// Copyright 2017 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.vespa.hosted.athenz.instanceproviderservice.identitydocument;

import com.google.inject.Inject;
import com.yahoo.container.jaxrs.annotation.Component;
import com.yahoo.log.LogLevel;

import javax.servlet.http.HttpServletRequest;
import javax.ws.rs.BadRequestException;
import javax.ws.rs.ForbiddenException;
import javax.ws.rs.GET;
import javax.ws.rs.InternalServerErrorException;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.QueryParam;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.MediaType;
import java.util.logging.Logger;

/**
 * @author bjorncs
 */
@Path("/identity-document")
public class IdentityDocumentResource {

    private static final Logger log = Logger.getLogger(IdentityDocumentResource.class.getName());

    private final IdentityDocumentGenerator identityDocumentGenerator;

    @Inject
    public IdentityDocumentResource(@Component IdentityDocumentGenerator identityDocumentGenerator) {
        this.identityDocumentGenerator = identityDocumentGenerator;
    }

    @GET
    @Produces(MediaType.APPLICATION_JSON)
    public SignedIdentityDocument getIdentityDocument(@QueryParam("hostname") String hostname,
                                                      @Context HttpServletRequest request) {
        // TODO Use TLS client authentication instead of blindly trusting hostname
        // Until we have distributed Athenz x509 certificates we will validate that remote address
        // is authorized to access the provided hostname. This means any container
        if (!identityDocumentGenerator.validateAccess(hostname, request.getRemoteAddr())) {
            throw new ForbiddenException();
        }
        if (hostname == null) {
            throw new BadRequestException("The 'hostname' query parameter is missing");
        }
        try {
            return identityDocumentGenerator.generateSignedIdentityDocument(hostname);
        } catch (Exception e) {
            String message = String.format("Unable to generate identity doument for '%s': %s", hostname, e.getMessage());
            log.log(LogLevel.ERROR, message, e);
            throw new InternalServerErrorException(message, e);
        }
    }
}

@@ -13,9 +13,9 @@
  201
-7
+8
  Yah
@@ -536,16 +536,46 @@
 s.Path;%0A
+import javax.ws.rs.PathParam;%0A
 import j
@@ -1192,54 +1192,341 @@
     
-@GET%0A    @Produces(MediaType.APPLICATION_JSON)
+/**%0A     * @deprecated Use %7B@link #getNodeIdentityDocument(String, HttpServletRequest)%7D%0A     *             and %7B@link #getTenantIdentityDocument(String, HttpServletRequest)%7D instead.%0A     */%0A    @GET%0A    @Produces(MediaType.APPLICATION_JSON)%0A    @Deprecated%0A    // TODO Make this method private when the rest api is not longer in use
 %0A   
@@ -2635,10 +2635,662 @@
 %7D%0A    %7D%0A
+%0A    @GET%0A    @Produces(MediaType.APPLICATION_JSON)%0A    @Path(%22/node/%7Bhost%7D%22)%0A    public SignedIdentityDocument getNodeIdentityDocument(@PathParam(%22host%22) String host,%0A                                                          @Context HttpServletRequest request) %7B%0A        return getIdentityDocument(host, request);%0A    %7D%0A%0A%0A    @GET%0A    @Produces(MediaType.APPLICATION_JSON)%0A    @Path(%22/tenant/%7Bhost%7D%22)%0A    public SignedIdentityDocument getTenantIdentityDocument(@PathParam(%22host%22) String host,%0A                                                            @Context HttpServletRequest request) %7B%0A        return getIdentityDocument(host, request);%0A    %7D%0A%0A
 %7D%0A

Add separate method for generating identity document for tenant and node