package pkg

import (
	"errors"
	"strings"
)

// Note : this structure was created by listing the possible properties of the profile, no actual profile was found for sourcing

type OCSPStaplingParams struct {
	ProfileCommon
	CacheErrorTimeout   string `json:"cache_error_timeout"`    // Specifies the lifetime of an error response in the cache, in seconds.The default value is 3600 or one hour.
	CacheTimeout        string `json:"cache_timeout"`          // Specifies the lifetime of the OCSP response in the cache, in seconds.The actual time period for which the response is cached is the minimum of the response validity period and the cache_timeout. The default value is indefinite, indicating that the response validity period takes precedence.
	ClockSkew           string `json:"clock_skew"`             // Specifies the tolerable maximum absolute difference in the clocks of the responder and the BIG_IP, in seconds. The default value is 300.
	DNSResolver         string `json:"dns_resolver"`           // Specifies the DNS resolver object used for fetching the OCSP response.
	ProxyServerPool     string `json:"proxy_server_pool"`      // Specifies the proxy server pool used for fetching the OCSP response.
	ResponderURL        string `json:"responder_url"`          // Specifies the absolute URL that overrides the OCSP responder URL obtained from the certificate's AIA extension(s). This should be a HTTP or HTTPS based URL.
	SignHash            string `json:"sign_hash"`              // Specifies the hash algorithm used for signing the OCSP request.The default value is SHA256.
	SignerCert          string `json:"signer_cert"`            // Specifies the certificate corresponding to the key used for signing the OCSP request.
	SignerKey           string `json:"signer_key"`             // Specifies the key used for signing the OCSP request.
	SignerKeyPassphrase string `json:"signer_key_passphrase"`  // Specifies the passphrase of the key used for signing the OCSP request.
	StatusAge           string `json:"status_age"`             // Specifies the maximum allowed lag time for the 'thisUpdate' time in the OCSP response that the BIG_IP accepts. If this maximum is exceeded, the response is dropped. If this value is set to '0', this validation is skipped. The default value is 86400 seconds.
	StrictRespCertCheck string `json:"strict_resp_cert_check"` // If enabled, the responder's certificate is checked for OCSP signingextension. By default, it is disabled.
	Timeout             string `json:"timeout"`                // Specifies the time interval (in seconds) that the BIG_IP waits for before aborting the connection to the OCSP responder. The default value is 8. The timeout should be less than the handshake timeout of the clientssl profile that the OCSP Stapling Parameters object is associated with.
	TrustedCA           string `json:"trusted_ca"`             // Specifies the certificate_authority that signs the responder's certificate.
	TrustedResponders   string `json:"trusted_responders"`     // Specifies the certificate(s) used for validating the OCSP response when the responder's certificate has been omitted from the response.
	UseProxyServer      string `json:"use_proxy_server"`       // Specifies whether the proxy server pool or the DNS resolver should be used for making the connection to the OCSP responder.
}

func ParseOCSPStaplingParams(raw string) (*OCSPStaplingParams, error) {
	p := new(OCSPStaplingParams)
	split := strings.Split(raw, "\n")
	if !strings.Contains(split[0], "ltm profile ocsp-stapling-params") {
		return nil, errors.New("not an ocsp-stapling-params profile")
	}
	p.ProfileCommon = parseCommon(raw)
	for _, line := range split {
		f := strings.Fields(line)
		switch strings.ToLower(f[0]) {
		case "cache-error-timeout":
			p.CacheErrorTimeout = strings.Join(f[1:], " ")
		case "cache-timeout":
			p.CacheTimeout = strings.Join(f[1:], " ")
		case "clock-skew":
			p.ClockSkew = strings.Join(f[1:], " ")
		case "dns-resolver":
			p.DNSResolver = strings.Join(f[1:], " ")
		case "proxy-server-pool":
			p.ProxyServerPool = strings.Join(f[1:], " ")
		case "responder-url":
			p.ResponderURL = strings.Join(f[1:], " ")
		case "sign-hash":
			p.SignHash = strings.Join(f[1:], " ")
		case "signer-cert":
			p.SignerCert = strings.Join(f[1:], " ")
		case "signer-key":
			p.SignerKey = strings.Join(f[1:], " ")
		case "signer-key-passphrase":
			p.SignerKeyPassphrase = strings.Join(f[1:], " ")
		case "status-age":
			p.StatusAge = strings.Join(f[1:], " ")
		case "strict-resp-cert-check":
			p.StrictRespCertCheck = strings.Join(f[1:], " ")
		case "timeout":
			p.Timeout = strings.Join(f[1:], " ")
		case "trusted-ca":
			p.TrustedCA = strings.Join(f[1:], " ")
		case "trusted-responders":
			p.TrustedResponders = strings.Join(f[1:], " ")
		case "use-proxy-server":
			p.UseProxyServer = strings.Join(f[1:], " ")
		}
	}
	return p, nil
}