/*
 * Copyright (C) 2012-2017 Japan Smartphone Security Association
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.jssec.webview.trustedcontents;

import android.app.Activity;
import android.app.AlertDialog;
import android.content.DialogInterface;
import android.net.http.SslCertificate;
import android.net.http.SslError;
import android.os.Bundle;
import android.webkit.SslErrorHandler;
import android.webkit.WebView;
import android.webkit.WebViewClient;

import java.text.SimpleDateFormat;

public class WebViewTrustedContentsActivity extends Activity {
	@Override
	public void onCreate(Bundle savedInstanceState) {
		super.onCreate(savedInstanceState);
		setContentView(R.layout.main);
		WebView webView = (WebView) findViewById(R.id.webView);

		webView.setWebViewClient(new WebViewClient() {
			@Override
			public void onReceivedSslError(WebView view,
					SslErrorHandler handler, SslError error) {
				// *** POINT 1 *** Handle SSL error from WebView appropriately
				// Show SSL error dialog.
				AlertDialog dialog = createSslErrorDialog(error);
				dialog.show();

				// *** POINT 1 *** Handle SSL error from WebView appropriately
				// Abort connection in case of SSL error
				// Since, there may be some defects in a certificate like expiration of validity,
				// or it may be man-in-the-middle attack. 
				handler.cancel();
			}
		});

		// *** POINT 2 *** Enable JavaScript (optional) 
		// in case to show contents which are managed in house.
		webView.getSettings().setJavaScriptEnabled(true);

		// *** POINT 3 *** Restrict URLs to HTTPS protocol only
		// *** POINT 4 *** Restrict URLs to in-house
		webView.loadUrl("https://url.to.your.contents/");
	}

	private AlertDialog createSslErrorDialog(SslError error) {
		// Error message to show in this dialog
		String errorMsg = createErrorMessage(error);
		// Handler for OK button
		DialogInterface.OnClickListener onClickOk = new DialogInterface.OnClickListener() {
			@Override
			public void onClick(DialogInterface dialog, int which) {
				setResult(RESULT_OK);
			}
		};
		// Create a dialog
		AlertDialog dialog = new AlertDialog.Builder(
				WebViewTrustedContentsActivity.this).setTitle("SSL connection error")
				.setMessage(errorMsg).setPositiveButton("OK", onClickOk)
				.create();
		return dialog;
	}

	private String createErrorMessage(SslError error) {
		SslCertificate cert = error.getCertificate();
        SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss");
        StringBuilder result = new StringBuilder()
		.append("The site's certification is NOT valid. Connection was disconnected.\n\nError:\n");
		switch (error.getPrimaryError()) {
		case SslError.SSL_EXPIRED:
			result.append("The certificate is no longer valid.\n\nThe expiration date is ")
			.append(dateFormat.format(cert.getValidNotAfterDate()));
			return result.toString();
		case SslError.SSL_IDMISMATCH:
			result.append("Host name doesn't match. \n\nCN=")
			.append(cert.getIssuedTo().getCName());
			return result.toString();
		case SslError.SSL_NOTYETVALID:
			result.append("The certificate isn't valid yet.\n\nIt will be valid from ")
			.append(dateFormat.format(cert.getValidNotBeforeDate()));
			return result.toString();
		case SslError.SSL_UNTRUSTED:
			result.append("Certificate Authority which issued the certificate is not reliable.\n\nCertificate Authority\n")
			.append(cert.getIssuedBy().getDName());
			return result.toString();
		default:
			result.append("Unknown error occured. ");
			return result.toString();

		}
	}

}
