// Copyright 2018 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "chrome/browser/signin/signin_util_win.h"

#include <memory>
#include <string>
#include <utility>

#include "base/bind.h"
#include "base/bind_helpers.h"
#include "base/no_destructor.h"
#include "base/strings/utf_string_conversions.h"
#include "base/win/registry.h"
#include "base/win/win_util.h"
#include "base/win/wincrypt_shim.h"
#include "chrome/browser/browser_process.h"
#include "chrome/browser/first_run/first_run.h"
#include "chrome/browser/profiles/profile.h"
#include "chrome/browser/profiles/profile_manager.h"
#include "chrome/browser/profiles/profile_window.h"
#include "chrome/browser/signin/about_signin_internals_factory.h"
#include "chrome/browser/signin/identity_manager_factory.h"
#include "chrome/browser/ui/browser_finder.h"
#include "chrome/browser/ui/browser_list.h"
#include "chrome/browser/ui/webui/signin/dice_turn_sync_on_helper.h"
#include "chrome/credential_provider/common/gcp_strings.h"
#include "components/prefs/pref_service.h"
#include "components/signin/core/browser/about_signin_internals.h"
#include "components/signin/public/base/signin_metrics.h"
#include "components/signin/public/base/signin_pref_names.h"
#include "components/signin/public/identity_manager/accounts_mutator.h"
#include "components/signin/public/identity_manager/identity_manager.h"

namespace signin_util {

namespace {

std::unique_ptr<DiceTurnSyncOnHelper::Delegate>*
GetDiceTurnSyncOnHelperDelegateForTestingStorage() {
  static base::NoDestructor<std::unique_ptr<DiceTurnSyncOnHelper::Delegate>>
      delegate;
  return delegate.get();
}

std::string DecryptRefreshToken(const std::string& cipher_text) {
  DATA_BLOB input;
  input.pbData =
      const_cast<BYTE*>(reinterpret_cast<const BYTE*>(cipher_text.data()));
  input.cbData = static_cast<DWORD>(cipher_text.length());
  DATA_BLOB output;
  BOOL result = ::CryptUnprotectData(&input, nullptr, nullptr, nullptr, nullptr,
                                     CRYPTPROTECT_UI_FORBIDDEN, &output);

  if (!result)
    return std::string();

  std::string refresh_token(reinterpret_cast<char*>(output.pbData),
                            output.cbData);
  ::LocalFree(output.pbData);
  return refresh_token;
}

// Finish the process of import credentials.  This is either called directly
// from ImportCredentialsFromProvider() if a browser window for the profile is
// already available or is delayed until a browser can first be opened.
void FinishImportCredentialsFromProvider(const CoreAccountId& account_id,
                                         Browser* browser,
                                         Profile* profile,
                                         Profile::CreateStatus status) {
  // DiceTurnSyncOnHelper deletes itself once done.
  if (GetDiceTurnSyncOnHelperDelegateForTestingStorage()->get()) {
    new DiceTurnSyncOnHelper(
        profile, signin_metrics::AccessPoint::ACCESS_POINT_MACHINE_LOGON,
        signin_metrics::PromoAction::PROMO_ACTION_WITH_DEFAULT,
        signin_metrics::Reason::REASON_SIGNIN_PRIMARY_ACCOUNT, account_id,
        DiceTurnSyncOnHelper::SigninAbortedMode::KEEP_ACCOUNT,
        std::move(*GetDiceTurnSyncOnHelperDelegateForTestingStorage()),
        base::DoNothing());
  } else {
    if (!browser)
      browser = chrome::FindLastActiveWithProfile(profile);

    new DiceTurnSyncOnHelper(
        profile, browser,
        signin_metrics::AccessPoint::ACCESS_POINT_MACHINE_LOGON,
        signin_metrics::PromoAction::PROMO_ACTION_WITH_DEFAULT,
        signin_metrics::Reason::REASON_SIGNIN_PRIMARY_ACCOUNT, account_id,
        DiceTurnSyncOnHelper::SigninAbortedMode::KEEP_ACCOUNT);
  }

  // Mark this profile as having been signed in with the credential provider.
  profile->GetPrefs()->SetBoolean(prefs::kSignedInWithCredentialProvider, true);
}

// Start the process of importing credentials from the credential provider given
// that all the required information is available.  The process depends on
// having a browser window for the profile.  If a browser window exists the
// profile be signed in and sync will be starting up.  If not, the profile will
// be still be signed in but sync will be started once the browser window is
// ready.
void ImportCredentialsFromProvider(Profile* profile,
                                   const base::string16& gaia_id,
                                   const base::string16& email,
                                   const std::string& refresh_token,
                                   bool turn_on_sync) {
  // For debugging purposes, record that the credentials for this profile
  // came from a credential provider.
  AboutSigninInternals* signin_internals =
      AboutSigninInternalsFactory::GetInstance()->GetForProfile(profile);
  signin_internals->OnAuthenticationResultReceived("Credential Provider");

  CoreAccountId account_id =
      IdentityManagerFactory::GetForProfile(profile)
          ->GetAccountsMutator()
          ->AddOrUpdateAccount(base::UTF16ToUTF8(gaia_id),
                               base::UTF16ToUTF8(email), refresh_token,
                               /*is_under_advanced_protection=*/false,
                               signin_metrics::SourceForRefreshTokenOperation::
                                   kMachineLogon_CredentialProvider);

  if (turn_on_sync) {
    Browser* browser = chrome::FindLastActiveWithProfile(profile);
    if (browser) {
      FinishImportCredentialsFromProvider(account_id, browser, profile,
                                          Profile::CREATE_STATUS_CREATED);
    } else {
      // If no active browser exists yet, this profile is in the process of
      // being created.  Wait for the browser to be created before finishing the
      // sign in.  This object deletes itself when done.
      new profiles::BrowserAddedForProfileObserver(
          profile, base::BindRepeating(&FinishImportCredentialsFromProvider,
                                       account_id, nullptr));
    }
  }
}

// Attempt to sign in with a credentials from a system installed credential
// provider if available.  If |auth_gaia_id| is not empty then the system
// credential must be for the same account.  Starts the process to turn on DICE
// only if |turn_on_sync| is true.
bool TrySigninWithCredentialProvider(Profile* profile,
                                     const base::string16& auth_gaia_id,
                                     bool turn_on_sync) {
  base::win::RegKey key;
  if (key.Open(HKEY_CURRENT_USER, credential_provider::kRegHkcuAccountsPath,
               KEY_READ) != ERROR_SUCCESS) {
    return false;
  }

  base::win::RegistryKeyIterator it(key.Handle(), L"");
  if (!it.Valid() || it.SubkeyCount() == 0)
    return false;

  base::win::RegKey key_account(key.Handle(), it.Name(), KEY_READ | KEY_WRITE);
  if (!key_account.Valid())
    return false;

  base::string16 gaia_id = it.Name();
  if (!auth_gaia_id.empty() && auth_gaia_id != gaia_id)
    return false;

  base::string16 email;
  if (key_account.ReadValue(
          base::UTF8ToUTF16(credential_provider::kKeyEmail).c_str(), &email) !=
      ERROR_SUCCESS) {
    return false;
  }

  // Read the encrypted refresh token.  The data is stored in binary format.
  // No matter what happens, delete the registry entry.

  std::string encrypted_refresh_token;
  DWORD size = 0;
  DWORD type;
  if (key_account.ReadValue(
          base::UTF8ToUTF16(credential_provider::kKeyRefreshToken).c_str(),
          nullptr, &size, &type) != ERROR_SUCCESS) {
    return false;
  }

  encrypted_refresh_token.resize(size);
  bool reauth_attempted = false;
  key_account.ReadValue(
      base::UTF8ToUTF16(credential_provider::kKeyRefreshToken).c_str(),
      const_cast<char*>(encrypted_refresh_token.c_str()), &size, &type);
  if (!gaia_id.empty() && !email.empty() && type == REG_BINARY &&
      !encrypted_refresh_token.empty()) {
    std::string refresh_token = DecryptRefreshToken(encrypted_refresh_token);
    if (!refresh_token.empty()) {
      reauth_attempted = true;
      ImportCredentialsFromProvider(profile, gaia_id, email, refresh_token,
                                    turn_on_sync);
    }
  }

  key_account.DeleteValue(
      base::UTF8ToUTF16(credential_provider::kKeyRefreshToken).c_str());
  return reauth_attempted;
}

}  // namespace

void SetDiceTurnSyncOnHelperDelegateForTesting(
    std::unique_ptr<DiceTurnSyncOnHelper::Delegate> delegate) {
  GetDiceTurnSyncOnHelperDelegateForTestingStorage()->swap(delegate);
}

void SigninWithCredentialProviderIfPossible(Profile* profile) {
  // Check to see if auto signin information is available.  Only applies if:
  //
  //  - This is first run.
  //  - Opening the initial profile.
  //  - Not already signed in.
  if (!(first_run::IsChromeFirstRun() &&
        g_browser_process->profile_manager()->GetInitialProfileDir() ==
            profile->GetPath().BaseName() &&
        !IdentityManagerFactory::GetForProfile(profile)->HasPrimaryAccount())) {
    return;
  }

  TrySigninWithCredentialProvider(profile, base::string16(), true);
}

bool ReauthWithCredentialProviderIfPossible(Profile* profile) {
  // Check to see if auto signin information is available.  Only applies if:
  //
  //  - The profile is marked as having been signed in with a system credential.
  //  - The profile is already signed in.
  //  - The profile is in an auth error state.
  auto* identity_manager = IdentityManagerFactory::GetForProfile(profile);
  if (!(profile->GetPrefs()->GetBoolean(
            prefs::kSignedInWithCredentialProvider) &&
        identity_manager->HasPrimaryAccount() &&
        identity_manager->HasAccountWithRefreshTokenInPersistentErrorState(
            identity_manager->GetPrimaryAccountId()))) {
    return false;
  }

  base::string16 gaia_id =
      base::UTF8ToUTF16(identity_manager->GetPrimaryAccountInfo().gaia.c_str());
  return TrySigninWithCredentialProvider(profile, gaia_id, false);
}

}  // namespace signin_util