/*

* Copyright (c) 2008 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:

*

*/

package com.nokia.mj.impl.security.midp.storage;

import com.nokia.mj.impl.utils.Uid;

import com.nokia.mj.impl.security.midp.common.AuthorizationRestriction;

import com.nokia.mj.impl.security.midp.common.AuthorizationRestrictionAttribute;

import com.nokia.mj.impl.security.midp.common.AuthenticationAttribute;

import com.nokia.mj.impl.security.midp.common.PolicyBasedPermission;

import com.nokia.mj.impl.security.midp.common.PolicyBasedPermissionImpl;

import com.nokia.mj.impl.security.midp.common.UserSecuritySettings;

import com.nokia.mj.impl.security.midp.common.UserSecuritySettingsImpl;

import com.nokia.mj.impl.security.midp.common.SecurityAttributes;

import com.nokia.mj.impl.security.midp.common.GeneralSecuritySettings;

import com.nokia.mj.impl.storage.*;

import com.nokia.mj.impl.utils.Logger;

import com.nokia.mj.impl.utils.Tokenizer;

import java.util.Vector;

import java.util.Hashtable;

/**

 * Class for handling the security related storage data. There are three types

 * of security data:

 *    - authentication data, which includes:

 *        - security domain

 *        - jar hash

 *        - root hash

 *        - succesfully validated certificates

 *    - authorization data, which includes the set of granted permissions

 *    - app access authorization data, which includes:

 *        - vendor name

 *        - domain name

 *        - signers list (the end-entity certificates from the succesfully

 *          validated certificate chains)

 */

public final class SecurityStorage

{

    /* Session to storage */

    private StorageSession session = null;

    // boolean indicating if the storage session needs to be destroyed.

    // This flag is modified if the storage session has been provided

    // to this class, so that the one providing the storage session

    // will destroy it

    private boolean destroyStorageSession = true;

    /*

     * The allowed modes info is stored as a 4-bit constant:

     *     X(oneshot)X(session)X(blanket)X(no)

     * e.g. 1011 (=11) means that oneshot, blanket and no are allowed.

     * The following constants are used to encode/decode the allowed modes

     * into/from a 4-bit number

     */

    private static final int NO_MASK = 1;

    private static final int BLANKET_MASK = 2;

    private static final int SESSION_MASK = 4;

    private static final int ONESHOT_MASK = 8;

    /*

     * The actual interaction with the storage session is kept in one place

     * (so that error handling is centralized, instead of being spread here

     * and there). These constants specify which storage operation to be

     * executed

     */

    private static final int STORAGE_OPEN = 1;

    private static final int STORAGE_CLOSE = 2;

    private static final int STORAGE_SEARCH = 3;

    private static final int STORAGE_WRITE = 4;

    private static final int STORAGE_UPDATE = 5;

    private static final int STORAGE_REMOVE = 6;

    /*

     * Filters for specifying which app access authorization data to be read

     * from storage

     */

    public static final int APP_ACCESS_AUTH_DOMAIN_QUERY = 1;

    public static final int APP_ACCESS_AUTH_VENDOR_QUERY = 2;

    public static final int APP_ACCESS_AUTH_SIGNERS_LIST_QUERY = 4;

    /*

     * Filters for specifying which authentication data to be read

     * from storage

     */

    public static final int AUTHENTICATION_DOMAIN_NAME_QUERY = 1;

    public static final int AUTHENTICATION_DOMAIN_CATEGORY_QUERY = 2;

    public static final int AUTHENTICATION_ROOT_HASH_QUERY = 4;

    public static final int AUTHENTICATION_JAR_HASH_QUERY = 8;

    public static final int AUTHENTICATION_VALID_CERTS_QUERY = 16;

    /**

     * Constructor

     */

    public SecurityStorage()

    {

        doStorageOpen();

    }

    /**

     * Constructor

     */

    public SecurityStorage(StorageSession session)

    {

        if (session != null)

        {

            destroyStorageSession = false;

            this.session = session;

        }

        else

        {

            doStorageOpen();

        }

    }

    /**

     * Destroies the session to the storage

     */

    public void close()

    {

        doStorageClose();

    }

    /**

     * Retrieves the storage session

     */

    public StorageSession getStorageSession()

    {

        return session;

    }

    /**

     * Retrieves the authorization restrictions of a certain application

     *

     * @param appUID the UID of the application whose authorization

     *               restrictions are retrieved

     * @return       an array of all the authorization restrictions or null if

     *               no restrictions found

     */

    public AuthorizationRestriction[] readAuthorizationRestrictions(Uid appUID)

    {

        if (appUID == null)

        {

            return null;

        }

        Vector authRestrictions = new Vector();

        StorageEntry query = new StorageEntry();

        query.addAttribute(new StorageAttribute(

                               StorageAttribute.ID,

                               appUID.getStringValue()));

        int i=1;

        while (true)

        {

            String mainAttrName = AuthorizationRestrictionAttribute

                                  .MAIN_ATTRIBUTE_PREFIX  + i;

            StorageAttribute mainAttr = new StorageAttribute(

                StorageNames.NAME, mainAttrName);

            query.addAttribute(mainAttr);

            query.addAttribute(new StorageAttribute(StorageNames.VALUE, ""));

            StorageEntry[] entries = doStorageSearch(

                                         StorageNames.APPLICATION_PACKAGE_ATTRIBUTES_TABLE, query);

            if (entries != null && entries.length > 0)

            {

                String mainAttrValue = getStorageAttributeValue(entries[0],

                                       StorageNames.VALUE);

                String secondAttrName = AuthorizationRestrictionAttribute

                                        .SECOND_ATTRIBUTE_PREFIX + i;

                query.removeAttribute(mainAttr);

                StorageAttribute secondAttr = new StorageAttribute(

                    StorageNames.NAME, secondAttrName);

                query.addAttribute(secondAttr);

                entries = doStorageSearch(

                              StorageNames.APPLICATION_PACKAGE_ATTRIBUTES_TABLE,

                              query);

                if (entries != null && entries.length > 0)

                {

                    String secondAttrValue = getStorageAttributeValue(

                                                 entries[0], StorageNames.VALUE);

                    authRestrictions.addElement(

                        new AuthorizationRestrictionAttribute(

                            mainAttrName, mainAttrValue,

                            secondAttrName, secondAttrValue));

                }

                else

                {

                    authRestrictions.addElement(

                        new AuthorizationRestrictionAttribute(

                            mainAttrName, mainAttrValue,

                            null, null));

                }

                query.removeAttribute(secondAttr);

            }

            else

            {

                break;

            }

            i++;

        }

        if (authRestrictions.size() == 0)

        {

            return null;

        }

        AuthorizationRestriction[] authorizationRestrictions =

            new AuthorizationRestriction[authRestrictions.size()];

        authRestrictions.copyInto(authorizationRestrictions);

        return authorizationRestrictions;

    }

    public AppAccessAuthorizationStorageData readAppAccessAuthorizationStorageData(Uid appUID)

    {

        // read everything

        return readAppAccessAuthorizationStorageData(appUID,

                APP_ACCESS_AUTH_DOMAIN_QUERY | APP_ACCESS_AUTH_VENDOR_QUERY | APP_ACCESS_AUTH_SIGNERS_LIST_QUERY);

    }

    /**

     * Retrieves the app access authorization data of a certain application

     *

     * @param aAppName    the name of the application for which the

     *                    authentication data is queried

     * @param aAppVersion the version of the application for which the

     *                    authentication data is queried

     * @param aAppVendor  the vendor of the application for which the

     *                    authentication data is queried

     * @param readFilter  specifies which app access authorization data to be

     *                    read

     * @return            the app access authorization data associated with the

     *                    queried application

     */

    public AppAccessAuthorizationStorageData readAppAccessAuthorizationStorageData(

        String aAppName,

        String aAppVersion,

        String aAppVendor,

        int readFilter)

    {

        return readAppAccessAuthorizationStorageData(null /* appUID */,

                aAppName,

                aAppVersion,

                aAppVendor,

                readFilter);

    }

    /**

     * Retrieves the app access authorization data of a certain application

     *

     * @param appUID     the UID of the application whose app access

     *                   authorization

     *                   data is retrieved

     * @param readFilter specifies which app access authorization data to be

     *                   read

     * @return           the app access authorization data

     */

    public AppAccessAuthorizationStorageData readAppAccessAuthorizationStorageData(

        Uid appUID, int readFilter)

    {

        return readAppAccessAuthorizationStorageData(appUID,

                null /* appName */,

                null /* appVersion */,

                null /* appvendor*/,

                readFilter);

    }

    /**

     * Retrieves the permissions granted to a certain application.

     * The user permissions are retrieved first and then the rest

     * of the permissions

     *

     * @param appUID the UID of the application whose granted permissions

     *               are retrieved

     * @return      aAn array of the granted permissions

     */

    public Vector readGrantedPermissions(Uid appUID)

    {

        if (appUID == null)

        {

            return null;

        }

        StorageEntry query = new StorageEntry();

        query.addAttribute(new StorageAttribute(

                               StorageAttribute.ID,

                               appUID.getStringValue()));

        StorageEntry[] permEntries = doStorageSearch(

                                         StorageNames.MIDP_PERMISSIONS_TABLE, query);

        Vector permissions = new Vector();

        Vector nonUserPermissions = new Vector();

        // put all the function group names into a hashtable and use it

        // to check if details of a certain function group have already

        // been read from storage (it's faster than querying the

        // storage)

        Hashtable fGroups = new Hashtable();

        if (permEntries != null && permEntries.length > 0)

        {

            for (int i=0; i<permEntries.length; i++)

            {

                String className = getStorageAttributeValue(permEntries[i],

                                   StorageNames.CLASS);

                String target = getStorageAttributeValue(permEntries[i],

                                StorageNames.NAME);

                String actionList = getStorageAttributeValue(permEntries[i],

                                    StorageNames.ACTION);

                FunctionGroup fg = decodeFunctionGroup(

                                getStorageAttributeValue(permEntries[i],

                                StorageNames.FUNCTION_GROUP));

                if (fg != null)

                {

                    UserSecuritySettings cachedSettings =

                        (UserSecuritySettings)fGroups.get(fg.name);

                    if (cachedSettings != null)

                    {

                        permissions.addElement(

                            new PolicyBasedPermissionImpl(

                                className,

                                target,

                                actionList,

                                fg.type,

                                cachedSettings));

                    }

                    else

                    {

                        // query the settings details

                        StorageEntry fgQuery = new StorageEntry();

                        fgQuery.addAttribute(new StorageAttribute(

                                                 StorageAttribute.ID,

                                                 appUID.getStringValue()));

                        fgQuery.addAttribute(new StorageAttribute(

                                                 StorageNames.FUNCTION_GROUP,

                                                 fg.name));

                        fgQuery.addAttribute(new StorageAttribute(

                                                 StorageNames.ALLOWED_SETTINGS,

                                                 ""));

                        fgQuery.addAttribute(new StorageAttribute(

                                                 StorageNames.CURRENT_SETTING,

                                                 ""));

                        fgQuery.addAttribute(new StorageAttribute(

                                                 StorageNames.BLANKET_PROMPT,

                                                 ""));

                        StorageEntry[] fgEntries = doStorageSearch(

                                                       StorageNames.MIDP_FUNC_GRP_SETTINGS_TABLE,

                                                       fgQuery);

                        if (fgEntries != null && fgEntries.length > 0)

                        {

                            try

                            {

                                int allowedSettings = Integer.valueOf(

                                                          getStorageAttributeValue(fgEntries[0],

                                                                                   StorageNames.ALLOWED_SETTINGS)).intValue();

                                int currentSetting = Integer.valueOf(

                                                         getStorageAttributeValue(fgEntries[0],

                                                                                  StorageNames.CURRENT_SETTING)).intValue();

                                String blanketPrompt = getStorageAttributeValue(fgEntries[0],

                                                       StorageNames.BLANKET_PROMPT);

                                UserSecuritySettings settings = new UserSecuritySettingsImpl(

                                    fg.name,

                                    currentSetting,

                                    decodeAllowedSettings(allowedSettings),

                                    ("1".equals(blanketPrompt) ? true : false),

                                    fg.isActive);

                                permissions.addElement(

                                    new PolicyBasedPermissionImpl(

                                        className,

                                        target,

                                        actionList,

                                        fg.type,

                                        settings));

                                fGroups.put(fg.name, settings);

                            }

                            catch (NumberFormatException e)

                            {

                                Logger.ELOG(Logger.EJavaSecurity, "Permission read failed", e);

                            }

                        }

                    }

                }

                else

                {

                    // is not a user permission

                    nonUserPermissions.addElement(

                        new PolicyBasedPermissionImpl(

                            className,

                            target,

                            actionList,

                            null));

                }

                // cleanup the query, so it can be used at the next interation

                if (fg != null)

                {

                    query.removeAttribute(fg.name);

                }

            }

        }

        // add the non user permissions into the set of returned permissions

        for (int i=0; i<nonUserPermissions.size(); i++)

        {

            permissions.addElement(nonUserPermissions.elementAt(i));

        }

        if (permissions.size() == 0)

        {

            return null;

        }

        return permissions;

    }

    /**

     * Stores the set of permissions granted to a certain application.

     * If this is an update (oldAppUID parameter is not null), then the

     * settings of the old application are retained

     *

     * @param appUID               the UID of the application to whome the

     *                             permissions are granted

     * @param oldAppUID            the UID if the application being updated

     *                             (if applicable) or null otherwise

     * @param grantedPermissions   the set of granted permissions

     */

    public void writeGrantedPermissions(Uid appUID, Uid oldAppUID, Vector grantedPermissions, boolean preserveSettings)

    {

        if (grantedPermissions != null

                && grantedPermissions.size() > 0

                && appUID != null)

        {

            if (oldAppUID != null)

            {

                // remove granted permissions

                removeGrantedPermissions(appUID);

                // write granted permissions

                writeGrantedPermissions(appUID, null, grantedPermissions);

                return;

            }

            // put all the function group names into a vector and use it

            // to check if details of a certain function group have already

            // been writen into storage (it's faster than querying the

            // storage or overwriting the storage data)

            Vector fGroups = new Vector();

            for (int i=0; i<grantedPermissions.size(); i++)

            {

                PolicyBasedPermission p = (PolicyBasedPermission)

                                          grantedPermissions.elementAt(i);

                if (p == null)

                {

                    // move to the next permission

                    continue;

                }

                StorageEntry permEntry = new StorageEntry();

                permEntry.addAttribute(new StorageAttribute(

                                           StorageAttribute.ID,

                                           appUID.getStringValue()));

                permEntry.addAttribute(new StorageAttribute(

                                           StorageNames.CLASS,

                                           p.getName()));

                if (p.getTarget() != null

                        && p.getTarget().length() > 0)

                {

                    permEntry.addAttribute(new StorageAttribute(

                                               StorageNames.NAME,

                                               p.getTarget()));

                }

                if (p.getActionList() != null

                        && p.getActionList().length() > 0)

                {

                    permEntry.addAttribute(new StorageAttribute(

                                               StorageNames.ACTION,

                                               p.getActionList()));

                }

                UserSecuritySettings settings =

                    p.getUserSecuritySettings();

                if (settings != null)

                {

                    StorageEntry fgEntry = new StorageEntry();

                    fgEntry.addAttribute(new StorageAttribute(

                                             StorageAttribute.ID,

                                             appUID.getStringValue()));

                    // update the MIDP_FUNC_GRP_SETTINGS_TABLE table as well

                    // (if not already done)

                    String fgName = settings.getName();

                    StorageAttribute fgAttribute = new StorageAttribute(

                        StorageNames.FUNCTION_GROUP,

                        fgName);

                    if (p.getType() == PolicyBasedPermission.USER_ASSIGNED_TYPE 

                        || !settings.isActive())

                    {

                        // the inactive settings or the settings of assigned 

                        // permissions with user settings should be activated 

                        // only after the first usage of the permission. 

                        // Otherwise it creates confusion for the user, 

                        // like in the following use cases:

                        // 1) the installation time dialog would include the assigned

                        //    permissions even though the MIDlet did not request it

                        // 2) after installing a MIDlet suite and before accessing 

                        //    some protected functionality (which is guarder by 

                        //    assigned permission with user setting) the user sees 

                        //    the settings of the permissions in the MIDlet settings 

                        //   (even though the MIDlet might never access such 

                        //   functionality)

                        //

                        // disabling the settings = alter the name of the function 

                        // group stored in PERMISSIONS table

                        permEntry.addAttribute(new StorageAttribute(

                            StorageNames.FUNCTION_GROUP,

                            encodeFunctionGroup(p.getType(),fgName)));

                    }

                    else

                    {

                        permEntry.addAttribute(fgAttribute);

                    }

                    // Do we need to check if the settings which already exist

                    // are equal to the ones which are to be inserted?

                    // This won't even happen, since all the settings are read

                    // from the security policy

                    // If we don't check, then the first settings are stored and are

                    // available for all the permissions