//------------------------------------------------------------------------------
// <copyright file="AuthenticationService.cs" company="Microsoft">
//     Copyright (c) Microsoft Corporation.  All rights reserved.
// </copyright>
//------------------------------------------------------------------------------

namespace System.Web.ApplicationServices {
    using System;
    using System.Diagnostics.CodeAnalysis;
    using System.ServiceModel;
    using System.ServiceModel.Activation;
    using System.Web;
    using System.Web.Management;
    using System.Web.Resources;
    using System.Web.Security;

    /// <devdoc>
    ///     Implements login service contract to be exposed as a WCF service. Uses Membership provider
    ///     or custom authentication login in the Authenticating event. Also uses Forms.SetAuthCookie() or
    ///     custom cookie generation via the CreatingCookie event.
    /// </devdoc>

    [
    AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Required),
    ServiceContract(Namespace="http://asp.net/ApplicationServices/v200"),
    ServiceBehavior(Namespace="http://asp.net/ApplicationServices/v200", InstanceContextMode = InstanceContextMode.Single, ConcurrencyMode = ConcurrencyMode.Multiple)
    ]
    public class AuthenticationService {

        /// <devdoc>
        ///    Raised to authenticate the user . The event handler sets the e.AuthenticationIsComplete flag to true
        ///    and e.Authenticated to the result.
        /// </devdoc>
        private static object _authenticatingEventHandlerLock = new object();
        private static EventHandler<AuthenticatingEventArgs> _authenticating;
        public static event EventHandler<AuthenticatingEventArgs> Authenticating {
            add {
                lock (_authenticatingEventHandlerLock) {
                    _authenticating += value;
                }
            }
            remove {
                lock (_authenticatingEventHandlerLock) {
                    _authenticating -= value;
                }
            }
        }

        /// <devdoc>
        ///    Raised to create and set the cookie. The event handler shouldset the e.CookieIsSet flag to true, if it is
        ///    setting the cookie.
        /// </devdoc>
        private static object _creatingCookieEventHandlerLock = new object();
        private static EventHandler<CreatingCookieEventArgs> _creatingCookie;
        public static event EventHandler<CreatingCookieEventArgs> CreatingCookie {
            add {
                lock (_creatingCookieEventHandlerLock) {
                    _creatingCookie += value;
                }
            }
            remove {
                lock (_creatingCookieEventHandlerLock) {
                    _creatingCookie -= value;
                }
            }
        }

        public AuthenticationService() {
        }
        
        /// <devdoc>
        ///    Raises the AuthentincatingEvent if atleast one handler is assigned.
        /// </devdoc>
        private void OnAuthenticating(AuthenticatingEventArgs e) {
            EventHandler<AuthenticatingEventArgs> handler = _authenticating;
            if (null != handler) {
                handler(this, e);
            }
        }

        /// <devdoc>
        ///     Raises the CreatingCookieEvent if atleast one handler is assigned.
        /// </devdoc>
        private void OnCreatingCookie(CreatingCookieEventArgs e) {
            EventHandler<CreatingCookieEventArgs> handler = _creatingCookie;
            if (null != handler) {
                handler(this, e);
            }
        }

        /// <devdoc>
        ///     Validates user credentials,without actually setting the FormAuth cookie
        /// </devdoc>
        /// <param name="username">Username of the account</param>
        /// <param name="password">Password of the account</param>
        /// <param name="customCredential">Any misc. string to be used by custom authentication logic</param>
        /// <returns>True, if credentials are valid, otherwise false</returns>
        [OperationContract]
        [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId="username", Justification="consistent with Whidbey")]
        public bool ValidateUser(string username, string password, string customCredential) {
            ApplicationServiceHelper.EnsureAuthenticationServiceEnabled(HttpContext.Current, true);
            return LoginInternal(username, password, customCredential, false, false);
        }

        /// <devdoc>
        ///     Validates user credentials,and sets the FormAuth cookie if the credentials are valid.
        /// </devdoc>
        /// <param name="username">Username of the account</param>
        /// <param name="password">Password of the account</param>
        /// <param name="customCredential">Any misc. string to be used by custom authentication logic</param>
        /// <param name="isPersistent">If true the persistant cookie is generated. </param>
        /// <returns>True, if credentials are valid, otherwise false</returns>
        [OperationContract]
        [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId="username", Justification="consistent with Whidbey")]
        public bool Login(string username, string password, string customCredential, bool isPersistent) {
            ApplicationServiceHelper.EnsureAuthenticationServiceEnabled(HttpContext.Current, true);
            return LoginInternal(username, password, customCredential, isPersistent, true);
        }

        /// <devdoc>
        ///    Checks whether the Forms Authentication cookie attached to the request is valid.
        /// </devdoc>
        [OperationContract]
        public bool IsLoggedIn() {
            ApplicationServiceHelper.EnsureAuthenticationServiceEnabled(HttpContext.Current, true);
            return HttpContext.Current.User.Identity.IsAuthenticated;
        }

        /// <devdoc>
        ///   Clears the Forms Authentication cookie
        /// </devdoc>
        [OperationContract]
        public void Logout() {
            ApplicationServiceHelper.EnsureAuthenticationServiceEnabled(HttpContext.Current, false);
            FormsAuthentication.SignOut();
        }

        /// <devdoc>
        ///     Validates the user credentials.
        /// </devdoc>
        /// <param name="username"></param>
        /// <param name="password"></param>
        /// <param name="customCredential"></param>
        /// <param name="isPersistent"></param>
        /// <param name="setCookie">If this is true, CreatingCookie event is raised, and cookie is set in HttpResponse</param>
        /// <returns></returns>
        private bool LoginInternal(string username, string password, string customCredential, bool isPersistent, bool setCookie) {
            if (null == username) {
                throw new ArgumentNullException("username");
            }

            if (null == password) {
                throw new ArgumentNullException("password");
            }
            AuthenticatingEventArgs authEventArgs = new AuthenticatingEventArgs(username, password, customCredential);
            try {
                OnAuthenticating(authEventArgs);

                if (!authEventArgs.AuthenticationIsComplete) {
                    MembershipValidate(authEventArgs);
                }
                if (!authEventArgs.Authenticated) {
                    Logout();
                }
                if (authEventArgs.Authenticated && setCookie) {
                    CreatingCookieEventArgs cookieEventArgs = new CreatingCookieEventArgs(username, password, isPersistent, customCredential);
                    OnCreatingCookie(cookieEventArgs);
                    if (!cookieEventArgs.CookieIsSet) {
                        SetCookie(username, isPersistent);
                    }
                }
            }
            catch (Exception e) {
                LogException(e);
                throw;
            }
            return authEventArgs.Authenticated;
        }


        private static void MembershipValidate(AuthenticatingEventArgs e) {
            e.Authenticated = Membership.ValidateUser(e.UserName, e.Password);
        }

        private static void SetCookie(string username, bool isPersistent) {
            FormsAuthentication.SetAuthCookie(username, isPersistent);
        }

        private void LogException(Exception e) {
            WebServiceErrorEvent errorevent = new WebServiceErrorEvent(AtlasWeb.UnhandledExceptionEventLogMessage, this, e);
            errorevent.Raise();
        }

    }
}