package com.acumenvelocity.ath.security;
   
   import java.io.IOException;
   import java.util.HashSet;
   import java.util.Set;
   
   import javax.servlet.Filter;
   import javax.servlet.FilterChain;
   import javax.servlet.FilterConfig;
  import javax.servlet.ServletException;
  import javax.servlet.ServletRequest;
  import javax.servlet.ServletResponse;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  
  import com.acumenvelocity.ath.common.Const;
  import com.acumenvelocity.ath.common.Log;
  
  import net.sf.okapi.common.Util;
  
  /**
   * Servlet filter for API key authentication.
   * Validates X-API-Key header for all requests.
   */
  public class ApiKeyAuthFilter implements Filter {
  
    private static final String API_KEY_HEADER = "X-API-Key";
    private static final Set<String> VALID_API_KEYS = new HashSet<>();
  
    // Paths that don't require authentication (e.g., health checks, version)
    private static final Set<String> PUBLIC_PATHS = new HashSet<>();
  
    static {
      // Load API keys from environment or configuration
      // For production, load from secure configuration service
      if (!Util.isEmpty(Const.ATH_API_KEY)) {
        VALID_API_KEYS.add(Const.ATH_API_KEY);
      }
  
      // Configure public paths
      PUBLIC_PATHS.add("/public");
      PUBLIC_PATHS.add("/site");
      PUBLIC_PATHS.add("/api/version");
      PUBLIC_PATHS.add("/api/openapi.json");
    }
  
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }
  
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
  
      HttpServletRequest httpRequest = (HttpServletRequest) request;
      HttpServletResponse httpResponse = (HttpServletResponse) response;
  
      String path = httpRequest.getRequestURI();
  
      // Skip authentication for public paths
      if (isPublicPath(path)) {
        chain.doFilter(request, response);
        return;
      }
  
      // No auth imposed if the key is not specified on the server (e.g. in a local dev environment)
      if (Util.isEmpty(Const.ATH_API_KEY)) {
        chain.doFilter(request, response);
        return;
      }
  
      // Extract API key from header
      String apiKey = httpRequest.getHeader(API_KEY_HEADER);
  
      // Validate API key
      if (Util.isEmpty(apiKey)) {
        sendUnauthorizedResponse(httpResponse, "Missing API key");
        return;
      }
  
      if (!VALID_API_KEYS.contains(apiKey)) {
        sendUnauthorizedResponse(httpResponse, "Invalid API key");
        return;
      }
  
      // API key is valid, proceed with request
      chain.doFilter(request, response);
    }
  
    @Override
    public void destroy() {
      // Cleanup if needed
    }
  
    /**
     * Check if the path is public and doesn't require authentication.
     */
    private boolean isPublicPath(String path) {
      for (String publicPath : PUBLIC_PATHS) {
       if (path.startsWith(publicPath)) {
         return true;
       }
     }
 
     return false;
   }
 
   /**
    * Send 401 Unauthorized response.
    */
   private void sendUnauthorizedResponse(HttpServletResponse response, String message)
       throws IOException {
 
     response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
     response.setContentType("application/json");
 
     response.getWriter().write(
         Log.format("{\"code\": 401, \"message\": \"{}\"}", message));
   }
 }