/****************************************************************
    * Licensed to the Apache Software Foundation (ASF) under one   *
    * or more contributor license agreements.  See the NOTICE file *
    * distributed with this work for additional information        *
    * regarding copyright ownership.  The ASF licenses this file   *
    * to you under the Apache License, Version 2.0 (the            *
    * "License"); you may not use this file except in compliance   *
    * with the License.  You may obtain a copy of the License at   *
    *                                                              *
   *   http://www.apache.org/licenses/LICENSE-2.0                 *
   *                                                              *
   * Unless required by applicable law or agreed to in writing,   *
   * software distributed under the License is distributed on an  *
   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY       *
   * KIND, either express or implied.  See the License for the    *
   * specific language governing permissions and limitations      *
   * under the License.                                           *
   ****************************************************************/
  
  package org.apache.james.mime4j.storage;
  
  import java.io.IOException;
  import java.io.InputStream;
  import java.security.GeneralSecurityException;
  import java.security.NoSuchAlgorithmException;
  
  import javax.crypto.Cipher;
  import javax.crypto.CipherInputStream;
  import javax.crypto.CipherOutputStream;
  import javax.crypto.KeyGenerator;
  import javax.crypto.spec.SecretKeySpec;
  
  /**
   * A {@link StorageProvider} that transparently scrambles and unscrambles the
   * data stored by another <code>StorageProvider</code>.
   *
   * <p>
   * Example usage:
   *
   * <pre>
   * StorageProvider mistrusted = new TempFileStorageProvider();
   * StorageProvider enciphered = new CipherStorageProvider(mistrusted);
   * StorageProvider provider = new ThresholdStorageProvider(enciphered);
   * DefaultStorageProvider.setInstance(provider);
   * </pre>
   */
  public class CipherStorageProvider extends AbstractStorageProvider {
  
      private final StorageProvider backend;
      private final String algorithm;
      private final KeyGenerator keygen;
  
      /**
       * Creates a new <code>CipherStorageProvider</code> for the given back-end
       * using the Blowfish cipher algorithm.
       *
       * @param backend
       *            back-end storage strategy to encrypt.
       */
      public CipherStorageProvider(StorageProvider backend) {
          this(backend, "Blowfish");
      }
  
      /**
       * Creates a new <code>CipherStorageProvider</code> for the given back-end
       * and cipher algorithm.
       *
       * @param backend
       *            back-end storage strategy to encrypt.
       * @param algorithm
       *            the name of the symmetric block cipher algorithm such as
       *            "Blowfish", "AES" or "RC2".
       */
      public CipherStorageProvider(StorageProvider backend, String algorithm) {
          if (backend == null)
              throw new IllegalArgumentException();
  
          try {
              this.backend = backend;
              this.algorithm = algorithm;
              this.keygen = KeyGenerator.getInstance(algorithm);
          } catch (NoSuchAlgorithmException e) {
              throw new IllegalArgumentException(e);
          }
      }
  
      public StorageOutputStream createStorageOutputStream() throws IOException {
          SecretKeySpec skeySpec = getSecretKeySpec();
  
          return new CipherStorageOutputStream(backend
                  .createStorageOutputStream(), algorithm, skeySpec);
      }
  
      private SecretKeySpec getSecretKeySpec() {
          byte[] raw = keygen.generateKey().getEncoded();
          return new SecretKeySpec(raw, algorithm);
      }
  
      private static final class CipherStorageOutputStream extends
             StorageOutputStream {
         private final StorageOutputStream storageOut;
         private final String algorithm;
         private final SecretKeySpec skeySpec;
         private final CipherOutputStream cipherOut;
 
         public CipherStorageOutputStream(StorageOutputStream out,
                 String algorithm, SecretKeySpec skeySpec) throws IOException {
             try {
                 this.storageOut = out;
                 this.algorithm = algorithm;
                 this.skeySpec = skeySpec;
 
                 Cipher cipher = Cipher.getInstance(algorithm);
                 cipher.init(Cipher.ENCRYPT_MODE, skeySpec);
 
                 this.cipherOut = new CipherOutputStream(out, cipher);
             } catch (GeneralSecurityException e) {
                 throw (IOException) new IOException().initCause(e);
             }
         }
 
         @Override
         public void close() throws IOException {
             super.close();
             cipherOut.close();
         }
 
         @Override
         protected void write0(byte[] buffer, int offset, int length)
                 throws IOException {
             cipherOut.write(buffer, offset, length);
         }
 
         @Override
         protected Storage toStorage0() throws IOException {
             // cipherOut has already been closed because toStorage calls close
             Storage encrypted = storageOut.toStorage();
             return new CipherStorage(encrypted, algorithm, skeySpec);
         }
     }
 
     private static final class CipherStorage implements Storage {
         private Storage encrypted;
         private final String algorithm;
         private final SecretKeySpec skeySpec;
 
         public CipherStorage(Storage encrypted, String algorithm,
                 SecretKeySpec skeySpec) {
             this.encrypted = encrypted;
             this.algorithm = algorithm;
             this.skeySpec = skeySpec;
         }
 
         public void delete() {
             if (encrypted != null) {
                 encrypted.delete();
                 encrypted = null;
             }
         }
 
         public InputStream getInputStream() throws IOException {
             if (encrypted == null)
                 throw new IllegalStateException("storage has been deleted");
 
             try {
                 Cipher cipher = Cipher.getInstance(algorithm);
                 cipher.init(Cipher.DECRYPT_MODE, skeySpec);
 
                 InputStream in = encrypted.getInputStream();
                 return new CipherInputStream(in, cipher);
             } catch (GeneralSecurityException e) {
                 throw (IOException) new IOException().initCause(e);
             }
         }
     }
 
 }