//

 //  MYDecoder.m

 //  Cloudy

 //

 //  Created by Jens Alfke on 1/16/08.

 //  Copyright 2008 Jens Alfke. All rights reserved.

 //

 #import "MYDecoder.h"

 #import "MYCrypto_Private.h"

 #import "Test.h"

 #import "MYErrorUtils.h"

 @interface MYSigner ()

 - (id) initWithDecoder: (CMSDecoderRef)decoder index: (size_t)index policy: (CFTypeRef)policy;

 @end

 @implementation MYDecoder

 - (id) initWithData: (NSData*)data error: (NSError**)outError

 {

     self = [self init];

     if( self ) {

         [self addData: data];

         [self finish];

         *outError = self.error;

         if( *outError ) {

             [self release];

             return nil;

         }

     }

     return self;

 }

 - (id) init

 {

     self = [super init];

     if (self != nil) {

         OSStatus err = CMSDecoderCreate(&_decoder);

         if( err ) {

             [self release];

             self = nil;

         }

     }

     return self;

 }

 - (void) dealloc

 {

     if( _decoder ) CFRelease(_decoder);

     if (_policy) CFRelease(_policy);

     [super dealloc];

 }

 - (BOOL) addData: (NSData*)data

 {

     Assert(data);

     return !_error && checksave( CMSDecoderUpdateMessage(_decoder, data.bytes, data.length) );

 }

 - (BOOL) finish

 {

     return !_error && checksave( CMSDecoderFinalizeMessage(_decoder) );

 }

 - (NSError*) error

 {

     if( _error )

         return MYError(_error, NSOSStatusErrorDomain, 

                        @"%@", MYErrorName(NSOSStatusErrorDomain,_error));

     else

         return nil;

 }

 - (BOOL) useKeychain: (MYKeychain*)keychain

 {

     return !_error && checksave( CMSDecoderSetSearchKeychain(_decoder, keychain.keychainRef) );

 }

 @synthesize policy=_policy;

 - (NSData*) _dataFromFunction: (OSStatus (*)(CMSDecoderRef,CFDataRef*))function

 {

     CFDataRef data=NULL;

     if( checksave( (*function)(_decoder, &data) ) )

        return [(NSData*)CFMakeCollectable(data) autorelease];

     else

         return nil;

 }

 - (NSData*) detachedContent

 {

     return [self _dataFromFunction: &CMSDecoderCopyDetachedContent];

 }

 - (void) setDetachedContent: (NSData*)detachedContent

 {

     if( ! _error )

         checksave( CMSDecoderSetDetachedContent(_decoder, (CFDataRef)detachedContent) );

 }

 - (CSSM_OID) contentType

 {

     NSData *data = [self _dataFromFunction: &CMSDecoderCopyEncapsulatedContentType];

     return (CSSM_OID){data.length,(uint8*)data.bytes};      // safe since data is autoreleased

 }

 - (NSData*) content

 {

     return [self _dataFromFunction: &CMSDecoderCopyContent];

 }

 - (BOOL) isSigned

 {

     size_t n;

     return checksave( CMSDecoderGetNumSigners(_decoder, &n) ) && n > 0;

 }

 - (BOOL) isEncrypted

 {

     Boolean isEncrypted;

     return check(CMSDecoderIsContentEncrypted(_decoder,&isEncrypted), @"CMSDecoderIsContentEncrypted")

         && isEncrypted;

 }

 - (NSArray*) signers

 {

     size_t n;

     if( ! checksave( CMSDecoderGetNumSigners(_decoder, &n) ) )

         return nil;

     NSMutableArray *signers = [NSMutableArray arrayWithCapacity: n];

     for( size_t i=0; i<n; i++ ) {

         MYSigner *signer = [[MYSigner alloc] initWithDecoder: _decoder

                                                        index: i

                                                       policy: _policy];

         [signers addObject: signer];

         [signer release];

     }

     return signers;

 }

 - (NSArray*) certificates

 {

     CFArrayRef certRefs = NULL;

     if( ! checksave( CMSDecoderCopyAllCerts(_decoder, &certRefs) ) || ! certRefs )

         return nil;

     unsigned n = CFArrayGetCount(certRefs);

     NSMutableArray *certs = [NSMutableArray arrayWithCapacity: n];

     for( unsigned i=0; i<n; i++ ) {

         SecCertificateRef certRef = (SecCertificateRef) CFArrayGetValueAtIndex(certRefs, i);

         [certs addObject: [MYCertificate certificateWithCertificateRef: certRef]];

     }

     CFRelease(certRefs);

     return certs;

 }

 - (NSString*) dump

 {

     static const char * kStatusNames[kCMSSignerInvalidIndex+1] = {

         "kCMSSignerUnsigned", "kCMSSignerValid", "kCMSSignerNeedsDetachedContent",	

         "kCMSSignerInvalidSignature","kCMSSignerInvalidCert","kCMSSignerInvalidIndex"};			

     CSSM_OID contentType = self.contentType;

     NSMutableString *s = [NSMutableString stringWithFormat:  @"%@<%p>:\n"

                                                               "\tcontentType = %@ (\"%@\")\n"

                                                               "\tcontent = %u bytes\n"

                                                               "\tsigned=%i, encrypted=%i\n"

                                                               "\tpolicy=%@\n"

                                                               "\t%u certificates\n"

                                                               "\tsigners =\n",

                               self.class, self,

                               OIDAsString(contentType), @"??"/*nameOfOID(&contentType)*/,

                               self.content.length,

                               self.isSigned,self.isEncrypted,

                               MYPolicyGetName(_policy),

                               self.certificates.count];

     for( MYSigner *signer in self.signers ) {

         CMSSignerStatus status = signer.status;

         const char *statusName = (status<=kCMSSignerInvalidIndex) ?kStatusNames[status] :"??";

         [s appendFormat:@"\t\t- status = %s\n"

                          "\t\t  verifyResult = %@\n"

                          "\t\t  trust = %@\n"

                          "\t\t  cert = %@\n",

                  statusName,

                  (signer.verifyResult ?MYErrorName(NSOSStatusErrorDomain,signer.verifyResult)

                                       :@"OK"),

                  MYTrustDescribe(signer.trust),

                  signer.certificate];

     }

     return s;

 }

 @end

 #pragma mark -

 @implementation MYSigner : NSObject

 #define kUncheckedStatus ((CMSSignerStatus)-1)

 - (id) initWithDecoder: (CMSDecoderRef)decoder index: (size_t)index policy: (CFTypeRef)policy

 {

     self = [super init];

     if( self ) {

         CFRetain(decoder);

         _decoder = decoder;

         _index = index;

         if(policy) _policy = CFRetain(policy);

         _status = kUncheckedStatus;

     }

     return self;

 }

 - (void) dealloc

 {

     if(_decoder) CFRelease(_decoder);

     if(_policy) CFRelease(_policy);

     if(_trust) CFRelease(_trust);

     [super dealloc];

 }

 - (void) _getInfo {

     if (_status == kUncheckedStatus) {

         if( !check(CMSDecoderCopySignerStatus(_decoder, _index, _policy, (_policy!=nil),

                                               &_status, &_trust, &_verifyResult), 

                    @"CMSDecoderCopySignerStatus"))

             _status = kMYSignerStatusCheckFailed;

     }

 }

 - (CMSSignerStatus) status

 {

     [self _getInfo];

     return _status;

 }

 - (OSStatus) verifyResult

 {

     [self _getInfo];

     return _verifyResult;

 }

 - (SecTrustRef) trust

 {

     [self _getInfo];

     return _trust;

 }

 - (NSString*) emailAddress

 {

     // Don't let caller see the addr if they haven't checked validity & the signature's invalid:

     if (_status==kUncheckedStatus && self.status != kCMSSignerValid)

         return nil;

     CFStringRef email=NULL;

     if( CMSDecoderCopySignerEmailAddress(_decoder, _index, &email) == noErr )

         return [(NSString*)CFMakeCollectable(email) autorelease];

     return nil;

 }

 - (MYCertificate *) certificate

 {

     // Don't let caller see the cert if they haven't checked validity & the signature's invalid:

     if (_status==kUncheckedStatus && self.status != kCMSSignerValid)

         return nil;

     SecCertificateRef certRef=NULL;

     OSStatus err = CMSDecoderCopySignerCert(_decoder, _index, &certRef);

     if( err == noErr )

         return [MYCertificate certificateWithCertificateRef: certRef];

     else {

         Warn(@"CMSDecoderCopySignerCert returned err %i",err);

         return nil;

     }

 }

 - (NSString*) description

 {

     NSMutableString *desc = [NSMutableString stringWithFormat: @"%@[st=%i", self.class,(int)self.status];

     int verify = self.verifyResult;

     if( verify )

         [desc appendFormat: @"; verify error %i",verify];

     else {

         MYCertificate *cert = self.certificate;

         if( cert )

             [desc appendFormat: @"; %@",cert.commonName];

     }

     [desc appendString: @"]"];

     return desc;

 }

 @end

 // Taken from Keychain.framework

 NSString* OIDAsString(const CSSM_OID oid) {

     if ((NULL == oid.Data) || (0 >= oid.Length)) {

         return nil;

     } else {

         NSMutableString *result = [NSMutableString stringWithCapacity:(4 * oid.Length)];

         unsigned int i;

         for (i = 0; i < oid.Length; ++i) {

             [result appendFormat:@"%s%hhu", ((0 == i) ? "" : ", "), oid.Data[i]];

         }

         return result;

     }

 }

 #pragma mark -

 #pragma mark TEST CASE:

 #if DEBUG

 #import "MYEncoder.h"

 #import "MYIdentity.h"

 static void TestRoundTrip( NSString *title, NSData *source, MYIdentity *signer, MYCertificate *recipient )

 {

     Log(@"Testing MYEncoder/Decoder %@...",title);

     NSError *error;

     NSData *encoded = [MYEncoder encodeData: source signer: signer recipient: recipient error: &error];

     CAssertEq(error,nil);

     CAssert([encoded length]);

     Log(@"MYEncoder encoded %u bytes into %u bytes", source.length,encoded.length);

     Log(@"Decoding...");

     MYDecoder *d = [[MYDecoder alloc] init];

     d.policy = [MYCertificate X509Policy];

     [d addData: encoded];

     [d finish];

     CAssertEq(d.error,nil);

     Log(@"%@", d.dump);

     CAssert(d.content);

     CAssert([d.content isEqual: source]);

     CAssertEq(d.detachedContent,nil);

     CAssertEq(d.isSigned,(signer!=nil));

     CAssertEq(d.isEncrypted,(recipient!=nil));

     if( signer ) {

         CAssert(d.certificates.count >= 1);     // may include extra parent certs

         CAssertEq(d.signers.count,1U);

         MYSigner *outSigner = [d.signers objectAtIndex: 0];

         CAssertEq(outSigner.status,(CMSSignerStatus)kCMSSignerValid);

         CAssertEq(outSigner.verifyResult,noErr);

         CAssert([outSigner.certificate isEqualToCertificate: signer]);

     } else {

         CAssertEq(d.certificates.count, 0U);

         CAssertEq(d.signers.count,0U);

     }

 }

 TestCase(MYDecoder) {

     RequireTestCase(MYEncoder);

     MYIdentity *me = [MYIdentity preferredIdentityForName: @"MYCryptoTest"];

     CAssert(me,@"No default identity has been set up in the Keychain");

     Log(@"Using %@", me);

     NSData *source = [NSData dataWithContentsOfFile: @"/Library/Desktop Pictures/Nature/Zen Garden.jpg"];

     CAssert(source);

     TestRoundTrip(@"signing",            source, me,  nil);

     TestRoundTrip(@"encryption",         source, nil, me);

     TestRoundTrip(@"signing+encryption", source, me,  me);

 }

 #endif DEBUG