation SFHFKeychainUtils

#if __IPHONE_OS_VERSION_MIN_REQUIRED < 30000 && TARGET_IPHONE_SIMULATOR

+ (NSString *)getPasswordForUsername:(NSString *)username
                       andServerName:(NSString *)serverName
                               error:(NSError **)error
{
	if (!username || !serviceName)
	{
		*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-2000 userInfo:nil];
		return nil;
	}

	SecKeychainItemRef item = [SFHFKeychainUtils getKeychainItemReferenceForUsername:username
	                                                                   andServerName:serverName
	                                                                           error:error];

	if (*error || !item)
	{
		return nil;
	}

	// from Advanced Mac OS X Programming, ch. 16
	UInt32 length;
	char *password;
	SecKeychainAttribute attributes[8];
	SecKeychainAttributeList list;

	attributes[0].tag = kSecAccountItemAttr;
	attributes[1].tag = kSecDescriptionItemAttr;
	attributes[2].tag = kSecLabelItemAttr;
	attributes[3].tag = kSecModDateItemAttr;

	list.count = 4;
	list.attr = attributes;

	OSStatus status = SecKeychainItemCopyContent(item, NULL, &list, &length, (void **)&password);

	if (status != noErr)
	{
		*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:status userInfo:nil];
		return nil;
	}

	NSString *passwordString = nil;

	if (password != NULL)
	{
		char passwordBuffer[1024];

		if (length > 1023)
		{
			length = 1023;
		}
		strncpy(passwordBuffer, password, length);

		passwordBuffer[length] = '\0';
		passwordString = [NSString stringWithCString:passwordBuffer];
	}

	SecKeychainItemFreeContent(&list, password);

	CFRelease(item);

	return passwordString;
}

+ (void)storeUsername:(NSString *)username
          andPassword:(NSString *)password
        forServerName:(NSString *)serverName
       updateExisting:(BOOL)updateExisting
                error:(NSError **)error
{
	if (!username || !password || !serverName)
	{
		*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-2000 userInfo:nil];
		return;
	}

	OSStatus status = noErr;

	SecKeychainItemRef item = [SFHFKeychainUtils getKeychainItemReferenceForUsername:username
	                                                                   andServerName:serverName
	                                                                           error:error];

	if (*error && [*error code] != noErr)
	{
		return;
	}

	*error = nil;

	if (item)
	{
		status = SecKeychainItemModifyAttributesAndData(item, NULL, strlen([password UTF8String]),
		                                                [password UTF8String]);

		CFRelease(item);
	}
	else
	{
		status = SecKeychainAddGenericPassword(
		    NULL, strlen([serverName UTF8String]), [serverName UTF8String],
		    strlen([username UTF8String]), [username UTF8String], strlen([password UTF8String]),
		    [password UTF8String], NULL);
	}

	if (status != noErr)
	{
		*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:status userInfo:nil];
	}
}

+ (void)deleteItemForUsername:(NSString *)username
                andServerName:(NSString *)serverName
                        error:(NSError **)error
{
	if (!username || !serverName)
	{
		*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:2000 userInfo:nil];
		return;
	}

	*error = nil;

	SecKeychainItemRef item = [SFHFKeychainUtils getKeychainItemReferenceForUsername:username
	                                                                   andServerName:serverName
	                                                                           error:error];

	if (*error && [*error code] != noErr)
	{
		return;
	}

	OSStatus status;

	if (item)
	{
		status = SecKeychainItemDelete(item);

		CFRelease(item);
	}

	if (status != noErr)
	{
		*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:status userInfo:nil];
	}
}

+ (SecKeychainItemRef)getKeychainItemReferenceForUsername:(NSString *)username
                                            andServerName:(NSString *)serverName
                                                    error:(NSError **)error
{
	if (!username || !serverName)
	{
		*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-2000 userInfo:nil];
		return nil;
	}

	*error = nil;

	SecKeychainItemRef item;

	OSStatus status = SecKeychainFindGenericPassword(
	    NULL, strlen([serverName UTF8String]), [serverName UTF8String],
	    strlen([username UTF8String]), [username UTF8String], NULL, NULL, &item);

	if (status != noErr)
	{
		if (status != errSecItemNotFound)
		{
			*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain
			                             code:status
			                         userInfo:nil];
		}

		return nil;
	}

	return item;
}

#else

+ (NSString *)getPasswordForUsername:(NSString *)username
                       andServerName:(NSString *)serverName
                               error:(NSError **)error
{
	if (!username || !serverName)
	{
		if (error != nil)
		{
			*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-2000 userInfo:nil];
		}
		return nil;
	}

	if (error != nil)
	{
		*error = nil;
	}

	// Set up a query dictionary with the base query attributes: item type (generic), username, and
	// service

	NSArray *keys = [[[NSArray alloc]
	    initWithObjects:(NSString *)kSecClass, kSecAttrAccount, kSecAttrService, nil] autorelease];
	NSArray *objects = [[[NSArray alloc] initWithObjects:(NSString *)kSecClassGenericPassword,
	                                                     username, serverName, nil] autorelease];

	NSMutableDictionary *query = [[[NSMutableDictionary alloc] initWithObjects:objects
	                                                                   forKeys:keys] autorelease];

	// First do a query for attributes, in case we already have a Keychain item with no password
	// data set. One likely way such an incorrect item could have come about is due to the previous
	// (incorrect) version of this code (which set the password as a generic attribute instead of
	// password data).

	NSDictionary *attributeResult = NULL;
	NSMutableDictionary *attributeQuery = [query mutableCopy];
	[attributeQuery setObject:(id)kCFBooleanTrue forKey:(id)kSecReturnAttributes];
	OSStatus status =
	    SecItemCopyMatching((CFDictionaryRef)attributeQuery, (CFTypeRef *)&attributeResult);

	[attributeResult release];
	[attributeQuery release];

	if (status != noErr)
	{
		// No existing item found--simply return nil for the password
		if (error != nil && status != errSecItemNotFound)
		{
			// Only return an error if a real exception happened--not simply for "not found."
			*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain
			                             code:status
			                         userInfo:nil];
		}

		return nil;
	}

	// We have an existing item, now query for the password data associated with it.

	NSData *resultData = nil;
	NSMutableDictionary *passwordQuery = [query mutableCopy];
	[passwordQuery setObject:(id)kCFBooleanTrue forKey:(id)kSecReturnData];

	status = SecItemCopyMatching((CFDictionaryRef)passwordQuery, (CFTypeRef *)&resultData);

	[resultData autorelease];
	[passwordQuery release];

	if (status != noErr)
	{
		if (status == errSecItemNotFound)
		{
			// We found attributes for the item previously, but no password now, so return a special
			// error. Users of this API will probably want to detect this error and prompt the user
			// to re-enter their credentials.  When you attempt to store the re-entered credentials
			// using storeUsername:andPassword:forServiceName:updateExisting:error
			// the old, incorrect entry will be deleted and a new one with a properly encrypted
			// password will be added.
			if (error != nil)
			{
				*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain
				                             code:-1999
				                         userInfo:nil];
			}
		}
		else
		{
			// Something else went wrong. Simply return the normal Keychain API error code.
			if (error != nil)
			{
				*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain
				                             code:status
				                         userInfo:nil];
			}
		}

		return nil;
	}

	NSString *password = nil;

	if (resultData)
	{
		password = [[NSString alloc] initWithData:resultData encoding:NSUTF8StringEncoding];
	}
	else
	{
		// There is an existing item, but we weren't able to get password data for it for some
		// reason, Possibly as a result of an item being incorrectly entered by the previous code.
		// Set the -1999 error so the code above us can prompt the user again.
		if (error != nil)
		{
			*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-1999 userInfo:nil];
		}
	}

	return [password autorelease];
}

+ (BOOL)storeUsername:(NSString *)username
          andPassword:(NSString *)password
        forServerName:(NSString *)serverName
       updateExisting:(BOOL)updateExisting
                error:(NSError **)error
{
	if (!username || !password || !serverName)
	{
		if (error != nil)
		{
			*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-2000 userInfo:nil];
		}
		return NO;
	}

	// See if we already have a password entered for these credentials.
	NSError *getError = nil;
	NSString *existingPassword = [SFHFKeychainUtils getPasswordForUsername:username
	                                                         andServerName:serverName
	                                                                 error:&getError];

	if ([getError code] == -1999)
	{
		// There is an existing entry without a password properly stored (possibly as a result of
		// the previous incorrect version of this code. Delete the existing item before moving on
		// entering a correct one.

		getError = nil;

		[self deleteItemForUsername:username andServerName:serverName error:&getError];

		if ([getError code] != noErr)
		{
			if (error != nil)
			{
				*error = getError;
			}
			return NO;
		}
	}
	else if ([getError code] != noErr)
	{
		if (error != nil)
		{
			*error = getError;
		}
		return NO;
	}

	if (error != nil)
	{
		*error = nil;
	}

	OSStatus status = noErr;

	if (existingPassword)
	{
		// We have an existing, properly entered item with a password.
		// Update the existing item.

		if (![existingPassword isEqualToString:password] && updateExisting)
		{
			// Only update if we're allowed to update existing.  If not, simply do nothing.

			NSArray *keys =
			    [[[NSArray alloc] initWithObjects:(NSString *)kSecClass, kSecAttrService,
			                                      kSecAttrLabel, kSecAttrAccount, nil] autorelease];

			NSArray *objects =
			    [[[NSArray alloc] initWithObjects:(NSString *)kSecClassGenericPassword, serverName,
			                                      serverName, username, nil] autorelease];

			NSDictionary *query = [[[NSDictionary alloc] initWithObjects:objects
			                                                     forKeys:keys] autorelease];

			status = SecItemUpdate(
			    (CFDictionaryRef)query,
			    (CFDictionaryRef)[NSDictionary
			        dictionaryWithObject:[password dataUsingEncoding:NSUTF8StringEncoding]
			                      forKey:(NSString *)kSecValueData]);
		}
	}
	else
	{
		// No existing entry (or an existing, improperly entered, and therefore now
		// deleted, entry).  Create a new entry.

		NSArray *keys =
		    [[[NSArray alloc] initWithObjects:(NSString *)kSecClass, kSecAttrService, kSecAttrLabel,
		                                      kSecAttrAccount, kSecValueData, nil] autorelease];

		NSArray *objects = [[[NSArray alloc]
		    initWithObjects:(NSString *)kSecClassGenericPassword, serverName, serverName, username,
		                    [password dataUsingEncoding:NSUTF8StringEncoding], nil] autorelease];

		NSDictionary *query = [[[NSDictionary alloc] initWithObjects:objects
		                                                     forKeys:keys] autorelease];

		status = SecItemAdd((CFDictionaryRef)query, NULL);
	}

	if (error != nil && status != noErr)
	{
		// Something went wrong with adding the new item. Return the Keychain error code.
		*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:status userInfo:nil];

		return NO;
	}

	return YES;
}

+ (BOOL)deleteItemForUsername:(NSString *)username
                andServerName:(NSString *)serverName
                        error:(NSError **)error
{
	if (!username || !serverName)
	{
		if (error != nil)
		{
			*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-2000 userInfo:nil];
		}
		return NO;
	}

	if (error != nil)
	{
		*error = nil;
	}

	NSArray *keys =
	    [[[NSArray alloc] initWithObjects:(NSString *)kSecClass, kSecAttrAccount, kSecAttrService,
	                                      kSecReturnAttributes, nil] autorelease];
	NSArray *objects =
	    [[[NSArray alloc] initWithObjects:(NSString *)kSecClassGenericPassword, username,
	                                      serverName, kCFBooleanTrue, nil] autorelease];

	NSDictionary *query = [[[NSDictionary alloc] initWithObjects:objects forKeys:keys] autorelease];

	OSStatus status = SecItemDelete((CFDictionaryRef)query);

	if (error != nil && status != noErr)
	{
		*error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:status userInfo:nil];

		return NO;
	}

	return YES;
}

#endif

@end