package Bugzilla::DuoAPI;
use strict;
use warnings;

our $VERSION = '1.0';

=head1 NAME

Duo::API - Reference client to call Duo Security's API methods.

=head1 SYNOPSIS

 use Duo::API;
 my $client = Duo::API->new('INTEGRATION KEY', 'SECRET KEY', 'HOSTNAME');
 my $res = $client->json_api_call('GET', '/auth/v2/check', {});

=head1 SEE ALSO

Duo for Developers: L<https://www.duosecurity.com/api>

=head1 COPYRIGHT

Copyright (c) 2013 Duo Security

This program is free software; you can redistribute it and/or modify
it under the same terms as Perl itself.

=head1 DESCRIPTION

Duo::API objects have the following methods:

=over 4

=item new($integration_key, $integration_secret_key, $api_hostname)

Returns a handle to sign and send requests. These parameters are
obtained when creating an API integration.

=item json_api_call($method, $path, \%params)

Make a request to an API endpoint with the given HTTPS method and
parameters. Returns the parsed result if successful or dies with the
error message from the Duo Security service.

=item api_call($method, $path, \%params)

Make a request without parsing the response.

=item canonicalize_params(\%params)

Serialize a parameter hash reference to a string to sign or send.

=item sign($method, $path, $canon_params, $date)

Return the Authorization header for a request. C<$canon_params> is the
string returned by L<canonicalize_params>.

=back

=cut

use CGI qw();
use Carp qw(croak);
use Digest::HMAC_SHA1 qw(hmac_sha1_hex);
use JSON qw(decode_json);
use LWP::UserAgent;
use MIME::Base64 qw(encode_base64);
use POSIX qw(strftime);

sub new {
  my ($proto, $ikey, $skey, $host) = @_;
  my $class = ref($proto) || $proto;
  my $self = {'ikey' => $ikey, 'skey' => $skey, 'host' => $host,};
  bless($self, $class);
  return $self;
}

sub canonicalize_params {
  my ($self, $params) = @_;

  my @ret;
  while (my ($k, $v) = each(%{$params})) {
    push(@ret, join('=', CGI::escape($k), CGI::escape($v)));
  }
  return join('&', sort(@ret));
}

sub sign {
  my ($self, $method, $path, $canon_params, $date) = @_;
  my $canon
    = join("\n", $date, uc($method), lc($self->{'host'}), $path, $canon_params);
  my $sig = hmac_sha1_hex($canon, $self->{'skey'});
  my $auth = join(':', $self->{'ikey'}, $sig);
  $auth = 'Basic ' . encode_base64($auth, '');
  return $auth;
}

sub api_call {
  my ($self, $method, $path, $params) = @_;
  $params ||= {};

  my $canon_params = $self->canonicalize_params($params);
  my $date         = strftime('%a, %d %b %Y %H:%M:%S -0000', gmtime(time()));
  my $auth         = $self->sign($method, $path, $canon_params, $date);

  my $ua  = LWP::UserAgent->new();
  my $req = HTTP::Request->new();
  $req->method($method);
  $req->protocol('HTTP/1.1');
  $req->header('If-SSL-Cert-Subject' => qr{CN=[^=]+\.duosecurity.com$});
  $req->header('Authorization'       => $auth);
  $req->header('Date'                => $date);
  $req->header('Host'                => $self->{'host'});

  if (grep(/^$method$/, qw(POST PUT))) {
    $req->header('Content-type' => 'application/x-www-form-urlencoded');
    $req->content($canon_params);
  }
  else {
    $path .= '?' . $canon_params;
  }

  $req->uri('https://' . $self->{'host'} . $path);
  if ($ENV{'DEBUG'}) {
    print STDERR $req->as_string();
  }
  my $res = $ua->request($req);
  return $res;
}

sub json_api_call {
  my $self = shift;
  my $res  = $self->api_call(@_);
  my $json = $res->content();
  if ($json !~ /^{/) {
    croak($json);
  }
  my $ret = decode_json($json);
  if (($ret->{'stat'} || '') ne 'OK') {
    my $msg = join('', 'Error ', $ret->{'code'}, ': ', $ret->{'message'});
    if (defined($ret->{'message_detail'})) {
      $msg .= ' (' . $ret->{'message_detail'} . ')';
    }
    croak($msg);
  }
  return $ret->{'response'};
}

1;