// Code generated by tools/cmd/genjwk/main.go. DO NOT EDIT.

package jwk

import (
	"bytes"
	"fmt"
	"sort"
	"sync"

	"github.com/lestrrat-go/blackmagic"
	"github.com/lestrrat-go/jwx/v3/cert"
	"github.com/lestrrat-go/jwx/v3/internal/base64"
	"github.com/lestrrat-go/jwx/v3/internal/json"
	"github.com/lestrrat-go/jwx/v3/internal/pool"
	"github.com/lestrrat-go/jwx/v3/internal/tokens"
	"github.com/lestrrat-go/jwx/v3/jwa"
	"github.com/lestrrat-go/jwx/v3/jwk/internal/registry"
)

const (
	SymmetricOctetsKey = "k"
)

type SymmetricKey interface {
	Key
	Octets() ([]byte, bool)
}

type symmetricKey struct {
	algorithm              *jwa.KeyAlgorithm // https://tools.ietf.org/html/rfc7517#section-4.4
	keyID                  *string           // https://tools.ietf.org/html/rfc7515#section-4.1.4
	keyOps                 *KeyOperationList // https://tools.ietf.org/html/rfc7517#section-4.3
	keyUsage               *string           // https://tools.ietf.org/html/rfc7517#section-4.2
	octets                 []byte
	x509CertChain          *cert.Chain // https://tools.ietf.org/html/rfc7515#section-4.1.6
	x509CertThumbprint     *string     // https://tools.ietf.org/html/rfc7515#section-4.1.7
	x509CertThumbprintS256 *string     // https://tools.ietf.org/html/rfc7515#section-4.1.8
	x509URL                *string     // https://tools.ietf.org/html/rfc7515#section-4.1.5
	privateParams          map[string]any
	mu                     sync.RWMutex
	dc                     json.DecodeCtx
}

var _ SymmetricKey = &symmetricKey{}
var _ Key = &symmetricKey{}

func newSymmetricKey() *symmetricKey {
	return &symmetricKey{
		privateParams: make(map[string]any),
	}
}

func (h *symmetricKey) KeyType() jwa.KeyType {
	return jwa.OctetSeq()
}

func (h *symmetricKey) rlock() {
	h.mu.RLock()
}

func (h *symmetricKey) runlock() {
	h.mu.RUnlock()
}

func (h *symmetricKey) Algorithm() (jwa.KeyAlgorithm, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.algorithm != nil {
		return *(h.algorithm), true
	}
	return nil, false
}

func (h *symmetricKey) KeyID() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.keyID != nil {
		return *(h.keyID), true
	}
	return "", false
}

func (h *symmetricKey) KeyOps() (KeyOperationList, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.keyOps != nil {
		return *(h.keyOps), true
	}
	return nil, false
}

func (h *symmetricKey) KeyUsage() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.keyUsage != nil {
		return *(h.keyUsage), true
	}
	return "", false
}

func (h *symmetricKey) Octets() ([]byte, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.octets != nil {
		return h.octets, true
	}
	return nil, false
}

func (h *symmetricKey) X509CertChain() (*cert.Chain, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x509CertChain != nil {
		return h.x509CertChain, true
	}
	return nil, false
}

func (h *symmetricKey) X509CertThumbprint() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x509CertThumbprint != nil {
		return *(h.x509CertThumbprint), true
	}
	return "", false
}

func (h *symmetricKey) X509CertThumbprintS256() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x509CertThumbprintS256 != nil {
		return *(h.x509CertThumbprintS256), true
	}
	return "", false
}

func (h *symmetricKey) X509URL() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x509URL != nil {
		return *(h.x509URL), true
	}
	return "", false
}

func (h *symmetricKey) Has(name string) bool {
	h.mu.RLock()
	defer h.mu.RUnlock()
	switch name {
	case KeyTypeKey:
		return true
	case AlgorithmKey:
		return h.algorithm != nil
	case KeyIDKey:
		return h.keyID != nil
	case KeyOpsKey:
		return h.keyOps != nil
	case KeyUsageKey:
		return h.keyUsage != nil
	case SymmetricOctetsKey:
		return h.octets != nil
	case X509CertChainKey:
		return h.x509CertChain != nil
	case X509CertThumbprintKey:
		return h.x509CertThumbprint != nil
	case X509CertThumbprintS256Key:
		return h.x509CertThumbprintS256 != nil
	case X509URLKey:
		return h.x509URL != nil
	default:
		_, ok := h.privateParams[name]
		return ok
	}
}

func (h *symmetricKey) Get(name string, dst any) error {
	h.mu.RLock()
	defer h.mu.RUnlock()
	switch name {
	case KeyTypeKey:
		if err := blackmagic.AssignIfCompatible(dst, h.KeyType()); err != nil {
			return fmt.Errorf(`symmetricKey.Get: failed to assign value for field %q to destination object: %w`, name, err)
		}
	case AlgorithmKey:
		if h.algorithm == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.algorithm)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case KeyIDKey:
		if h.keyID == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.keyID)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case KeyOpsKey:
		if h.keyOps == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.keyOps)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case KeyUsageKey:
		if h.keyUsage == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.keyUsage)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case SymmetricOctetsKey:
		if h.octets == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, h.octets); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case X509CertChainKey:
		if h.x509CertChain == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, h.x509CertChain); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case X509CertThumbprintKey:
		if h.x509CertThumbprint == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.x509CertThumbprint)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case X509CertThumbprintS256Key:
		if h.x509CertThumbprintS256 == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.x509CertThumbprintS256)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case X509URLKey:
		if h.x509URL == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.x509URL)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	default:
		v, ok := h.privateParams[name]
		if !ok {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, v); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
	}
	return nil
}

func (h *symmetricKey) Set(name string, value any) error {
	h.mu.Lock()
	defer h.mu.Unlock()
	return h.setNoLock(name, value)
}

func (h *symmetricKey) setNoLock(name string, value any) error {
	switch name {
	case "kty":
		return nil
	case AlgorithmKey:
		switch v := value.(type) {
		case string, jwa.SignatureAlgorithm, jwa.KeyEncryptionAlgorithm, jwa.ContentEncryptionAlgorithm:
			tmp, err := jwa.KeyAlgorithmFrom(v)
			if err != nil {
				return fmt.Errorf(`invalid algorithm for %q key: %w`, AlgorithmKey, err)
			}
			h.algorithm = &tmp
		default:
			return fmt.Errorf(`invalid type for %q key: %T`, AlgorithmKey, value)
		}
		return nil
	case KeyIDKey:
		if v, ok := value.(string); ok {
			h.keyID = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, KeyIDKey, value)
	case KeyOpsKey:
		var acceptor KeyOperationList
		if err := acceptor.Accept(value); err != nil {
			return fmt.Errorf(`invalid value for %s key: %w`, KeyOpsKey, err)
		}
		h.keyOps = &acceptor
		return nil
	case KeyUsageKey:
		switch v := value.(type) {
		case KeyUsageType:
			switch v {
			case ForSignature, ForEncryption:
				tmp := v.String()
				h.keyUsage = &tmp
			default:
				return fmt.Errorf(`invalid key usage type %s`, v)
			}
		case string:
			h.keyUsage = &v
		default:
			return fmt.Errorf(`invalid key usage type %s`, v)
		}
	case SymmetricOctetsKey:
		if v, ok := value.([]byte); ok {
			if v == nil {
				h.octets = nil
			} else {
				h.octets = make([]byte, len(v))
				copy(h.octets, v)
			}
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, SymmetricOctetsKey, value)
	case X509CertChainKey:
		if v, ok := value.(*cert.Chain); ok {
			h.x509CertChain = v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, X509CertChainKey, value)
	case X509CertThumbprintKey:
		if v, ok := value.(string); ok {
			h.x509CertThumbprint = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, X509CertThumbprintKey, value)
	case X509CertThumbprintS256Key:
		if v, ok := value.(string); ok {
			h.x509CertThumbprintS256 = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, X509CertThumbprintS256Key, value)
	case X509URLKey:
		if v, ok := value.(string); ok {
			h.x509URL = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, X509URLKey, value)
	default:
		if h.privateParams == nil {
			h.privateParams = map[string]any{}
		}
		h.privateParams[name] = value
	}
	return nil
}

func (k *symmetricKey) Remove(key string) error {
	k.mu.Lock()
	defer k.mu.Unlock()
	switch key {
	case AlgorithmKey:
		k.algorithm = nil
	case KeyIDKey:
		k.keyID = nil
	case KeyOpsKey:
		k.keyOps = nil
	case KeyUsageKey:
		k.keyUsage = nil
	case SymmetricOctetsKey:
		k.octets = nil
	case X509CertChainKey:
		k.x509CertChain = nil
	case X509CertThumbprintKey:
		k.x509CertThumbprint = nil
	case X509CertThumbprintS256Key:
		k.x509CertThumbprintS256 = nil
	case X509URLKey:
		k.x509URL = nil
	default:
		delete(k.privateParams, key)
	}
	return nil
}

func (k *symmetricKey) Clone() (Key, error) {
	key, err := cloneKey(k)
	if err != nil {
		return nil, fmt.Errorf(`symmetricKey.Clone: %w`, err)
	}
	return key, nil
}

func (k *symmetricKey) DecodeCtx() json.DecodeCtx {
	k.mu.RLock()
	defer k.mu.RUnlock()
	return k.dc
}

func (k *symmetricKey) SetDecodeCtx(dc json.DecodeCtx) {
	k.mu.Lock()
	defer k.mu.Unlock()
	k.dc = dc
}

func (h *symmetricKey) UnmarshalJSON(buf []byte) (retErr error) {
	h.mu.Lock()
	defer h.mu.Unlock()
	h.algorithm = nil
	h.keyID = nil
	h.keyOps = nil
	h.keyUsage = nil
	h.octets = nil
	h.x509CertChain = nil
	h.x509CertThumbprint = nil
	h.x509CertThumbprintS256 = nil
	h.x509URL = nil
	defer func() {
		if retErr != nil {
			clear(h.octets)
			h.octets = nil
		}
	}()
	dec := json.NewDecoder(bytes.NewReader(buf))
LOOP:
	for {
		tok, err := dec.Token()
		if err != nil {
			return fmt.Errorf(`error reading token: %w`, err)
		}
		switch tok := tok.(type) {
		case json.Delim:
			// Assuming we're doing everything correctly, we should ONLY
			// get either tokens.OpenCurlyBracket or tokens.CloseCurlyBracket here.
			if tok == tokens.CloseCurlyBracket { // End of object
				break LOOP
			} else if tok != tokens.OpenCurlyBracket {
				return fmt.Errorf(`expected '%c' but got '%c'`, tokens.OpenCurlyBracket, tok)
			}
		case string: // Objects can only have string keys
			switch tok {
			case KeyTypeKey:
				val, err := json.ReadNextStringToken(dec, h.dc)
				if err != nil {
					return fmt.Errorf(`error reading token: %w`, err)
				}
				if val != jwa.OctetSeq().String() {
					return fmt.Errorf(`invalid kty value for RSAPublicKey (%s)`, val)
				}
			case AlgorithmKey:
				var s string
				if err := dec.Decode(&s); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, AlgorithmKey, err)
				}
				alg, err := jwa.KeyAlgorithmFrom(s)
				if err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, AlgorithmKey, err)
				}
				h.algorithm = &alg
			case KeyIDKey:
				if err := json.AssignNextStringToken(&h.keyID, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, KeyIDKey, err)
				}
			case KeyOpsKey:
				var decoded KeyOperationList
				if err := dec.Decode(&decoded); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, KeyOpsKey, err)
				}
				h.keyOps = &decoded
			case KeyUsageKey:
				if err := json.AssignNextStringToken(&h.keyUsage, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, KeyUsageKey, err)
				}
			case SymmetricOctetsKey:
				if err := json.AssignNextBytesToken(&h.octets, dec); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, SymmetricOctetsKey, err)
				}
			case X509CertChainKey:
				var decoded cert.Chain
				if err := dec.Decode(&decoded); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, X509CertChainKey, err)
				}
				h.x509CertChain = &decoded
			case X509CertThumbprintKey:
				if err := json.AssignNextStringToken(&h.x509CertThumbprint, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, X509CertThumbprintKey, err)
				}
			case X509CertThumbprintS256Key:
				if err := json.AssignNextStringToken(&h.x509CertThumbprintS256, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, X509CertThumbprintS256Key, err)
				}
			case X509URLKey:
				if err := json.AssignNextStringToken(&h.x509URL, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, X509URLKey, err)
				}
			default:
				if dc := h.dc; dc != nil {
					if localReg := dc.Registry(); localReg != nil {
						decoded, err := localReg.Decode(dec, tok)
						if err == nil {
							h.setNoLock(tok, decoded)
							continue
						}
					}
				}
				decoded, err := fieldRegistry.Decode(dec, tok)
				if err == nil {
					h.setNoLock(tok, decoded)
					continue
				}
				return fmt.Errorf(`could not decode field %s: %w`, tok, err)
			}
		default:
			return fmt.Errorf(`invalid token %T`, tok)
		}
	}
	if h.octets == nil {
		return fmt.Errorf(`required field k is missing`)
	}
	return nil
}

func (h *symmetricKey) makePairs() ([]fieldPair, error) {
	pairs := getFieldPairList()
	h.mu.RLock()
	defer h.mu.RUnlock()
	{
		v, err := json.Marshal(jwa.OctetSeq())
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, KeyTypeKey, err)
		}
		pairs = append(pairs, fieldPair{Name: KeyTypeKey, Value: v})
	}
	if h.algorithm != nil {
		v, err := json.Marshal(*(h.algorithm))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, AlgorithmKey, err)
		}
		pairs = append(pairs, fieldPair{Name: AlgorithmKey, Value: v})
	}
	if h.keyID != nil {
		v, err := json.Marshal(*(h.keyID))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, KeyIDKey, err)
		}
		pairs = append(pairs, fieldPair{Name: KeyIDKey, Value: v})
	}
	if h.keyOps != nil {
		v, err := json.Marshal(*(h.keyOps))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, KeyOpsKey, err)
		}
		pairs = append(pairs, fieldPair{Name: KeyOpsKey, Value: v})
	}
	if h.keyUsage != nil {
		v, err := json.Marshal(*(h.keyUsage))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, KeyUsageKey, err)
		}
		pairs = append(pairs, fieldPair{Name: KeyUsageKey, Value: v})
	}
	if h.octets != nil {
		v, err := json.Marshal(base64.EncodeToString(h.octets))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, SymmetricOctetsKey, err)
		}
		pairs = append(pairs, fieldPair{Name: SymmetricOctetsKey, Value: v})
	}
	if h.x509CertChain != nil {
		v, err := json.Marshal(h.x509CertChain)
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, X509CertChainKey, err)
		}
		pairs = append(pairs, fieldPair{Name: X509CertChainKey, Value: v})
	}
	if h.x509CertThumbprint != nil {
		v, err := json.Marshal(*(h.x509CertThumbprint))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, X509CertThumbprintKey, err)
		}
		pairs = append(pairs, fieldPair{Name: X509CertThumbprintKey, Value: v})
	}
	if h.x509CertThumbprintS256 != nil {
		v, err := json.Marshal(*(h.x509CertThumbprintS256))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, X509CertThumbprintS256Key, err)
		}
		pairs = append(pairs, fieldPair{Name: X509CertThumbprintS256Key, Value: v})
	}
	if h.x509URL != nil {
		v, err := json.Marshal(*(h.x509URL))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, X509URLKey, err)
		}
		pairs = append(pairs, fieldPair{Name: X509URLKey, Value: v})
	}
	for k, v := range h.privateParams {
		var encoded []byte
		switch v := v.(type) {
		case []byte:
			var err error
			encoded, err = json.Marshal(base64.EncodeToString(v))
			if err != nil {
				return nil, fmt.Errorf(`failed to marshal field %q: %w`, k, err)
			}
		default:
			var err error
			encoded, err = json.Marshal(v)
			if err != nil {
				return nil, fmt.Errorf(`failed to marshal field %q: %w`, k, err)
			}
		}
		pairs = append(pairs, fieldPair{Name: k, Value: encoded})
	}

	sort.Slice(pairs, func(i, j int) bool {
		return pairs[i].Name < pairs[j].Name
	})

	return pairs, nil
}

func (h *symmetricKey) MarshalJSON() ([]byte, error) {
	buf := pool.BytesBuffer().Get()
	defer pool.BytesBuffer().Put(buf)
	pairs, err := h.makePairs()
	if err != nil {
		return nil, fmt.Errorf(`failed to make pairs: %w`, err)
	}
	buf.WriteByte(tokens.OpenCurlyBracket)

	for i, pair := range pairs {
		if i > 0 {
			buf.WriteByte(tokens.Comma)
		}
		if err := json.WriteQuotedKey(buf, pair.Name); err != nil {
			return nil, fmt.Errorf(`failed to encode field name %q: %w`, pair.Name, err)
		}
		buf.Write(pair.Value.([]byte))
	}
	buf.WriteByte(tokens.CloseCurlyBracket)
	ret := make([]byte, buf.Len())
	copy(ret, buf.Bytes())
	putFieldPairList(pairs)
	return ret, nil
}

func (h *symmetricKey) Keys() []string {
	h.mu.RLock()
	defer h.mu.RUnlock()
	keys := make([]string, 0, 9+len(h.privateParams))
	keys = append(keys, KeyTypeKey)
	if h.algorithm != nil {
		keys = append(keys, AlgorithmKey)
	}
	if h.keyID != nil {
		keys = append(keys, KeyIDKey)
	}
	if h.keyOps != nil {
		keys = append(keys, KeyOpsKey)
	}
	if h.keyUsage != nil {
		keys = append(keys, KeyUsageKey)
	}
	if h.octets != nil {
		keys = append(keys, SymmetricOctetsKey)
	}
	if h.x509CertChain != nil {
		keys = append(keys, X509CertChainKey)
	}
	if h.x509CertThumbprint != nil {
		keys = append(keys, X509CertThumbprintKey)
	}
	if h.x509CertThumbprintS256 != nil {
		keys = append(keys, X509CertThumbprintS256Key)
	}
	if h.x509URL != nil {
		keys = append(keys, X509URLKey)
	}
	for k := range h.privateParams {
		keys = append(keys, k)
	}
	return keys
}

var symmetricStandardFields KeyFilter

func init() {
	symmetricStandardFields = NewFieldNameFilter(KeyTypeKey, KeyUsageKey, KeyOpsKey, AlgorithmKey, KeyIDKey, X509URLKey, X509CertChainKey, X509CertThumbprintKey, X509CertThumbprintS256Key, SymmetricOctetsKey)
}

// SymmetricStandardFieldsFilter returns a KeyFilter that filters out standard Symmetric fields.
func SymmetricStandardFieldsFilter() KeyFilter {
	return symmetricStandardFields
}

func init() {
	registry.Register(jwa.OctetSeq().String(), registry.Constructor{
		Private: func() any { return newSymmetricKey() },
	})
}