/**

* Apache License

* Version 2.0, January 2004

* http://www.apache.org/licenses/

*

* TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

*

* 1. Definitions.

*

* "License" shall mean the terms and conditions for use, reproduction,

* and distribution as defined by Sections 1 through 9 of this document.

*

* "Licensor" shall mean the copyright owner or entity authorized by

* the copyright owner that is granting the License.

*

* "Legal Entity" shall mean the union of the acting entity and all

* other entities that control, are controlled by, or are under common

* control with that entity. For the purposes of this definition,

* "control" means (i) the power, direct or indirect, to cause the

* direction or management of such entity, whether by contract or

* otherwise, or (ii) ownership of fifty percent (50%) or more of the

* outstanding shares, or (iii) beneficial ownership of such entity.

*

* "You" (or "Your") shall mean an individual or Legal Entity

* exercising permissions granted by this License.

*

* "Source" form shall mean the preferred form for making modifications,

* including but not limited to software source code, documentation

* source, and configuration files.

*

* "Object" form shall mean any form resulting from mechanical

* transformation or translation of a Source form, including but

* not limited to compiled object code, generated documentation,

* and conversions to other media types.

*

* "Work" shall mean the work of authorship, whether in Source or

* Object form, made available under the License, as indicated by a

* copyright notice that is included in or attached to the work

* (an example is provided in the Appendix below).

*

* "Derivative Works" shall mean any work, whether in Source or Object

* form, that is based on (or derived from) the Work and for which the

* editorial revisions, annotations, elaborations, or other modifications

* represent, as a whole, an original work of authorship. For the purposes

* of this License, Derivative Works shall not include works that remain

* separable from, or merely link (or bind by name) to the interfaces of,

* the Work and Derivative Works thereof.

*

* "Contribution" shall mean any work of authorship, including

* the original version of the Work and any modifications or additions

* to that Work or Derivative Works thereof, that is intentionally

* submitted to Licensor for inclusion in the Work by the copyright owner

* or by an individual or Legal Entity authorized to submit on behalf of

* the copyright owner. For the purposes of this definition, "submitted"

* means any form of electronic, verbal, or written communication sent

* to the Licensor or its representatives, including but not limited to

* communication on electronic mailing lists, source code control systems,

* and issue tracking systems that are managed by, or on behalf of, the

* Licensor for the purpose of discussing and improving the Work, but

* excluding communication that is conspicuously marked or otherwise

* designated in writing by the copyright owner as "Not a Contribution."

*

* "Contributor" shall mean Licensor and any individual or Legal Entity

* on behalf of whom a Contribution has been received by Licensor and

* subsequently incorporated within the Work.

*

* 2. Grant of Copyright License. Subject to the terms and conditions of

* this License, each Contributor hereby grants to You a perpetual,

* worldwide, non-exclusive, no-charge, royalty-free, irrevocable

* copyright license to reproduce, prepare Derivative Works of,

* publicly display, publicly perform, sublicense, and distribute the

* Work and such Derivative Works in Source or Object form.

*

* 3. Grant of Patent License. Subject to the terms and conditions of

* this License, each Contributor hereby grants to You a perpetual,

* worldwide, non-exclusive, no-charge, royalty-free, irrevocable

* (except as stated in this section) patent license to make, have made,

* use, offer to sell, sell, import, and otherwise transfer the Work,

* where such license applies only to those patent claims licensable

* by such Contributor that are necessarily infringed by their

* Contribution(s) alone or by combination of their Contribution(s)

* with the Work to which such Contribution(s) was submitted. If You

* institute patent litigation against any entity (including a

* cross-claim or counterclaim in a lawsuit) alleging that the Work

* or a Contribution incorporated within the Work constitutes direct

* or contributory patent infringement, then any patent licenses

* granted to You under this License for that Work shall terminate

* as of the date such litigation is filed.

*

* 4. Redistribution. You may reproduce and distribute copies of the

* Work or Derivative Works thereof in any medium, with or without

* modifications, and in Source or Object form, provided that You

* meet the following conditions:

*

* (a) You must give any other recipients of the Work or

* Derivative Works a copy of this License; and

*

* (b) You must cause any modified files to carry prominent notices

* stating that You changed the files; and

*

* (c) You must retain, in the Source form of any Derivative Works

* that You distribute, all copyright, patent, trademark, and

* attribution notices from the Source form of the Work,

* excluding those notices that do not pertain to any part of

* the Derivative Works; and

*

* (d) If the Work includes a "NOTICE" text file as part of its

* distribution, then any Derivative Works that You distribute must

* include a readable copy of the attribution notices contained

* within such NOTICE file, excluding those notices that do not

* pertain to any part of the Derivative Works, in at least one

* of the following places: within a NOTICE text file distributed

* as part of the Derivative Works; within the Source form or

* documentation, if provided along with the Derivative Works; or,

* within a display generated by the Derivative Works, if and

* wherever such third-party notices normally appear. The contents

* of the NOTICE file are for informational purposes only and

* do not modify the License. You may add Your own attribution

* notices within Derivative Works that You distribute, alongside

* or as an addendum to the NOTICE text from the Work, provided

* that such additional attribution notices cannot be construed

* as modifying the License.

*

* You may add Your own copyright statement to Your modifications and

* may provide additional or different license terms and conditions

* for use, reproduction, or distribution of Your modifications, or

* for any such Derivative Works as a whole, provided Your use,

* reproduction, and distribution of the Work otherwise complies with

* the conditions stated in this License.

*

* 5. Submission of Contributions. Unless You explicitly state otherwise,

* any Contribution intentionally submitted for inclusion in the Work

* by You to the Licensor shall be under the terms and conditions of

* this License, without any additional terms or conditions.

* Notwithstanding the above, nothing herein shall supersede or modify

* the terms of any separate license agreement you may have executed

* with Licensor regarding such Contributions.

*

* 6. Trademarks. This License does not grant permission to use the trade

* names, trademarks, service marks, or product names of the Licensor,

* except as required for reasonable and customary use in describing the

* origin of the Work and reproducing the content of the NOTICE file.

*

* 7. Disclaimer of Warranty. Unless required by applicable law or

* agreed to in writing, Licensor provides the Work (and each

* Contributor provides its Contributions) on an "AS IS" BASIS,

* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

* implied, including, without limitation, any warranties or conditions

* of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A

* PARTICULAR PURPOSE. You are solely responsible for determining the

* appropriateness of using or redistributing the Work and assume any

* risks associated with Your exercise of permissions under this License.

*

* 8. Limitation of Liability. In no event and under no legal theory,

* whether in tort (including negligence), contract, or otherwise,

* unless required by applicable law (such as deliberate and grossly

* negligent acts) or agreed to in writing, shall any Contributor be

* liable to You for damages, including any direct, indirect, special,

* incidental, or consequential damages of any character arising as a

* result of this License or out of the use or inability to use the

* Work (including but not limited to damages for loss of goodwill,

* work stoppage, computer failure or malfunction, or any and all

* other commercial damages or losses), even if such Contributor

* has been advised of the possibility of such damages.

*

* 9. Accepting Warranty or Additional Liability. While redistributing

* the Work or Derivative Works thereof, You may choose to offer,

* and charge a fee for, acceptance of support, warranty, indemnity,

* or other liability obligations and/or rights consistent with this

* License. However, in accepting such obligations, You may act only

* on Your own behalf and on Your sole responsibility, not on behalf

* of any other Contributor, and only if You agree to indemnify,

* defend, and hold each Contributor harmless for any liability

* incurred by, or claims asserted against, such Contributor by reason

* of your accepting any such warranty or additional liability.

*

* END OF TERMS AND CONDITIONS

*

* APPENDIX: How to apply the Apache License to your work.

*

* To apply the Apache License to your work, attach the following

* boilerplate notice, with the fields enclosed by brackets "{}"

* replaced with your own identifying information. (Don't include

* the brackets!) The text should be enclosed in the appropriate

* comment syntax for the file format. We also recommend that a

* file or class name and description of purpose be included on the

* same "printed page" as the copyright notice for easier

* identification within third-party archives.

*

* Copyright 2014 Edgar Espina

*

* Licensed under the Apache License, Version 2.0 (the "License");

* you may not use this file except in compliance with the License.

* You may obtain a copy of the License at

*

* http://www.apache.org/licenses/LICENSE-2.0

*

* Unless required by applicable law or agreed to in writing, software

* distributed under the License is distributed on an "AS IS" BASIS,

* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

* See the License for the specific language governing permissions and

* limitations under the License.

*/

package org.jooby;

import com.google.common.base.Splitter;

import com.google.common.base.Strings;

import com.google.common.io.BaseEncoding;

import static java.util.Objects.requireNonNull;

import org.jooby.funzy.Throwing;

import org.jooby.internal.CookieImpl;

import javax.annotation.Nonnull;

import javax.annotation.Nullable;

import javax.crypto.Mac;

import javax.crypto.spec.SecretKeySpec;

import java.net.URLDecoder;

import java.net.URLEncoder;

import java.nio.charset.StandardCharsets;

import java.util.Collections;

import java.util.Iterator;

import java.util.Map;

import java.util.Objects;

import java.util.Optional;

import java.util.function.Function;

import java.util.regex.Pattern;

import java.util.stream.Collectors;

/**

* Creates a cookie, a small amount of information sent by a server to

* a Web browser, saved by the browser, and later sent back to the server.

* A cookie's value can uniquely

* identify a client, so cookies are commonly used for session management.

*

* <p>

* A cookie has a name, a single value, and optional attributes such as a comment, path and domain

* qualifiers, a maximum age, and a version number.

* </p>

*

* <p>

* The server sends cookies to the browser by using the {@link Response#cookie(Cookie)} method,

* which adds fields to HTTP response headers to send cookies to the browser, one at a time. The

* browser is expected to support 20 cookies for each Web server, 300 cookies total, and may limit

* cookie size to 4 KB each.

* </p>

*

* <p>

* The browser returns cookies to the server by adding fields to HTTP request headers. Cookies can

* be retrieved from a request by using the {@link Request#cookie(String)} method. Several cookies

* might have the same name but different path attributes.

* </p>

*

* <p>

* This class supports both the Version 0 (by Netscape) and Version 1 (by RFC 2109) cookie

* specifications. By default, cookies are created using Version 0 to ensure the best

* interoperability.

* </p>

*

* @author edgar and various

* @since 0.1.0

*/

public interface Cookie {

/**

* Decode a cookie value using, like: <code>k=v</code>, multiple <code>k=v</code> pair are

* separated by <code>&amp;</code>. Also, <code>k</code> and <code>v</code> are decoded using

* {@link URLDecoder}.

*/

Function<String, Map<String, String>> URL_DECODER = value -> {

if (value == null) {

return Collections.emptyMap();

}

Throwing.Function<String, String> decode = v -> URLDecoder

.decode(v, StandardCharsets.UTF_8.name());

return Splitter.on('&')

.trimResults()

.omitEmptyStrings()

.splitToList(value)

.stream()

.map(v -> {

Iterator<String> it = Splitter.on('=').trimResults().omitEmptyStrings()

.split(v)

.iterator();

return new String[]{

decode.apply(it.next()),

it.hasNext() ? decode.apply(it.next()) : null

};

})

.filter(it -> Objects.nonNull(it[1]))

.collect(Collectors.toMap(it -> it[0], it -> it[1]));

};

/**

* Encode a hash into cookie value, like: <code>k1=v1&amp;...&amp;kn=vn</code>. Also,

* <code>key</code> and <code>value</code> are encoded using {@link URLEncoder}.

*/

Function<Map<String, String>, String> URL_ENCODER = value -> {

Throwing.Function<String, String> encode = v -> URLEncoder

.encode(v, StandardCharsets.UTF_8.name());

return value.entrySet().stream()

.map(e -> new StringBuilder()

.append(encode.apply(e.getKey()))

.append('=')

.append(encode.apply(e.getValue())))

.collect(Collectors.joining("&"))

.toString();

};

/**

* Build a {@link Cookie}.

*

* @author edgar

* @since 0.1.0

*/

class Definition {

/** Cookie's name. */

private String name;

/** Cookie's value. */

private String value;

/** Cookie's domain. */

private String domain;

/** Cookie's path. */

private String path;

/** Cookie's comment. */

private String comment;

/** HttpOnly flag. */

private Boolean httpOnly;

/** True, ensure that the session cookie is only transmitted via HTTPS. */

private Boolean secure;

/**

* By default, <code>-1</code> is returned, which indicates that the cookie will persist until

* browser shutdown.

*/

private Integer maxAge;

/**

* Creates a new {@link Definition cookie's definition}.

*/

protected Definition() {

}

/**

* Clone a new {@link Definition cookie's definition}.

*

* @param def A cookie's definition.

*/

public Definition(final Definition def) {

this.comment = def.comment;

this.domain = def.domain;

this.httpOnly = def.httpOnly;

this.maxAge = def.maxAge;

this.name = def.name;

this.path = def.path;

this.secure = def.secure;

this.value = def.value;

}

/**

* Creates a new {@link Definition cookie's definition}.

*

* @param name Cookie's name.

* @param value Cookie's value.

*/

public Definition(final String name, final String value) {

name(name);

value(value);

}

/**

* Creates a new {@link Definition cookie's definition}.

*

* @param name Cookie's name.

*/

public Definition(final String name) {

name(name);

}

/**

* Produces a cookie from current definition.

*

* @return A new cookie.

*/

@Nonnull

public Cookie toCookie() {

return new CookieImpl(this);

}

@Override

public String toString() {

return toCookie().encode();

}

/**

* Set/Override the cookie's name.

*

* @param name A cookie's name.

* @return This definition.

*/

@Nonnull

public Definition name(final String name) {

this.name = requireNonNull(name, "A cookie name is required.");

return this;

}

/**

* @return Cookie's name.

*/

@Nonnull

public Optional<String> name() {

return Optional.ofNullable(name);

}

/**

* Set the cookie's value.

*

* @param value A value.

* @return This definition.

*/

@Nonnull

public Definition value(final String value) {

this.value = requireNonNull(value, "A cookie value is required.");

return this;

}

/**

* @return Cookie's value.

*/

@Nonnull

public Optional<String> value() {

if (Strings.isNullOrEmpty(value)) {

return Optional.empty();

}

return Optional.of(value);

}

/**

* Set the cookie's domain.

*

* @param domain Cookie's domain.

* @return This definition.

*/

@Nonnull

public Definition domain(final String domain) {

this.domain = requireNonNull(domain, "A cookie domain is required.");

return this;

}

/**

* @return A cookie's domain.

*/

@Nonnull

public Optional<String> domain() {

return Optional.ofNullable(domain);

}

/**

* Set the cookie's path.

*

* @param path Cookie's path.

* @return This definition.

*/

@Nonnull

public Definition path(final String path) {

this.path = requireNonNull(path, "A cookie path is required.");

return this;

}

/**

* @return Get cookie's path.

*/

@Nonnull

public Optional<String> path() {

return Optional.ofNullable(path);

}

/**

* Set cookie's comment.

*

* @param comment A cookie's comment.

* @return This definition.

*/

@Nonnull

public Definition comment(final String comment) {

this.comment = requireNonNull(comment, "A cookie comment is required.");

return this;

}

/**

* @return Cookie's comment.

*/

@Nonnull

public Optional<String> comment() {

return Optional.ofNullable(comment);

}

/**

* Set HttpOnly flag.

*

* @param httpOnly True, for HTTP Only.

* @return This definition.

*/

@Nonnull

public Definition httpOnly(final boolean httpOnly) {

this.httpOnly = httpOnly;

return this;

}

/**

* @return HTTP only flag.

*/

@Nonnull

public Optional<Boolean> httpOnly() {

return Optional.ofNullable(httpOnly);

}

/**

* True, ensure that the session cookie is only transmitted via HTTPS.

*

* @param secure True, ensure that the session cookie is only transmitted via HTTPS.

* @return This definition.

*/

@Nonnull

public Definition secure(final boolean secure) {

this.secure = secure;

return this;

}

/**

* @return True, ensure that the session cookie is only transmitted via HTTPS.

*/

@Nonnull

public Optional<Boolean> secure() {

return Optional.ofNullable(secure);

}

/**

* Sets the maximum age in seconds for this Cookie.

*

* <p>

* A positive value indicates that the cookie will expire after that many seconds have passed.

* Note that the value is the <i>maximum</i> age when the cookie will expire, not the cookie's

* current age.

* </p>

*

* <p>

* A negative value means that the cookie is not stored persistently and will be deleted when

* the Web browser exits. A zero value causes the cookie to be deleted.

* </p>

*

* @param maxAge an integer specifying the maximum age of the cookie in seconds; if negative,

* means the cookie is not stored; if zero, deletes the cookie.

* @return This definition.

*/

@Nonnull

public Definition maxAge(final int maxAge) {

this.maxAge = maxAge;

return this;

}

/**

* Gets the maximum age in seconds for this Cookie.

*

* <p>

* A positive value indicates that the cookie will expire after that many seconds have passed.

* Note that the value is the <i>maximum</i> age when the cookie will expire, not the cookie's

* current age.

* </p>

*

* <p>

* A negative value means that the cookie is not stored persistently and will be deleted when

* the Web browser exits. A zero value causes the cookie to be deleted.

* </p>

*

* @return Cookie's max age in seconds.

*/

@Nonnull

public Optional<Integer> maxAge() {

return Optional.ofNullable(maxAge);

}

}

/**

* Sign cookies using a HMAC algorithm plus SHA-256 hash.

* Usage:

*

* <pre>

* String signed = Signature.sign("hello", "mysecretkey");

* ...

* // is it valid?

* assertEquals(signed, Signature.unsign(signed, "mysecretkey");

* </pre>

*

* @author edgar

* @since 0.1.0

*/

public class Signature {

/** Remove trailing '='. */

private static final Pattern EQ = Pattern.compile("=+$");

/** Algorithm name. */

public static final String HMAC_SHA256 = "HmacSHA256";

/** Signature separator. */

private static final String SEP = "|";

/**

* Sign a value using a secret key. A value and secret key are required. Sign is done with

* {@link #HMAC_SHA256}.

* Signed value looks like:

*

* <pre>

* [signed value] '|' [raw value]

* </pre>

*

* @param value A value to sign.

* @param secret A secret key.

* @return A signed value.

*/

@Nonnull

public static String sign(final String value, final String secret) {

requireNonNull(value, "A value is required.");

requireNonNull(secret, "A secret is required.");

try {

Mac mac = Mac.getInstance(HMAC_SHA256);

mac.init(new SecretKeySpec(secret.getBytes(), HMAC_SHA256));

byte[] bytes = mac.doFinal(value.getBytes());

return EQ.matcher(BaseEncoding.base64().encode(bytes)).replaceAll("") + SEP + value;

} catch (Exception ex) {

throw new IllegalArgumentException("Can't sing value", ex);

}

}

/**

* Un-sign a value, previously signed with {@link #sign(String, String)}.

* Try {@link #valid(String, String)} to check for valid signed values.

*

* @param value A signed value.

* @param secret A secret key.

* @return A new signed value or null.

*/

@Nullable

public static String unsign(final String value, final String secret) {

requireNonNull(value, "A value is required.");

requireNonNull(secret, "A secret is required.");

int sep = value.indexOf(SEP);

if (sep <= 0) {

return null;

}

String str = value.substring(sep + 1);

String mac = sign(str, secret);

return mac.equals(value) ? str : null;

}

/**

* True, if the given signed value is valid.

*

* @param value A signed value.

* @param secret A secret key.

* @return True, if the given signed value is valid.

*/

public static boolean valid(final String value, final String secret) {

return unsign(value, secret) != null;

}

}

/**

* @return Cookie's name.

*/

@Nonnull

String name();

/**

* @return Cookie's value.

*/

@Nonnull

Optional<String> value();

/**

* @return An optional comment.

*/

@Nonnull

Optional<String> comment();

/**

* @return Cookie's domain.

*/

@Nonnull

Optional<String> domain();

/**

* Gets the maximum age of this cookie (in seconds).

*

* <p>

* By default, <code>-1</code> is returned, which indicates that the cookie will persist until

* browser shutdown.

* </p>

*

* @return An integer specifying the maximum age of the cookie in seconds; if negative, means

* the cookie persists until browser shutdown

*/

int maxAge();

/**

* @return Cookie's path.

*/

@Nonnull

Optional<String> path();

/**

* Returns <code>true</code> if the browser is sending cookies only over a secure protocol, or

* <code>false</code> if the browser can send cookies using any protocol.

*

* @return <code>true</code> if the browser uses a secure protocol, <code>false</code> otherwise.

*/

boolean secure();

/**

* @return True if HTTP Only.

*/

boolean httpOnly();

/**

* @return Encode the cookie.

*/

@Nonnull

String encode();

}