# BiometricCipherKeyStore.kt

    /*
     * The MIT License
     *
     * Original work sponsored and donated by The Danish Health Data Authority (http://www.sundhedsdatastyrelsen.dk)
     *
     * Copyright (C) 2021 The Danish Health Data Authority (http://www.sundhedsdatastyrelsen.dk)
     *
     *
     * Permission is hereby granted, free of charge, to any person obtaining a copy of
     * this software and associated documentation files (the "Software"), to deal in
     * the Software without restriction, including without limitation the rights to
     * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
     * of the Software, and to permit persons to whom the Software is furnished to do
     * so, subject to the following conditions:
     *
     *
     * The above copyright notice and this permission notice shall be included in all
     * copies or substantial portions of the Software.
     *
     *
     * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
     * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     * SOFTWARE.
     */

    package dk.nsp.domain.auth

    import android.content.Context
    import dk.nsp.api.auth.keystore.KeyStoreController
    import javax.crypto.Cipher
    import javax.crypto.SecretKey
    import javax.crypto.spec.IvParameterSpec

    class BiometricCipherKeyStore(context: Context) {

        private val aliasId = "alias"
        private val keyStoreController =
            KeyStoreController(context.applicationContext)

        /**
         * Gets a keystore cipher that is ready for the given operation.
         * @param shouldEncrypt Boolean true if we want to encrypt data, false means decrypt data
         * @return Cipher?
         */
        @Throws(Exception::class)
        fun getKeyStoreCipher(shouldEncrypt: Boolean): Cipher? {
            val (keystoreCipher, key) = getKeyStoreCipherBeforeInit() ?: return null
            if (shouldEncrypt) {
                keystoreCipher.init(Cipher.ENCRYPT_MODE, key)
            } else {
                val iv = keyStoreController.getLongSecretIv() ?: return null
                keystoreCipher.init(Cipher.DECRYPT_MODE, key, IvParameterSpec(iv))
            }

            return keystoreCipher
        }

        @Throws(Exception::class)
        private fun getKeyStoreCipherBeforeInit(): Pair<Cipher, SecretKey>? {
            val helper = BiometricsHelper.get()
            val keyStoreCipher = helper.createKeyStoreCipher()
            val keystore = helper.getKeystore()

            val key = keystore.getKey(aliasId, null) as SecretKey?
            val safeKey = key ?: helper.createCipherKeyGenerator().generateKey()

            return Pair(keyStoreCipher, safeKey)
        }

        @Throws(Exception::class)
        fun deleteStoredKey() {
            BiometricsHelper.get().getKeystore().deleteEntry(aliasId)
        }

        /**
         * Check if we can attempt a login via fingerprint
         * @return Boolean true if fingerprint login should be possible
         */
        fun hasAllRequiredStored(): Boolean {
            return try {
                BiometricsHelper.get().getKeystore().containsAlias(aliasId)
                    && keyStoreController.canTryLoginViaBiometric()
            } catch (e: Exception) {
                false
            }
        }
    }