approov_secret =
  System.get_env("APPROOV_BASE64_SECRET") ||
    raise "Environment variable APPROOV_BASE64_SECRET is missing."

config :YOUR_APP, YOUR_APP.ApproovTokenPlug,
  allowed_algos: ["HS256"],
  secret_key: Base.decode64!(approov_secret)

{:guardian, "~> 2.0"}

defmodule YOUR_APP.ApproovTokenPlug do
  require Logger

  ##############################################################################
  # Adhere to the Phoenix Module Plugs specification by implementing:
  #   * init/1
  #   * call/2
  #
  # @link https://hexdocs.pm/phoenix/plug.html#module-plugs
  ##############################################################################

  def init(options), do: options

  def call(conn, _options) do
    with {:ok, conn, _approov_token_claims} <- _verify_approov_token(conn) do
      conn
    else
      {:error, conn} ->
        conn |> _halt_connection()
    end
  end

  ##############################################################################
  # Inject Guardian functions and implement the required behaviour callbacks:
  #   * subject_for_token/2
  #   * resource_from_claims/2
  #
  # The required behaviour functions are not necessary in the context of
  # checking the Approov token, but required to be implemented in order to use
  # Guardian.
  ##############################################################################

  use Guardian, otp_app: :hello

  @impl true
  def subject_for_token(user, _claims), do: {:ok, to_string(user.id)}

  @impl true
  def resource_from_claims(claims), do: {:ok, claims["sub"]}

  defp _verify_approov_token(conn) do
    with [approov_token | _] <- Plug.Conn.get_req_header(conn, "approov-token"),
         {:ok, approov_token_claims} <- decode_and_verify(approov_token),
         :ok <- _verify_expiration(approov_token_claims) do
      {:ok, conn, approov_token_claims}
    else
      [] ->
        # You may want to add some logging here
        {:error, conn}

      {:error, reason} when is_atom(reason) ->
        # You may want to add some logging here
        {:error, conn}

      {:error, %ArgumentError{} = error} ->
        # You may want to add some logging here
        {:error, conn}

      {:error, error} ->
        # You may want to add some logging here
        {:error, conn}
    end
  end

  defp _verify_expiration(%{"exp" => timestamp}) do
    datetime = _timestamp_to_datetime(timestamp)
    now = DateTime.utc_now()

    case DateTime.compare(now, datetime) do
      :lt ->
        :ok

      _ ->
        {:error, :approov_token_expired}
    end
  end

  defp _verify_expiration(_claims) do
    {:error, :missing_exp_claim}
  end

  defp _timestamp_to_datetime(timestamp) when is_integer(timestamp) do
    DateTime.from_unix!(timestamp)
  end

  defp _timestamp_to_datetime(timestamp) when is_float(timestamp) do
    {timestamp, _decimals} = Integer.parse("#{timestamp}")
    DateTime.from_unix!(timestamp)
  end

  defp _halt_connection(conn) do
    conn
    |> Plug.Conn.put_status(401)
    |> Phoenix.Controller.json(%{})
    |> Plug.Conn.halt()
  end
end

pipeline :api do
  plug :accepts, ["json"]

  # Ideally you will not want to add any other Plug before the Approov Token
  # check to protect your server from wasting resources in processing requests
  # not having a valid Approov token. This increases availability for your
  # users during peak time or in the event of a DoS attack(We all know the
  # BEAM design allows to cope very well with this scenarios, but best to play
  # in the safe side).
  plug YourAppWeb.ApproovTokenPlug
end