module Aws

  # @api private
  class SharedConfig

    # @return [String]
    attr_reader :credentials_path

    # @return [String]
    attr_reader :config_path

    # @return [String]
    attr_reader :profile_name

    # Constructs a new SharedConfig provider object. This will load the shared
    # credentials file, and optionally the shared configuration file, as ini
    # files which support profiles.
    #
    # By default, the shared credential file (the default path for which is
    # `~/.aws/credentials`) and the shared config file (the default path for
    # which is `~/.aws/config`) are loaded. However, if you set the
    # `ENV['AWS_SDK_CONFIG_OPT_OUT']` environment variable, only the shared
    # credential file will be loaded. You can specify the shared credential
    # file path with the `ENV['AWS_SHARED_CREDENTIALS_FILE']` environment
    # variable or with the `:credentials_path` option. Similarly, you can
    # specify the shared config file path with the `ENV['AWS_CONFIG_FILE']`
    # environment variable or with the `:config_path` option.
    #
    # The default profile name is 'default'. You can specify the profile name
    # with the `ENV['AWS_PROFILE']` environment variable or with the
    # `:profile_name` option.
    #
    # @param [Hash] options
    # @option options [String] :credentials_path Path to the shared credentials
    #   file. If not specified, will check `ENV['AWS_SHARED_CREDENTIALS_FILE']`
    #   before using the default value of "#{Dir.home}/.aws/credentials".
    # @option options [String] :config_path Path to the shared config file.
    #   If not specified, will check `ENV['AWS_CONFIG_FILE']` before using the
    #   default value of "#{Dir.home}/.aws/config".
    # @option options [String] :profile_name The credential/config profile name
    #   to use. If not specified, will check `ENV['AWS_PROFILE']` before using
    #   the fixed default value of 'default'.
    # @option options [Boolean] :config_enabled If true, loads the shared config
    #   file and enables new config values outside of the old shared credential
    #   spec.
    def initialize(options = {})
      @parsed_config = nil
      @profile_name = determine_profile(options)
      @config_enabled = options[:config_enabled]
      @credentials_path = options[:credentials_path] ||
        determine_credentials_path
      @parsed_credentials = {}
      load_credentials_file if loadable?(@credentials_path)
      if @config_enabled
        @config_path = options[:config_path] || determine_config_path
        load_config_file if loadable?(@config_path)
      end
    end

    # @api private
    def fresh(options = {})
      @profile_name = nil
      @credentials_path = nil
      @config_path = nil
      @parsed_credentials = {}
      @parsed_config = nil
      @config_enabled = options[:config_enabled] ? true : false
      @profile_name = determine_profile(options)
      @credentials_path = options[:credentials_path] ||
        determine_credentials_path
      load_credentials_file if loadable?(@credentials_path)
      if @config_enabled
        @config_path = options[:config_path] || determine_config_path
        load_config_file if loadable?(@config_path)
      end
    end

    # @return [Boolean] Returns `true` if a credential file
    #   exists and has appropriate read permissions at {#path}.
    # @note This method does not indicate if the file found at {#path}
    #   will be parsable, only if it can be read.
    def loadable?(path)
      !path.nil? && File.exist?(path) && File.readable?(path)
    end

    # @return [Boolean] returns `true` if use of the shared config file is
    #   enabled.
    def config_enabled?
      @config_enabled ? true : false
    end

    # Sources static credentials from shared credential/config files.
    #
    # @param [Hash] opts
    # @option options [String] :profile the name of the configuration file from
    #   which credentials are being sourced.
    # @return [Aws::Credentials] credentials sourced from configuration values,
    #   or `nil` if no valid credentials were found.
    def credentials(opts = {})
      p = opts[:profile] || @profile_name
      validate_profile_exists(p) if credentials_present?
      if credentials = credentials_from_shared(p, opts)
        credentials
      elsif credentials = credentials_from_config(p, opts)
        credentials
      else
        nil
      end
    end

    # Attempts to assume a role from shared config or shared credentials file.
    # Will always attempt first to assume a role from the shared credentials
    # file, if present.
    def assume_role_credentials_from_config(opts = {})
      p = opts.delete(:profile) || @profile_name
      chain_config = opts.delete(:chain_config)
      credentials = assume_role_from_profile(@parsed_credentials, p, opts, chain_config)
      if @parsed_config
        credentials ||= assume_role_from_profile(@parsed_config, p, opts, chain_config)
      end
      credentials
    end

    def region(opts = {})
      p = opts[:profile] || @profile_name
      if @config_enabled
        if @parsed_credentials
          region = @parsed_credentials.fetch(p, {})["region"]
        end
        if @parsed_config
          region ||= @parsed_config.fetch(p, {})["region"]
        end
        region
      else
        nil
      end
    end

    def endpoint_discovery(opts = {})
      p = opts[:profile] || @profile_name
      if @config_enabled && @parsed_config
        @parsed_config.fetch(p, {})["endpoint_discovery_enabled"]
      end
    end

    def credentials_process(profile)
      validate_profile_exists(profile)
      @parsed_config[profile]['credential_process']
    end

    def csm_enabled(opts = {})
      p = opts[:profile] || @profile_name
      if @config_enabled
        if @parsed_credentials
          value = @parsed_credentials.fetch(p, {})["csm_enabled"]
        end
        if @parsed_config
          value ||= @parsed_config.fetch(p, {})["csm_enabled"]
        end
        value
      else
        nil
      end
    end

    def csm_client_id(opts = {})
      p = opts[:profile] || @profile_name
      if @config_enabled
        if @parsed_credentials
          value = @parsed_credentials.fetch(p, {})["csm_client_id"]
        end
        if @parsed_config
          value ||= @parsed_config.fetch(p, {})["csm_client_id"]
        end
        value
      else
        nil
      end
    end

    def csm_port(opts = {})
      p = opts[:profile] || @profile_name
      if @config_enabled
        if @parsed_credentials
          value = @parsed_credentials.fetch(p, {})["csm_port"]
        end
        if @parsed_config
          value ||= @parsed_config.fetch(p, {})["csm_port"]
        end
        value
      else
        nil
      end
    end

    def csm_host(opts = {})
      p = opts[:profile] || @profile_name
      if @config_enabled
        if @parsed_credentials
          value = @parsed_credentials.fetch(p, {})["csm_host"]
        end
        if @parsed_config
          value ||= @parsed_config.fetch(p, {})["csm_host"]
        end
        value
      else
        nil
      end
    end

    private
    def credentials_present?
      (@parsed_credentials && !@parsed_credentials.empty?) ||
        (@parsed_config && !@parsed_config.empty?)
    end

    def assume_role_from_profile(cfg, profile, opts, chain_config)
      if cfg && prof_cfg = cfg[profile]
        opts[:source_profile] ||= prof_cfg["source_profile"]
        credential_source = opts.delete(:credential_source)
        credential_source ||= prof_cfg["credential_source"]
        if opts[:source_profile] && credential_source
          raise Errors::CredentialSourceConflictError.new(
            "Profile #{profile} has a source_profile, and "\
              "a credential_source. For assume role credentials, must "\
              "provide only source_profile or credential_source, not both."
          )
        elsif opts[:source_profile]
          opts[:credentials] = credentials(profile: opts[:source_profile])
          if opts[:credentials]
            opts[:role_session_name] ||= prof_cfg["role_session_name"]
            opts[:role_session_name] ||= "default_session"
            opts[:role_arn] ||= prof_cfg["role_arn"]
            opts[:external_id] ||= prof_cfg["external_id"]
            opts[:serial_number] ||= prof_cfg["mfa_serial"]
            opts[:profile] = opts.delete(:source_profile)
            AssumeRoleCredentials.new(opts)
          else
            raise Errors::NoSourceProfileError.new(
              "Profile #{profile} has a role_arn, and source_profile, but the"\
                " source_profile does not have credentials."
            )
          end
        elsif credential_source
          opts[:credentials] = credentials_from_source(
            credential_source,
            chain_config
          )
          if opts[:credentials]
            opts[:role_session_name] ||= prof_cfg["role_session_name"]
            opts[:role_session_name] ||= "default_session"
            opts[:role_arn] ||= prof_cfg["role_arn"]
            opts[:external_id] ||= prof_cfg["external_id"]
            opts[:serial_number] ||= prof_cfg["mfa_serial"]
            opts.delete(:source_profile) # Cleanup
            AssumeRoleCredentials.new(opts)
          else
            raise Errors::NoSourceCredentials.new(
              "Profile #{profile} could not get source credentials from"\
                " provider #{credential_source}"
            )
          end
        elsif prof_cfg["role_arn"]
          raise Errors::NoSourceProfileError.new(
            "Profile #{profile} has a role_arn, but no source_profile."
          )
        else
          nil
        end
      else
        nil
      end
    end

    def credentials_from_source(credential_source, config)
      case credential_source
      when "Ec2InstanceMetadata"
        InstanceProfileCredentials.new(
          retries: config ? config.instance_profile_credentials_retries : 0,
          http_open_timeout: config ? config.instance_profile_credentials_timeout : 1,
          http_read_timeout: config ? config.instance_profile_credentials_timeout : 1
        )
      when "EcsContainer"
        ECSCredentials.new
      else
        raise Errors::InvalidCredentialSourceError.new(
          "Unsupported credential_source: #{credential_source}"
        )
      end
    end

    def credentials_from_shared(profile, opts)
      if @parsed_credentials && prof_config = @parsed_credentials[profile]
        credentials_from_profile(prof_config)
      else
        nil
      end
    end

    def credentials_from_config(profile, opts)
      if @parsed_config && prof_config = @parsed_config[profile]
        credentials_from_profile(prof_config)
      else
        nil
      end
    end

    def credentials_from_profile(prof_config)
      creds = Credentials.new(
        prof_config['aws_access_key_id'],
        prof_config['aws_secret_access_key'],
        prof_config['aws_session_token']
      )
      if credentials_complete(creds)
        creds
      else
        nil
      end
    end

    def credentials_complete(creds)
      creds.set?
    end

    def load_credentials_file
      @parsed_credentials = IniParser.ini_parse(
        File.read(@credentials_path)
      )
    end

    def load_config_file
      @parsed_config = IniParser.ini_parse(File.read(@config_path))
    end

    def determine_credentials_path
      ENV['AWS_SHARED_CREDENTIALS_FILE'] || default_shared_config_path('credentials')
    end

    def determine_config_path
      ENV['AWS_CONFIG_FILE'] || default_shared_config_path('config')
    end

    def default_shared_config_path(file)
      File.join(Dir.home, '.aws', file)
    rescue ArgumentError
      # Dir.home raises ArgumentError when ENV['home'] is not set
      nil
    end

    def validate_profile_exists(profile)
      unless (@parsed_credentials && @parsed_credentials[profile]) ||
          (@parsed_config && @parsed_config[profile])
        msg = "Profile `#{profile}' not found in #{@credentials_path}"
        msg << " or #{@config_path}" if @config_path
        raise Errors::NoSuchProfileError.new(msg)
      end
    end

    def determine_profile(options)
      ret = options[:profile_name]
      ret ||= ENV["AWS_PROFILE"]
      ret ||= "default"
      ret
    end

  end
end