// Copyright 2024 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "crypto/apple/keychain_util.h"

#import <Security/Security.h>

#include <string>

#include "base/apple/bridging.h"
#include "base/apple/foundation_util.h"
#include "base/apple/scoped_cftyperef.h"
#include "base/metrics/histogram_functions.h"
#include "base/strings/sys_string_conversions.h"
#include "crypto/apple/keychain_v2.h"
#include "crypto/features.h"

namespace crypto::apple {

namespace {

#if BUILDFLAG(IS_IOS)
// These values are persisted to logs. Entries should not be renumbered and
// numeric values should never be reused.
enum class KeychainMigrationResult {
  kNotNeeded = 0,
  kSuccess = 1,
  kFailure = 2,
  kMaxValue = kFailure,
};

#endif  // BUILDFLAG(IS_IOS)

}  // namespace

#if !BUILDFLAG(IS_IOS)
bool ExecutableHasKeychainAccessGroupEntitlement(
    const std::string& keychain_access_group) {
  base::apple::ScopedCFTypeRef<SecTaskRef> task(SecTaskCreateFromSelf(nullptr));
  if (!task) {
    return false;
  }

  base::apple::ScopedCFTypeRef<CFTypeRef> entitlement_value_cftype(
      KeychainV2::GetInstance().TaskCopyValueForEntitlement(
          task.get(), CFSTR("keychain-access-groups"), nullptr));
  if (!entitlement_value_cftype) {
    return false;
  }

  NSArray* entitlement_value_nsarray = base::apple::CFToNSPtrCast(
      base::apple::CFCast<CFArrayRef>(entitlement_value_cftype.get()));
  if (!entitlement_value_nsarray) {
    return false;
  }

  return [entitlement_value_nsarray
      containsObject:base::SysUTF8ToNSString(keychain_access_group)];
}
#endif  // !BUILDFLAG(IS_IOS)

#if BUILDFLAG(IS_IOS)
// Creates a dictionary containing the attributes for an accessibility
// migration. Only used on iOS.
base::apple::ScopedCFTypeRef<CFDictionaryRef> MakeAttributeMigrationQuery() {
  NSDictionary* query = @{
    base::apple::CFToNSPtrCast(kSecAttrAccessible) :
        base::apple::CFToNSPtrCast(kSecAttrAccessibleAfterFirstUnlock),
  };
  return base::apple::ScopedCFTypeRef<CFDictionaryRef>(
      base::apple::NSToCFOwnershipCast(query));
}
#endif  // BUILDFLAG(IS_IOS)

CFStringRef GetKeychainAccessibilityAttribute() {
#if BUILDFLAG(IS_IOS)
  if (base::FeatureList::IsEnabled(
          crypto::features::kMigrateIOSKeychainAccessibility)) {
    return kSecAttrAccessibleAfterFirstUnlock;
  }
#endif  // BUILDFLAG(IS_IOS)
  return kSecAttrAccessibleWhenUnlocked;
}

#if BUILDFLAG(IS_IOS)
bool MigrateKeychainItemAccessibilityIfNeeded(CFDictionaryRef attributes,
                                              CFDictionaryRef query) {
  if (!base::FeatureList::IsEnabled(
          crypto::features::kMigrateIOSKeychainAccessibility)) {
    return false;
  }

  CFStringRef accessibility = base::apple::GetValueFromDictionary<CFStringRef>(
      attributes, kSecAttrAccessible);
  if (CFStringCompare(accessibility, kSecAttrAccessibleWhenUnlocked, 0) ==
      kCFCompareEqualTo) {
    // The item has the old accessibility attribute, so update it.
    base::apple::ScopedCFTypeRef<CFDictionaryRef> attributes_to_update =
        MakeAttributeMigrationQuery();
    OSStatus status =
        KeychainV2::GetInstance().ItemUpdate(query, attributes_to_update.get());
    if (status == errSecSuccess) {
      base::UmaHistogramEnumeration("Security.iOS.KeychainMigration.Result",
                                    KeychainMigrationResult::kSuccess);
    } else {
      base::UmaHistogramEnumeration("Security.iOS.KeychainMigration.Result",
                                    KeychainMigrationResult::kFailure);
    }
    return true;
  }

  base::UmaHistogramEnumeration("Security.iOS.KeychainMigration.Result",
                                KeychainMigrationResult::kNotNeeded);
  return false;
}



base::apple::ScopedCFTypeRef<CFDictionaryRef>
GenerateGenericPasswordUpdateQuery(std::string_view account_name) {
  NSDictionary* query = @{
    base::apple::CFToNSPtrCast(kSecClass) :
        base::apple::CFToNSPtrCast(kSecClassGenericPassword),
    base::apple::CFToNSPtrCast(kSecAttrAccount) :
        base::SysUTF8ToNSString(account_name),
  };
  return base::apple::ScopedCFTypeRef<CFDictionaryRef>(
      base::apple::NSToCFOwnershipCast(query));
}
#endif  // BUILDFLAG(IS_IOS)

}  // namespace crypto::apple