module SRP
  class Session
    include SRP::Util
    attr_accessor :user, :aa, :bb

    def initialize(user, aa=nil)
      @user = user
      aa ? initialize_server(aa) : initialize_client
    end

    # client -> server: I, A = g^a
    def handshake(server)
      @bb = server.handshake(user.username, aa)
      @u = calculate_u
    end

    # client -> server: M = H(H(N) xor H(g), H(I), s, A, B, K)
    def validate(server)
      server.validate(calculate_m(client_secret))
    end

    def authenticate!(m)
      authenticate(m) || raise(SRP::WrongPassword)
    end

    def authenticate(m)
      if(m == calculate_m(server_secret))
        @m2 = calculate_m2
        return @user
      end
    end

    def to_json(options={})
      if @m2
        { :M2 => @m2.to_s(16) }.to_json(options)
      else
        { :B => bb.to_s(16),
#          :b => @b.to_s(16),    # only use for debugging
          :salt => @user.salt.to_s(16)
        }.to_json(options)
      end
    end

    protected


    # only seed b for testing purposes.
    def initialize_server(aa, b = nil)
      @aa = aa
      @b =  b || bigrand(32).hex
      # B = g^b + k v (mod N)
      @bb = (modpow(GENERATOR, @b) + multiplier * @user.verifier) % BIG_PRIME_N
      @u = calculate_u
    end

    def initialize_client
      @a = bigrand(32).hex
      @aa = modpow(GENERATOR, @a) # A = g^a (mod N)
    end

    # client: K = H( (B - kg^x) ^ (a + ux) )
    def client_secret
      base = @bb
      # base += BIG_PRIME_N * @multiplier
      base -= modpow(GENERATOR, @user.private_key) * multiplier
      base = base % BIG_PRIME_N
      modpow(base, @user.private_key * @u + @a)
    end

    # server: K = H( (Av^u) ^ b )
    # do not cache this - it's secret and someone might store the
    # session in a CookieStore
    def server_secret
      base = (modpow(@user.verifier, @u) * @aa) % BIG_PRIME_N
      modpow(base, @b)
    end

    # this is outdated - SRP 6a uses
    # M = H(H(N) xor H(g), H(I), s, A, B, K)
    def calculate_m(secret)
      @k = sha256_int(secret).hex
      n_xor_g_long = hn_xor_hg.bytes.map{|b| "%02x" % b.ord}.join.hex
      username_hash = sha256_str(@user.username).hex
      @m = sha256_int(n_xor_g_long, username_hash, @user.salt, @aa, @bb, @k).hex
    end

    def calculate_m2
      sha256_int(@aa, @m, @k).hex
    end

    def calculate_u
      sha256_int(@aa, @bb).hex
    end

  end
end