package credssp

import "encoding/asn1"

const defaultCredSSPVersion = 6

// negoToken 是 CredSSP TSRequest 中的单个协商令牌 // Logan.Li
type negoToken struct {
	Data []byte `asn1:"explicit,tag:0"`
}

// tsRequest 是 MS-CSSP 2.2.1.2 TSRequest 的最小实现 // Logan.Li
type tsRequest struct {
	Version     int         `asn1:"explicit,tag:0"`
	NegoTokens  []negoToken `asn1:"optional,explicit,tag:1"`
	AuthInfo    []byte      `asn1:"optional,explicit,tag:2"`
	PubKeyAuth  []byte      `asn1:"optional,explicit,tag:3"`
	ErrorCode   int         `asn1:"optional,explicit,tag:4"`
	ClientNonce []byte      `asn1:"optional,explicit,tag:5"`
}

type tsCredentials struct {
	CredType    int    `asn1:"explicit,tag:0"`
	Credentials []byte `asn1:"explicit,tag:1"`
}

type tsPasswordCreds struct {
	DomainName []byte `asn1:"explicit,tag:0"`
	UserName   []byte `asn1:"explicit,tag:1"`
	Password   []byte `asn1:"explicit,tag:2"`
}

func encodeTSRequest(tokens [][]byte, authInfo, pubKeyAuth []byte) ([]byte, error) {
	return encodeTSRequestWithNonce(tokens, authInfo, pubKeyAuth, nil)
}

func encodeTSRequestWithNonce(tokens [][]byte, authInfo, pubKeyAuth, clientNonce []byte) ([]byte, error) {
	return encodeTSRequestVersion(defaultCredSSPVersion, tokens, authInfo, pubKeyAuth, clientNonce)
}

func encodeTSRequestVersion(version int, tokens [][]byte, authInfo, pubKeyAuth, clientNonce []byte) ([]byte, error) {
	req := tsRequest{Version: version}
	for _, token := range tokens {
		req.NegoTokens = append(req.NegoTokens, negoToken{Data: token})
	}
	if len(authInfo) > 0 {
		req.AuthInfo = authInfo
	}
	if len(pubKeyAuth) > 0 {
		req.PubKeyAuth = pubKeyAuth
	}
	if len(clientNonce) > 0 {
		req.ClientNonce = clientNonce
	}
	return asn1.Marshal(req)
}

func decodeTSRequest(data []byte) (*tsRequest, error) {
	var req tsRequest
	_, err := asn1.Unmarshal(data, &req)
	return &req, err
}

func encodePasswordCredentials(domain, user, password string) ([]byte, error) {
	pass, err := asn1.Marshal(tsPasswordCreds{
		DomainName: utf16le(domain),
		UserName:   utf16le(user),
		Password:   utf16le(password),
	})
	if err != nil {
		return nil, err
	}
	return asn1.Marshal(tsCredentials{CredType: 1, Credentials: pass})
}