# KeyStoreController.kt

    /*
     * The MIT License
     *
     * Original work sponsored and donated by The Danish Health Data Authority (http://www.sundhedsdatastyrelsen.dk)
     *
     * Copyright (C) 2021 The Danish Health Data Authority (http://www.sundhedsdatastyrelsen.dk)
     *
     *
     * Permission is hereby granted, free of charge, to any person obtaining a copy of
     * this software and associated documentation files (the "Software"), to deal in
     * the Software without restriction, including without limitation the rights to
     * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
     * of the Software, and to permit persons to whom the Software is furnished to do
     * so, subject to the following conditions:
     *
     *
     * The above copyright notice and this permission notice shall be included in all
     * copies or substantial portions of the Software.
     *
     *
     * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
     * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     * SOFTWARE.
     */

    package dk.nsp.api.auth.keystore

    import android.content.Context
    import dk.nsp.api.auth.keyserver.models.KeyModelDTO
    import dk.nsp.shared.util.sharedprefs.getDefaultSharedPrefs
    import javax.crypto.Cipher

    class KeyStoreController(private val context: Context) {
        private val storageName = "KeyStoreController"

        private val storedValues = KeyStoreValues(context, storageName)

        private val migrationController = AuthMigrationController()

        init {
            migrationController.handMigration(storedValues)
        }

        fun hasKeyIdAndRefreshToken() = hasKeyId() && hasRefreshToken()
        fun hasKeyId(): Boolean = storedValues.keyId != null
        fun hasRefreshToken(): Boolean = storedValues.encryptedRefreshToken != null

        /**
         * removes all settings stored in the KeyStoreController
         */
        fun clear() {
            removeRefreshTokenAndKeyId()
            removeLongSecretStoredViaBiometric()
            removeBiometricPreferences()
            storedValues.userName = null
        }

        private fun removeRefreshTokenAndKeyId() {
            storedValues.encryptedRefreshToken = null
            storedValues.keyId = null
        }

        fun canTryLoginViaBiometric(): Boolean =
            hasKeyIdAndRefreshToken() && hasLongSecretViaBiometric()

        @Throws(Exception::class)
        fun storeLongSecretViaBiometric(cipher: Cipher, keyModel: KeyModelDTO) {
            val encryptedLongSecret = cipher.doFinal(keyModel.longSecret.toByteArray())
            val unencryptedIv = cipher.iv
            storedValues.encryptedLongSecret = encryptedLongSecret
            storedValues.longSecretIv = unencryptedIv
        }

        /**
         * Tells if we have a valid combination of an iv and a long secret (encrypted via biometric)
         * @return Boolean true if we have and thus can use biometric to try and unlock the long secret.
         * false otherwise
         */
        fun hasLongSecretViaBiometric(): Boolean =
            storedValues.encryptedLongSecret != null && storedValues.longSecretIv != null

        fun removeLongSecretStoredViaBiometric() {
            storedValues.encryptedLongSecret = null
            storedValues.longSecretIv = null
        }

        fun removeBiometricPreferences() {
            context.getDefaultSharedPrefs().clearBiometricSettings()
        }

        /**
         * Store the refresh token together with the [KeyModelDTO.keyId]
         * @param encryptedRefreshToken The encrypted refresh token
         * @param keyId The [KeyModelDTO.keyId] for the KeyModel used to encrypt the refresh token
         */
        fun storeRefreshTokenAndKeyId(encryptedRefreshToken: ByteArray, keyId: String) {
            storedValues.keyId = keyId
            storedValues.encryptedRefreshToken = encryptedRefreshToken
        }

        fun getKeyId() = storedValues.keyId
        fun getEncryptedRefreshToken() = storedValues.encryptedRefreshToken
        fun getLongSecretIv() = storedValues.longSecretIv
        fun getEncryptedLongSecret() = storedValues.encryptedLongSecret
    }