/*
    * Copyright (c) 2024 Kaiserpfalz EDV-Service, Roland T. Lichti
    *
    * This program is free software; you can redistribute it and/or
    * modify it under the terms of the GNU Lesser General Public
    * License as published by the Free Software Foundation; either
    * version 3 of the License, or (at your option) any later version.
    * 
    * This program is distributed in the hope that it will be useful,
   * but WITHOUT ANY WARRANTY; without even the implied warranty of
   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   * Lesser General Public License for more details.
   * 
   * You should have received a copy of the GNU Lesser General Public License
   * along with this program; if not, write to the Free Software Foundation,
   * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
   */
  package de.kaiserpfalzedv.commons.spring.security;
  
  
  
  import org.springframework.http.ResponseEntity;
  import org.springframework.security.core.Authentication;
  import org.springframework.security.oauth2.core.oidc.user.OidcUser;
  import org.springframework.security.web.authentication.logout.LogoutHandler;
  import org.springframework.stereotype.Component;
  import org.springframework.web.client.RestTemplate;
  import org.springframework.web.util.UriComponentsBuilder;
  
  import jakarta.servlet.http.HttpServletRequest;
  import jakarta.servlet.http.HttpServletResponse;
  import lombok.extern.slf4j.Slf4j;
  
  
  /**
   * 
   * @author klenkes74 {@literal <rlichti@kaiserpfalz-edv.de>}
   * @version 1.0.0
   * @since 2024-06-14
   */
  @Component
  @Slf4j
  public class KeycloakLogoutHandler implements LogoutHandler {
      private final RestTemplate restTemplate;
  
      public KeycloakLogoutHandler(RestTemplate restTemplate) {
          this.restTemplate = restTemplate;
      }
  
      @Override
      public void logout(HttpServletRequest request, HttpServletResponse response, Authentication auth) {
          logoutFromKeycloak((OidcUser) auth.getPrincipal());
      }
  
      private void logoutFromKeycloak(OidcUser user) {
          String endSessionEndpoint = user.getIssuer() + "/protocol/openid-connect/logout";
          UriComponentsBuilder builder = UriComponentsBuilder
              .fromUriString(endSessionEndpoint)
              .queryParam("id_token_hint", user.getIdToken().getTokenValue());
  
          ResponseEntity<String> logoutResponse = restTemplate.getForEntity(
          builder.toUriString(), String.class);
          if (logoutResponse.getStatusCode().is2xxSuccessful()) {
              log.info("Successfully logged out from Keycloak");
          } else {
              log.error("Could not propagate logout to Keycloak");
          }
      }
  }