// Copyright 2017 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.container.jdisc.athenz.impl;

import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.RequestBuilder;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.util.EntityUtils;
import org.eclipse.jetty.http.HttpStatus;

import java.io.IOException;
import java.net.URI;

/**
 * @author mortent
 */
public class ServiceProviderApi {

    private final URI providerUri;

    public ServiceProviderApi(String providerAddress) {
        providerUri = URI.create(String.format("https://%s:8443/athenz/v1/provider", providerAddress));
    }

    /**
     * Get signed identity document from config server
     */
    public String getSignedIdentityDocument() {

        // TODO Use client side auth to establish trusted secure channel
        try (CloseableHttpClient httpClient = HttpClientBuilder.create().build()) {

            CloseableHttpResponse idDocResponse = httpClient.execute(RequestBuilder.get().setUri(providerUri + "/identity-document").build());
            if (HttpStatus.isSuccess(idDocResponse.getStatusLine().getStatusCode())) {
                return EntityUtils.toString(idDocResponse.getEntity());
            } else {
                // make sure we have retried a few times (AND logged) before giving up
                throw new RuntimeException("Failed to initialize Athenz instance provider");
            }
        } catch (IOException e) {
            throw new RuntimeException("Failed getting signed identity document", e);
        }
    }

}

@@ -267,32 +267,200 @@
 RequestBuilder;%0A
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;%0Aimport org.apache.http.conn.ssl.SSLContextBuilder;%0Aimport org.apache.http.conn.ssl.TrustSelfSignedStrategy;%0A
 import org.apach
@@ -499,16 +499,16 @@
 Client;%0A
-
 import o
@@ -685,16 +685,148 @@
 net.URI;
+%0Aimport java.security.KeyManagementException;%0Aimport java.security.KeyStoreException;%0Aimport java.security.NoSuchAlgorithmException;
 %0A%0A/**%0A *
@@ -1206,82 +1206,8 @@
 () %7B
-%0A%0A        // TODO Use client side auth to establish trusted secure channel
 %0A   
@@ -1249,16 +1249,22 @@
 lient = 
+create
 HttpClie
@@ -1269,37 +1269,14 @@
 ient
-Builder.create().build
 ()) %7B%0A
-%0A
     
@@ -1818,24 +1818,24 @@
 eption e) %7B%0A
-
             
@@ -1925,10 +1925,856 @@
 %0A    %7D%0A%0A
+    // TODO Use client side auth to establish trusted secure channel%0A    // TODO Validate TLS certifcate of config server%0A    private static CloseableHttpClient createHttpClient() %7B%0A        try %7B%0A            SSLContextBuilder sslContextBuilder = new SSLContextBuilder();%0A            sslContextBuilder.loadTrustMaterial(null, new TrustSelfSignedStrategy());%0A            SSLConnectionSocketFactory sslSocketFactory =%0A                    new SSLConnectionSocketFactory(sslContextBuilder.build(),%0A                                                   SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);%0A            return HttpClientBuilder.create().setSSLSocketFactory(sslSocketFactory).build();%0A        %7D catch (KeyManagementException %7C NoSuchAlgorithmException %7C KeyStoreException e) %7B%0A            throw new RuntimeException(e);%0A        %7D%0A    %7D%0A%0A
 %7D%0A

Disable certifcate validation for service provider client