/*
    Flexisip, a flexible SIP proxy server with media capabilities.
    Copyright (C) 2010-2025 Belledonne Communications SARL, All rights reserved.

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU Affero General Public License as
    published by the Free Software Foundation, either version 3 of the
    License, or (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU Affero General Public License for more details.

    You should have received a copy of the GNU Affero General Public License
    along with this program. If not, see <http://www.gnu.org/licenses/>.
*/

#pragma once

#include "flexisip/module-authentication-base.hh"
#include "flexisip/module.hh"
#include "flexisip/sofia-wrapper/auth-module.hh"

namespace flexisip {

class Agent;
class AuthDb;

class Authentication : public ModuleAuthenticationBase {
	friend std::shared_ptr<Module> ModuleInfo<Authentication>::create(Agent*);

public:
	StatCounter64* mCountPassFound = nullptr;
	StatCounter64* mCountPassNotFound = nullptr;

	~Authentication() override;

	void onLoad(const GenericStruct* mc) override;
	bool tlsClientCertificatePostCheck(RequestSipEvent& ev);
	virtual bool handleTlsClientAuthentication(RequestSipEvent& ev);
	std::unique_ptr<ResponseSipEvent> onResponse(std::unique_ptr<ResponseSipEvent>&& ev) override;
	void onIdle() override;
	bool doOnConfigStateChanged(const ConfigValue& conf, ConfigState state) override;

	static void declareConfig(GenericStruct& moduleConfig);

protected:
	Authentication(Agent* ag, const ModuleInfoBase* moduleInfo);

private:
	FlexisipAuthModuleBase* createAuthModule(const std::string& domain, int nonceExpire, bool qopAuth) override;

	std::unique_ptr<RequestSipEvent> processAuthentication(std::unique_ptr<RequestSipEvent>&& request,
	                                                       FlexisipAuthModuleBase& am) override;

	const char* findIncomingSubjectInTrusted(const RequestSipEvent& ev, const char* fromDomain);

	static ModuleInfo<Authentication> sInfo;
	std::list<std::string> mTrustedClientCertificates;
	regex_t mRequiredSubject;
	bool mNewAuthOn407 = false;
	bool mRequiredSubjectCheckSet = false;
	bool mRejectWrongClientCertificates = false;
	bool mTrustDomainCertificates = false;
	AuthDb& mAuthDb;
};

} // namespace flexisip