validator.go

package main

import (
	"context"
	"crypto/sha256"
	"crypto/tls"
	"encoding/hex"
	"fmt"
	"io"
	"net"
	"net/http"
	"strings"
	"sync"
	"time"

	"golang.org/x/time/rate"
)

type LogLevel int

const (
	LogLevelError LogLevel = iota
	LogLevelInfo
	LogLevelDebug
)

type RequestMultiplexer struct {
	done      chan struct{}
	err       error
	isRunning bool
	timestamp time.Time
}

type TokenValidator struct {
	cache                *Cache
	upstreamURL          string
	timeout              time.Duration
	httpClient           *http.Client
	logLevel             LogLevel
	globalLimiter        *rate.Limiter
	ipLimiters           map[string]*rate.Limiter
	ipLimiterMutex       sync.RWMutex
	perIPRateLimit       int
	rateLimitWindow      time.Duration
	cleanupInterval      time.Duration
	lastCleanup          time.Time
	inFlightRequests     map[string]*RequestMultiplexer
	inFlightRequestMutex sync.RWMutex
}

func NewTokenValidator(config *Config) *TokenValidator {
	timeout := config.Timeout
	if timeout <= 0 {
		timeout = 5 * time.Second
	}

	transport := &http.Transport{
		DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
			dialer := &net.Dialer{
				Timeout:   timeout / 3,
				KeepAlive: 30 * time.Second,
			}
			return dialer.DialContext(ctx, network, addr)
		},
		MaxIdleConns:          100,
		IdleConnTimeout:       90 * time.Second,
		TLSHandshakeTimeout:   timeout / 3,
		ExpectContinueTimeout: 1 * time.Second,
		ResponseHeaderTimeout: timeout / 2,
		MaxIdleConnsPerHost:   10,
		DisableCompression:    false,
	}

	if config.TLSSkipVerify {
		transport.TLSClientConfig = &tls.Config{
			InsecureSkipVerify: true,
		}
	}

	httpClient := &http.Client{
		Transport: transport,
		Timeout:   timeout,
	}

	cache := NewCache(config.CacheFreshness, 8*time.Hour)

	var globalLimiter *rate.Limiter
	if config.GlobalRateLimit > 0 && config.RateLimitWindow > 0 {
		ratePerSec := float64(config.GlobalRateLimit) / config.RateLimitWindow.Seconds()
		globalLimiter = rate.NewLimiter(rate.Limit(ratePerSec), config.GlobalRateLimit)
	}

	cleanupInterval := config.CleanupInterval
	if cleanupInterval <= 0 {
		cleanupInterval = 5 * time.Minute
	}

	return &TokenValidator{
		cache:            cache,
		upstreamURL:      config.UpstreamURL,
		timeout:          timeout,
		httpClient:       httpClient,
		logLevel:         parseLogLevel(config.LogLevel),
		globalLimiter:    globalLimiter,
		ipLimiters:       make(map[string]*rate.Limiter),
		perIPRateLimit:   config.PerIPRateLimit,
		rateLimitWindow:  config.RateLimitWindow,
		inFlightRequests: make(map[string]*RequestMultiplexer),
		cleanupInterval:  cleanupInterval,
		lastCleanup:      time.Now(),
	}
}

func parseLogLevel(level string) LogLevel {
	switch strings.ToLower(level) {
	case "debug":
		return LogLevelDebug
	case "error":
		return LogLevelError
	default:
		return LogLevelInfo
	}
}

func (tv *TokenValidator) log(level LogLevel, format string, args ...interface{}) {
	if level <= tv.logLevel {
		var levelStr string
		switch level {
		case LogLevelError:
			levelStr = "ERROR"
		case LogLevelInfo:
			levelStr = "INFO"
		case LogLevelDebug:
			levelStr = "DEBUG"
		}
		fmt.Printf("[%s] %s\n", levelStr, fmt.Sprintf(format, args...))
	}
}

func (tv *TokenValidator) ValidateToken(token string) error {
	if len(token) != 16 {
		return fmt.Errorf("incorrect token length")
	}

	if tv.cache.Has(token) {
		tv.log(LogLevelDebug, "Token '%s' found in cache", token)
		return nil
	}

	tv.inFlightRequestMutex.RLock()
	multiplexer, exists := tv.inFlightRequests[token]
	isRunning := exists && multiplexer.isRunning
	tv.inFlightRequestMutex.RUnlock()

	if isRunning {
		tv.log(LogLevelDebug, "Request for token '%s' already in progress, waiting", token)
		<-multiplexer.done
		return multiplexer.err
	}

	tv.inFlightRequestMutex.Lock()
	multiplexer, exists = tv.inFlightRequests[token]
	if !exists {
		multiplexer = &RequestMultiplexer{
			done:      make(chan struct{}),
			isRunning: true,
			timestamp: time.Now(),
		}
		tv.inFlightRequests[token] = multiplexer
	} else if !multiplexer.isRunning {
		multiplexer.done = make(chan struct{})
		multiplexer.isRunning = true
		multiplexer.timestamp = time.Now()
	}
	tv.inFlightRequestMutex.Unlock()

	fullURL := tv.upstreamURL + token
	ctx, cancel := context.WithTimeout(context.Background(), tv.timeout)
	defer cancel()

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil)
	if err != nil {
		err = fmt.Errorf("error creating request: %w", err)
		tv.log(LogLevelError, err.Error())
		tv.completeRequest(token, err)
		return err
	}

	req.Header.Set("User-Agent", "ETIS-AuthProvider/1.0")
	req.Header.Set("Accept", "text/calendar")

	response, err := tv.httpClient.Do(req)
	if err != nil {
		// Check if it's a network/timeout error
		if isNetworkError(err) {
			err = fmt.Errorf("upstream service unavailable: %w", err)
			tv.log(LogLevelError, "Upstream ICAL service is unavailable: %v", err)
		} else {
			err = fmt.Errorf("error making request: %w", err)
			tv.log(LogLevelError, err.Error())
		}
		tv.completeRequest(token, err)
		return err
	}
	defer response.Body.Close()

	// Check HTTP status code
	if response.StatusCode >= 500 {
		err = fmt.Errorf("upstream service unavailable (HTTP %d)", response.StatusCode)
		tv.log(LogLevelError, "Upstream ICAL service returned error: HTTP %d", response.StatusCode)
		tv.completeRequest(token, err)
		return err
	}

	if response.StatusCode == 404 || response.StatusCode == 401 {
		err = fmt.Errorf("invalid token")
		tv.log(LogLevelDebug, "Invalid token (HTTP %d): %s", response.StatusCode, token)
		tv.completeRequest(token, err)
		return err
	}

	if response.StatusCode != 200 {
		err = fmt.Errorf("unexpected response from upstream (HTTP %d)", response.StatusCode)
		tv.log(LogLevelError, "Unexpected HTTP status: %d", response.StatusCode)
		tv.completeRequest(token, err)
		return err
	}

	body := make([]byte, 20)
	_, err = io.ReadAtLeast(response.Body, body, 20)
	if err != nil {
		err = fmt.Errorf("error reading response: %w", err)
		tv.log(LogLevelError, err.Error())
		tv.completeRequest(token, err)
		return err
	}

	result := string(body)
	if strings.HasPrefix(result, "BEGIN") {
		tv.cache.Set(token, true, 0)
		tv.log(LogLevelDebug, "Valid token: %s", token)
		tv.completeRequest(token, nil)
		return nil
	}

	err = fmt.Errorf("invalid token")
	tv.log(LogLevelDebug, "Invalid token: %s", token)
	tv.completeRequest(token, err)
	return err
}

func (tv *TokenValidator) completeRequest(token string, err error) {
	tv.inFlightRequestMutex.Lock()
	defer tv.inFlightRequestMutex.Unlock()

	if multiplexer, exists := tv.inFlightRequests[token]; exists {
		multiplexer.err = err
		multiplexer.isRunning = false
		close(multiplexer.done)

		if err == nil {
			delete(tv.inFlightRequests, token)
		} else {
			go func() {
				time.Sleep(30 * time.Second)
				tv.inFlightRequestMutex.Lock()
				defer tv.inFlightRequestMutex.Unlock()

				if m, exists := tv.inFlightRequests[token]; exists && m == multiplexer && !m.isRunning {
					delete(tv.inFlightRequests, token)
				}
			}()
		}
	}
}

func (tv *TokenValidator) CheckRateLimit(userIP string) error {
	if tv.globalLimiter != nil && !tv.globalLimiter.Allow() {
		tv.log(LogLevelError, "Global rate limit exceeded")
		return fmt.Errorf("global rate limit exceeded")
	}

	if tv.perIPRateLimit > 0 && tv.rateLimitWindow > 0 {
		tv.ipLimiterMutex.RLock()
		limiter, exists := tv.ipLimiters[userIP]
		tv.ipLimiterMutex.RUnlock()

		if !exists {
			tv.ipLimiterMutex.Lock()
			limiter, exists = tv.ipLimiters[userIP]
			if !exists {
				ratePerSec := float64(tv.perIPRateLimit) / tv.rateLimitWindow.Seconds()
				limiter = rate.NewLimiter(rate.Limit(ratePerSec), tv.perIPRateLimit)
				tv.ipLimiters[userIP] = limiter
			}
			tv.ipLimiterMutex.Unlock()
		}

		if !limiter.Allow() {
			tv.log(LogLevelError, "Rate limit exceeded for IP: %s", userIP)
			return fmt.Errorf("rate limit exceeded")
		}
	}

	return nil
}

func (tv *TokenValidator) CleanupStaleRequests() {
	now := time.Now()

	if now.Sub(tv.lastCleanup) < tv.cleanupInterval {
		return
	}
	tv.lastCleanup = now

	tv.inFlightRequestMutex.Lock()
	for token, multiplexer := range tv.inFlightRequests {
		if !multiplexer.isRunning && now.Sub(multiplexer.timestamp) > 5*time.Minute {
			delete(tv.inFlightRequests, token)
		}
	}
	tv.inFlightRequestMutex.Unlock()

	tv.ipLimiterMutex.Lock()
	if len(tv.ipLimiters) > 1000 {
		count := 0
		for ip := range tv.ipLimiters {
			delete(tv.ipLimiters, ip)
			count++
			if count >= 100 {
				break
			}
		}
	}
	tv.ipLimiterMutex.Unlock()
}

func HashToken(token string) string {
	hash := sha256.Sum256([]byte(token))
	return hex.EncodeToString(hash[:])
}

// isNetworkError checks if error is related to network connectivity
func isNetworkError(err error) bool {
	if err == nil {
		return false
	}
	
	// Check for timeout
	if netErr, ok := err.(net.Error); ok && netErr.Timeout() {
		return true
	}
	
	// Check for DNS errors
	if _, ok := err.(*net.DNSError); ok {
		return true
	}
	
	// Check for connection refused
	if _, ok := err.(*net.OpError); ok {
		return true
	}
	
	// Check for context deadline exceeded
	if err == context.DeadlineExceeded {
		return true
	}
	
	errMsg := err.Error()
	return strings.Contains(errMsg, "connection refused") ||
		strings.Contains(errMsg, "no such host") ||
		strings.Contains(errMsg, "network is unreachable") ||
		strings.Contains(errMsg, "timeout") ||
		strings.Contains(errMsg, "connection reset")
}