// Copyright 2017 The Nomulus Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package google.registry.util;

import static com.google.common.base.Preconditions.checkNotNull;
import static com.google.common.io.BaseEncoding.base16;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectInputFilter.Config;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serializable;
import javax.annotation.Nullable;
import org.apache.commons.codec.binary.Base64;

/** Utilities for easy serialization with informative error messages. */
public final class SerializeUtils {

  /**
   * Turns an object into a byte array.
   *
   * @return serialized object or {@code null} if {@code value} is {@code null}
   */
  @Nullable
  public static byte[] serialize(@Nullable Object value) {
    if (value == null) {
      return null;
    }
    ByteArrayOutputStream objectBytes = new ByteArrayOutputStream();
    try (ObjectOutputStream oos = new ObjectOutputStream(objectBytes)) {
      oos.writeObject(value);
    } catch (IOException e) {
      throw new IllegalArgumentException("Unable to serialize: " + value, e);
    }
    return objectBytes.toByteArray();
  }

  /**
   * Turns a byte string into an object.
   *
   * @return deserialized object or {@code null} if {@code objectBytes} is {@code null}
   */
  @Nullable
  public static <T> T deserialize(Class<T> type, @Nullable byte[] objectBytes) {
    checkNotNull(type);
    if (objectBytes == null) {
      return null;
    }
    try {
      ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(objectBytes));
      // Restrict deserialization to known, trusted packages to prevent RCE gadget chain attacks.
      ois.setObjectInputFilter(
          Config.createFilter(
              "google.registry.**;com.google.common.**;java.**;javax.**;jakarta.**;"
                  + "org.hibernate.**;org.joda.**;com.googlecode.objectify.**;!*"));
      return type.cast(ois.readObject());
    } catch (ClassNotFoundException | IOException e) {
      throw new IllegalArgumentException(
          "Unable to deserialize: objectBytes=" + base16().encode(objectBytes), e);
    }
  }

  /** Serializes an object then deserializes it. This is typically used in tests. */
  public static Object serializeDeserialize(Object object) {
    return deserialize(Object.class, serialize(object));
  }

  private SerializeUtils() {}

  /** Encodes a byte array as a URL-safe string. */
  public static String encodeBase64(byte[] bytes) {
    return Base64.encodeBase64URLSafeString(bytes);
  }

  /** Turns a string encoded by {@link #encodeBase64} back into a byte array. */
  public static byte[] decodeBase64(String objectString) {
    return Base64.decodeBase64(objectString);
  }

  /** Turns an object into an encoded string that can be used safely as a URI query parameter. */
  public static String stringify(Serializable object) {
    checkNotNull(object, "Object cannot be null");
    return encodeBase64(SerializeUtils.serialize(object));
  }

  /** Turns a string encoded by stringify() into an object. */
  @Nullable
  public static <T> T parse(Class<T> type, String objectString) {
    checkNotNull(type, "Class type is not specified");
    checkNotNull(objectString, "Object string cannot be null");

    return SerializeUtils.deserialize(type, decodeBase64(objectString));
  }
}
