/*
   Copyright 2018 Conor Patrick

   Permission is hereby granted, free of charge, to any person obtaining a copy of
   this software and associated documentation files (the "Software"), to deal in
   the Software without restriction, including without limitation the rights to
   use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
   of the Software, and to permit persons to whom the Software is furnished to do
   so, subject to the following conditions:

   The above copyright notice and this permission notice shall be included in all
   copies or substantial portions of the Software.

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
   AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
   SOFTWARE.
*/
DEVELOPMENT = 0;

var to_b58 = function(B){var A="123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";var d=[],s="",i,j,c,n;for(i in B){j=0,c=B[i];s+=c||s.length^i?"":1;while(j in d||c){n=d[j];n=n?n*256+c:c;c=n/58|0;d[j]=n%58;j++}}while(j--)s+=A[d[j]];return s};
var from_b58 = function(S){var A="123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";var d=[],b=[],i,j,c,n;for(i in S){j=0,c=A.indexOf(S[i]);if(c<0)throw new Error('Invald b58 character');c||b.length^i?i:b.push(0);while(j in d||c){n=d[j];n=n?n*58+c:c;c=n>>8;d[j]=n%256;j++}}while(j--)b.push(d[j]);return new Uint8Array(b)};

// Calculate the Shannon entropy of a string in bits per symbol.
// https://gist.github.com/jabney/5018b4adc9b2bf488696
(function(shannon) {
    'use strict';

    // Create a dictionary of character frequencies and iterate over it.
    function process(s, evaluator) {
        var h = Object.create(null), k;
        s.split('').forEach(function(c) {
            h[c] && h[c]++ || (h[c] = 1); });
        if (evaluator) for (k in h) evaluator(k, h[k]);
        return h;
    };

    // Measure the entropy of a string in bits per symbol.
    shannon.entropy = function(s) {
        var sum = 0,len = s.length;
        process(s, function(k, f) {
            var p = f/len;
            sum -= p * Math.log(p) / Math.log(2);
        });
        return sum;
    };

    // Measure the entropy of a string in total bits.
    shannon.bits = function(s) {
        return shannon.entropy(s) * s.length;
    };

    // Log the entropy of a string to the console.
    shannon.log = function(s) {
        console.log('Entropy of "' + s + '" in bits per symbol:', shannon.entropy(s));
    };
})(window.shannon = window.shannon || Object.create(null));

function hex(byteArray, join) {
  if (join === undefined) join = ' ';
  return Array.from(byteArray, function(byte) {
    return ('0' + (byte & 0xFF).toString(16)).slice(-2);
  }).join(join)
}

// Convert from normal to web-safe, strip trailing "="s
function webSafe64(base64) {
    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
}

// Convert from web-safe to normal, add trailing "="s
function normal64(base64) {
    return base64.replace(/\-/g, '+').replace(/_/g, '/') + '=='.substring(0, (3*base64.length)%4);
}

function websafe2array(base64) {
    var binary_string =  window.atob(normal64(base64));
    var len = binary_string.length;
    var bytes = new Uint8Array( len );
    for (var i = 0; i < len; i++)        {
        bytes[i] = binary_string.charCodeAt(i);
    }
    return bytes;
}

function array2websafe(array) {
    var result = "";
    for(var i = 0; i < array.length; ++i){
        result+= (String.fromCharCode(array[i]));
    }
    return webSafe64(window.btoa(result));
}

function string2websafe(string) {
    return webSafe64(window.btoa(string));
}
function websafe2string(string) {
    return window.atob(normal64(string));
}
function string2array(string) {

    var bytes = new Uint8Array( string.length );

    for (var i = 0; i < string.len; i++) {
        bytes[i] = string.charCodeAt(i);
    }

    return bytes;
}
function hex2array(string)
{
    if (string.slice(0,2) == '0x')
    {
        string = string.slice(2,string.length);
    }
    if (string.length & 1)
    {
        throw new Error('Odd length hex string');
    }
    var arr = new Uint8Array(string.length/2);
    var i;
    for (i = 0; i < string.length; i+=2)
    {
        arr[i/2] = parseInt(string.slice(i,i+2),16);
    }
    return arr;
}


// @key input private key in hex string format
function key2wif(key)
{
    //2
    key = '0x80' + key;

    bin = hex2array(key);

    //3
    var hash = sha256.create();
    hash.update(bin);
    bin = hash.array();

    //4
    hash = sha256.create();
    hash.update(bin);
    bin = hash.array();

    // 5
    var chksum = bin.slice(0,4);

    // 6
    key = key + array2hex(chksum);

    // 7
    key = hex2array(key);
    key = to_b58(key);

    return key;
}



function array2hex(buffer) {
  return Array.prototype.map.call(new Uint8Array(buffer), x => ('00' + x.toString(16)).slice(-2)).join('');
}

// https://stackoverflow.com/questions/18729405/how-to-convert-utf8-string-to-byte-array
function toUTF8Array(str) {
    var utf8 = [];
    for (var i=0; i < str.length; i++) {
        var charcode = str.charCodeAt(i);
        if (charcode < 0x80) utf8.push(charcode);
        else if (charcode < 0x800) {
            utf8.push(0xc0 | (charcode >> 6), 
                      0x80 | (charcode & 0x3f));
        }
        else if (charcode < 0xd800 || charcode >= 0xe000) {
            utf8.push(0xe0 | (charcode >> 12), 
                      0x80 | ((charcode>>6) & 0x3f), 
                      0x80 | (charcode & 0x3f));
        }
        // surrogate pair
        else {
            i++;
            // UTF-16 encodes 0x10000-0x10FFFF by
            // subtracting 0x10000 and splitting the
            // 20 bits of 0x0-0xFFFFF into two halves
            charcode = 0x10000 + (((charcode & 0x3ff)<<10)
                      | (str.charCodeAt(i) & 0x3ff));
            utf8.push(0xf0 | (charcode >>18), 
                      0x80 | ((charcode>>12) & 0x3f), 
                      0x80 | ((charcode>>6) & 0x3f), 
                      0x80 | (charcode & 0x3f));
        }
    }
    return utf8;
}
function error2string(err)
{
    var lut = {     // Only some of these are used
        0x00 : 'CTAP1_SUCCESS',
        0x01 : 'CTAP1_ERR_INVALID_COMMAND',
        0x02 : 'CTAP1_ERR_INVALID_PARAMETER',
        0x03 : 'CTAP1_ERR_INVALID_LENGTH',
        0x04 : 'CTAP1_ERR_INVALID_SEQ',
        0x05 : 'CTAP1_ERR_TIMEOUT',
        0x06 : 'CTAP1_ERR_CHANNEL_BUSY',
        0x0A : 'CTAP1_ERR_LOCK_REQUIRED',
        0x0B : 'CTAP1_ERR_INVALID_CHANNEL',
        0x10 : 'CTAP2_ERR_CBOR_PARSING',
        0x11 : 'CTAP2_ERR_CBOR_UNEXPECTED_TYPE',
        0x12 : 'CTAP2_ERR_INVALID_CBOR',
        0x13 : 'CTAP2_ERR_INVALID_CBOR_TYPE',
        0x14 : 'CTAP2_ERR_MISSING_PARAMETER',
        0x15 : 'CTAP2_ERR_LIMIT_EXCEEDED',
        0x16 : 'CTAP2_ERR_UNSUPPORTED_EXTENSION',
        0x17 : 'CTAP2_ERR_TOO_MANY_ELEMENTS',
        0x18 : 'CTAP2_ERR_EXTENSION_NOT_SUPPORTED',
        0x19 : 'CTAP2_ERR_CREDENTIAL_EXCLUDED',
        0x20 : 'CTAP2_ERR_CREDENTIAL_NOT_VALID',
        0x21 : 'CTAP2_ERR_PROCESSING',
        0x22 : 'CTAP2_ERR_INVALID_CREDENTIAL',
        0x23 : 'CTAP2_ERR_USER_ACTION_PENDING',
        0x24 : 'CTAP2_ERR_OPERATION_PENDING',
        0x25 : 'CTAP2_ERR_NO_OPERATIONS',
        0x26 : 'CTAP2_ERR_UNSUPPORTED_ALGORITHM',
        0x27 : 'CTAP2_ERR_OPERATION_DENIED',
        0x28 : 'CTAP2_ERR_KEY_STORE_FULL',
        0x29 : 'CTAP2_ERR_NOT_BUSY',
        0x2A : 'CTAP2_ERR_NO_OPERATION_PENDING',
        0x2B : 'CTAP2_ERR_UNSUPPORTED_OPTION',
        0x2C : 'CTAP2_ERR_INVALID_OPTION',
        0x2D : 'CTAP2_ERR_KEEPALIVE_CANCEL',
        0x2E : 'CTAP2_ERR_NO_CREDENTIALS',
        0x2F : 'CTAP2_ERR_USER_ACTION_TIMEOUT',
        0x30 : 'CTAP2_ERR_NOT_ALLOWED',
        0x31 : 'CTAP2_ERR_PIN_INVALID',
        0x32 : 'CTAP2_ERR_PIN_BLOCKED',
        0x33 : 'CTAP2_ERR_PIN_AUTH_INVALID',
        0x34 : 'CTAP2_ERR_PIN_AUTH_BLOCKED',
        0x35 : 'CTAP2_ERR_PIN_NOT_SET',
        0x36 : 'CTAP2_ERR_PIN_REQUIRED',
        0x37 : 'CTAP2_ERR_PIN_POLICY_VIOLATION',
        0x38 : 'CTAP2_ERR_PIN_TOKEN_EXPIRED',
        0x39 : 'CTAP2_ERR_REQUEST_TOO_LARGE',
    }
    return lut[err]
}

var CMD = {
    sign: 0x10,
    register: 0x11,
    pin: 0x12,
    reset: 0x13,
    version: 0x14,
    rng: 0x15,
    pubkey: 0x16,
    boot_write: 0x40,
    boot_done: 0x41,
    boot_check: 0x42,
    boot_erase: 0x43,
};

var PIN = {
    getRetries: 0x01,
    getKeyAgreement: 0x02,
    setPin: 0x03,
    changePin: 0x04,
    getPinToken: 0x05,
};

// Create XHR object.
function createCORSRequest(method, url) {
    var xhr = new XMLHttpRequest();
    if ("withCredentials" in xhr) {
        // XHR for Chrome/Firefox/Opera/Safari.
        xhr.open(method, url, true);
    } else if (typeof XDomainRequest != "undefined") {
        // XDomainRequest for IE.
        xhr = new XDomainRequest();
        xhr.open(method, url);
    } else {
        // CORS not supported.
        xhr = null;
    }
    return xhr;
}

function parse_device_response(arr)
{
    var dataview = new DataView(arr.slice(1,5).buffer);

    count = dataview.getUint32(0,true); // get count as 32 bit LE integer

    data = null;
    if (arr[5] == 0) {
        data = arr.slice(6,arr.length);

    }
    return {count: count, status: error2string(arr[5]), data: data};
}



// For development purposes
function send_msg_http(data, func, timeout) {
    var url = 'https://localhost:8080';

    var req = JSON.stringify({data: array2websafe(data)});

    var xhr = createCORSRequest('POST', url);

    if (!xhr) {
        console.log('CORS not supported');
        return;
    }

    // Response handlers.
    xhr.onload = function() {
        var text = xhr.responseText;
        var resp = JSON.parse(text);
        arr = websafe2array(resp.data);
        data = parse_device_response(arr);
        if (func) func(data);
    };

    xhr.onerror = function() {
        console.log('Woops, there was an error making the request.');
    };

    xhr.send(req);
}

function get_firmware_http_(func) {
    var url = 'https://localhost:8080';

    var xhr = createCORSRequest('GET', url);

    if (!xhr) {
        console.log('CORS not supported');
        return;
    }

    // Response handlers.
    xhr.onload = function() {
        var text = xhr.responseText;
        var resp = JSON.parse(text);
        resp.firmware = websafe2string(resp.firmware);
        if (func) func(resp);
    };

    xhr.onerror = function() {
        console.log('Woops, there was an error making the request.');
    };

    xhr.send();
}

// For real
function send_msg_u2f(data, func, timeout) {
    // Use key handle and signature response as comm channel
    var d = new Date();
    var t1 = d.getTime();
    timeout = timeout || 5;

    var appid = window.location.origin;
    //var chal = string2websafe('AABBCC');

    var chal = array2websafe(hex2array('d1cd7357bcedc03fcec112fe5a7f3f890292ff6f758978928b736ce1e63479e5'));

    var args = {
        type: 'navigator.id.getAssertion',
        challenge: chal,
        origin: appid
    };

    var keyHandle = array2websafe(data);

    var key = {
        version: 'U2F_V2',
        keyHandle: keyHandle,
        transports: [],
        appId: appid
    };


    window.u2f.sign(appid,chal,[key], function(res){

        var d2 = new Date();
        t2 = d2.getTime();
        if (!res.signatureData)
            func(res);
        sig = websafe2array(res.signatureData)
        data = parse_device_response(sig);
        func(data);

    },timeout);
}

var send_msg;
if (DEVELOPMENT) {
    send_msg = send_msg_http;
} else {
    send_msg = send_msg_u2f;
}

function formatBootRequest(cmd, addr, data) {
    var array = new Uint8Array(255);

    if (addr == undefined)
        addr = 0x8000;

    data = data || new Uint8Array(1);

    if (data.length > (255 - 9)) {
        throw new Error("Max size exceeded");
    }

    array[0] = cmd & 0xff;
    array[1] = (addr >> 0) & 0xff;
    array[2] = (addr >> 8) & 0xff;
    array[3] = (addr >> 16) & 0xff;

    array[4] = 0x8C;    // Wallet tag.  To not interfere with U2F devices.
    array[5] = 0x27;
    array[6] = 0x90;
    array[7] = 0xf6;

    array[8] = data.length & 0xff;

    var offset = 9;

    var i;
    for (i = 0; i < data.length; i++){
        array[offset + i] = data[i];
    }
    return array;
}

// Format a request message
// @cmd 0-255 value command
// @p1,p2 optional "sub" commands/arguments, each 0-255 valued.
// @pinAuth 16 byte Uint8Array needed for most commands to authorize command
// @args array of Uint8Arrays, arguments for the command being run
function formatRequest(cmd, p1, p2, pinAuth, args) {
    var argslen = 0;
    var i,j;
    args = args || [];
    for (i = 0; i < args.length; i+=1) {
        argslen += args[i].length + 1
    }
    var len = 16 + 4 + 4 +argslen;

    if (len > 255)
    {
        throw new Error('Total length of request cannot exceed 255 bytes');
    }

    var array = new Uint8Array(len);

    array[0] = cmd & 0xff;
    array[1] = p1 & 0xff;
    array[2] = p2 & 0xff;
    array[3] = (args.length) & 0xff;

    array[4] = 0x8C;    // Wallet tag.  To not interfere with U2F devices.
    array[5] = 0x27;
    array[6] = 0x90;
    array[7] = 0xf6;

    var offset = 8;

    if (pinAuth) {
        for (i = 0; i < 16; i += 1) {
            array[offset + i] = pinAuth[i];
        }
    }

    offset = offset + i;

    for (i = 0; i < args.length; i += 1) {
        array[offset] = args[i].length;
        offset += 1
        for (j = 0; j < args[i].length; j += 1) {
            array[offset] = args[i][j];
            offset += 1
        }
    }
    return array;
}

// Computes sha256 HMAC
// @pinToken is key for HMAC
// @cmd,p1,p2 each are bytes input to HMAC
// @args array of Uint8Arrays input to HMAC
// @return first 16 bytes of HMAC
function computePinAuth(pinToken, cmd,p1,p2,args)
{
    var hmac = sha256.hmac.create(pinToken);
    var i;
    hmac.update([cmd]);
    hmac.update([p1]);
    hmac.update([p2]);
    if (args && args.length) hmac.update([args.length]);
    else hmac.update([0]);

    hmac.update([0x8c,0x27,0x90,0xf6]);

    if (args) {
        for (i = 0; i < args.length; i++)
        {
            hmac.update([args[i].length]);
            hmac.update(args[i]);
        }
    }

    return hmac.array().slice(0,16)
}

function computePinAuthRaw(pinToken, data)
{
    var hmac = sha256.hmac.create(pinToken);
    hmac.update(data);
    return hmac.array().slice(0,16)
}

// @sigAlg is a number 0-255
// @pinAuth token, see pinToken information.  Uint8Array
// @challenge is websafe base64 string.  Data to be signed.
// @keyid is optional, websafe base64 string
function signRequestFormat(sigAlg,pinToken,challenge,keyid) {
// Sign request
// Field                Value               length
// op:                  0x10                1
// authType:            sigAlg              1
// reserved:            0x00                1
// pinHashEnc:          [dynamic]           16
// challenge-length:    challenge.length    1
// challenge:           challenge           1-234
// keyID-length:        keyid.length        1
// keyID:               keyid               0-233
// Note: total size must not exceed 255 bytes

    var cmd = CMD.sign;
    var p1 = sigAlg;
    var p2 = 0;

    if (typeof(challenge) == 'string')
    {
        challenge = websafe2array(challenge);
    }

    var args = [challenge];
    if (keyid) args.push(keyid)

    var pinAuth;

    if (pinToken) pinAuth = computePinAuth(pinToken,cmd,p1,p2,args);
    else pinAuth = new Uint8Array(16);

    var req = formatRequest(cmd,p1,p2,pinAuth,args);

    return req;
}

// @wifkey is wif key in base58 format string
function registerRequestFormat(wifkey, pinToken) {

    var cmd = CMD.register;
    var p1 = 0;
    var p2 = 0;
    var keyarr = from_b58(wifkey);
    var args = [keyarr];

    var pinAuth;

    if (pinToken) pinAuth = computePinAuth(pinToken,cmd,p1,p2,args);
    else pinAuth = new Uint8Array(16);

    var req = formatRequest(cmd,p1,p2,pinAuth,args);

    return req;
}

// @subCmd is one of the following in PIN {}
function pinRequestFormat(subcmd, pinAuth, pubkey, pinEnc, pinHashEnc) {

    var cmd = CMD.pin;
    var p1 = subcmd;
    var p2 = 0;
    //var args = [challenge];
    //if (keyid) args.push(keyid)
    pinAuth = pinAuth || new Uint8Array(16);
    var args = [];

    if (pubkey) args.push(pubkey);
    if (pinEnc) args.push(pinEnc);
    if (pinHashEnc) args.push(pinHashEnc);

    //var pinAuth = computePinAuth(pinToken,cmd,p1,p2,args);
    //console.log(hex(pinAuth));
    var req = formatRequest(cmd,p1,p2,pinAuth,args);

    return req;
}

var get_shared_secret_ = function(func) {
    // Get temporary pubkey from device to compute shared secret
    var req = pinRequestFormat(PIN.getKeyAgreement);
    var self = this;
    send_msg(req, function(resp){

        if (resp.status == 'CTAP1_SUCCESS') {
            var i;

            var devicePubkeyHex = '04'+hex(resp.data,'');
            var devicePubkey = self.ecp256.keyFromPublic(devicePubkeyHex,'hex');

            // Generate a new key pair for shared secret
            var platform_keypair = self.ecp256.genKeyPair();
            self.platform_keypair = platform_keypair;


            // shared secret
            var shared = platform_keypair.derive(devicePubkey.getPublic()).toArray();
            var hash = sha256.create();
            hash.update(shared);
            shared = hash.array();

            resp.data = shared;
        }
        if (func) func(resp);

    });
};

var authenticate_ = function(pin, func){
    if (! this.shared_secret){
        throw new Error('Device is not connected.');
    }
    hash = sha256.create();
    hash.update(toUTF8Array(pin));
    pinHash = hash.array().slice(0,16);

    var iv = new Uint8Array(16);
    iv.fill(0);

    var aesCbc = new aesjs.ModeOfOperation.cbc(this.shared_secret, iv);
    pinHashEnc = aesCbc.encrypt(pinHash);


    var ourPubkey = this.platform_keypair.getPublic(undefined, 'hex');
    var ourPubkeyBytes = hex2array(ourPubkey.slice(2,ourPubkey.length));


    var req = pinRequestFormat(PIN.getPinToken, pinHashEnc, ourPubkeyBytes);


    var self = this;

    send_msg(req, function(resp){
        var aesCbc = new aesjs.ModeOfOperation.cbc(self.shared_secret, iv);
        var pinTokenEnc = resp.data;
        if  (resp.status == 'CTAP1_SUCCESS') {
            var pinToken = aesCbc.decrypt(pinTokenEnc);
            self.pinToken = pinToken;
            if (func) func({pinToken: pinToken, status: resp.status});
        }   else {

            self.init(function(){
                if (func) func(resp);
            });
        }
    });
};

function pin2bytes(pin){
    var pinBytes = toUTF8Array(pin);

    var encLen = pinBytes.length + (16-(pinBytes.length % 16));

    if (encLen < 64){
        encLen = 64;
    }

    if (pin.length < 4){
        throw Error('FIDO2 pin must be at least 4 unicode characters.');
    }
    if (encLen > 255){
        throw Error('FIDO2 pin may not exceed 255 bytes');
    }
    if (encLen > 80){
        throw Error('Recommended to not use pins longer than 80 bytes due to 255 byte max message size.');
    }


    var pinBytesPadded = new Uint8Array(encLen);
    pinBytesPadded.fill(0);

    var i;
    for (i = 0; i < pinBytes.length; i++){
        pinBytesPadded[i] = pinBytes[i];
    }

    return pinBytesPadded;
}

var set_pin_ = function(pin, failAuth, func){
    var subcmd = PIN.setPin;

    var pinBytesPadded = pin2bytes(pin);
    var encLen = pinBytesPadded.length;

    var iv = new Uint8Array(16);
    iv.fill(0);

    var aesCbc = new aesjs.ModeOfOperation.cbc(this.shared_secret, iv);
    pinEnc = aesCbc.encrypt(pinBytesPadded);

    var pinAuth = computePinAuthRaw(this.shared_secret, pinEnc);

    if (func == undefined && typeof failAuth == 'function'){
        func = failAuth;
        failAuth = false;
    }

    if (failAuth){
        pinAuth.fill(0xAA);
        pinEnc.fill(0xAA);
    }

    var ourPubkey = this.platform_keypair.getPublic(undefined, 'hex');
    var ourPubkeyBytes = hex2array(ourPubkey.slice(2,ourPubkey.length));

    var req = pinRequestFormat(subcmd, pinAuth, ourPubkeyBytes, pinEnc);

    send_msg(req, function(resp){
        if (func) func(resp);
    });
}

var is_pin_set_ = function(func)
{
    this.set_pin('12345', true, function(resp){
        if (resp.status == "CTAP2_ERR_NOT_ALLOWED") {
            func({data:true, status: 'CTAP1_SUCCESS'});
        }
        else if (resp.status == "CTAP2_ERR_PIN_AUTH_INVALID"){
            func({data:false, status: 'CTAP1_SUCCESS'});
        }
        else {
            func({data: undefined, status: resp.status});
            //throw new Error("Device returned expected status: " + stat);
        }
    });
}

var change_pin_ = function(curpin, newpin, func, failAuth){
    var subcmd = PIN.changePin;

    pin2bytes(curpin);  // validation only

    var pinBytesPadded = pin2bytes(newpin);
    var encLen = pinBytesPadded.length;


    var iv = new Uint8Array(16);
    iv.fill(0);

    var aesCbc = new aesjs.ModeOfOperation.cbc(this.shared_secret, iv);
    newPinEnc = aesCbc.encrypt(pinBytesPadded);

    var hash = sha256.create();
    hash.update(toUTF8Array(curpin));
    curPinHash = hash.array().slice(0,16);

    aesCbc = new aesjs.ModeOfOperation.cbc(this.shared_secret, iv);
    curPinHashEnc = aesCbc.encrypt(curPinHash);

    var concat = new Uint8Array(newPinEnc.length + curPinHashEnc.length);
    concat.set(newPinEnc);
    concat.set(curPinHashEnc, newPinEnc.length);

    var pinAuth = computePinAuthRaw(this.shared_secret, concat);

    var ourPubkey = this.platform_keypair.getPublic(undefined, 'hex');
    var ourPubkeyBytes = hex2array(ourPubkey.slice(2,ourPubkey.length));

    var req = pinRequestFormat(subcmd, pinAuth, ourPubkeyBytes, newPinEnc, curPinHashEnc);

    send_msg(req, function(resp){
        if (func) func(resp);
    });
}

var get_retries_ = function(func){
    var subcmd = PIN.getRetries;

    var req = pinRequestFormat(subcmd);

    send_msg(req, function(resp){
        resp.data = resp.data[0];
        if (func) func(resp);
    });
}

var sign_ = function(obj, func){

    if (!obj.challenge)
        throw new Error("Need something to sign");

    var alg = obj.alg || 3;

    var pinToken = this.pinToken || undefined;

    var req = signRequestFormat(alg,pinToken,obj.challenge,obj.keyid);

    send_msg(req, function(resp){
        if (resp.status == 'CTAP1_SUCCESS') {
            var r = resp.data.slice(0,32);
            var s = resp.data.slice(32,64);
            r = array2hex(r);
            s = array2hex(s);
            resp.sig = {};
            resp.sig.r = r;
            resp.sig.s = s;
        }


        if (func) func(resp);
    });
};

var register_ = function(wifkey, func){

    if (!wifkey)
        throw new Error("No key provided");


    var req = registerRequestFormat(wifkey,this.pinToken);

    send_msg(req, function(resp){
        if (func) func(resp);
    });
};

// @note authorization required beforehand if device is not already locked.
var reset_ = function(func){

    var pinAuth = undefined;

    if (this.pinToken) {
        pinAuth = computePinAuth(this.pinToken, CMD.reset, 0, 0);
    }

    var req = formatRequest(CMD.reset,0,0, pinAuth);

    var self = this;

    send_msg(req, function(resp){
        if (resp.status == "CTAP1_SUCCESS")
        {
            self.init(function(resp){
                if (func)func(resp);
            });
        }
        else {
            if (func) func(resp);
        }
    });
};


// Read 72 random bytes from hardware RNG on device
var get_rng_ = function(func){

    var pinAuth = undefined;

    if (this.pinToken) {
        pinAuth = computePinAuth(this.pinToken, CMD.rng, 0, 0);
    }

    var req = formatRequest(CMD.rng,0,0, pinAuth);

    var self = this;

    send_msg(req, function(resp){
        if (func)func(resp);
    });
};

// Derive public key from the private key stored on device.  Returns X,Y point.  64 bytes.
var get_pubkey_ = function(func){

    var pinAuth = undefined;

    if (this.pinToken) {
        pinAuth = computePinAuth(this.pinToken, CMD.pubkey, 0, 0);
    }

    var req = formatRequest(CMD.pubkey,0,0, pinAuth);

    var self = this;

    send_msg(req, function(resp){
        if (func)func(resp);
    });
};

var is_bootloader_ = function(func){

    var req = formatBootRequest(CMD.boot_check);

    var self = this;

    send_msg(req, function(resp){
        if (func)func(resp);
    });
};

var bootloader_finish_ = function(sig,func){

    var req = formatBootRequest(CMD.boot_done, 0x8000, sig);

    send_msg(req, function(resp){
        if (func)func(resp);
    });
};

var bootloader_write_ = function(addr,data,func){

    var req = formatBootRequest(CMD.boot_write,addr,data);

    send_msg(req, function(resp){
        if (func)func(resp);
    });
};


function wrap_promise(func)
{
    var self = this;
    return function (){
        var args = arguments;
        return new Promise(function(resolve,reject){
            var i;
            var oldfunc = null;
            for (i = 0; i < args.length; i++)
            {
                if (typeof args[i] == 'function')
                {
                    oldfunc = args[i];
                    args[i] = function(){
                        oldfunc.apply(self,arguments);
                        resolve.apply(self,arguments);
                    };
                    break;
                }
            }
            if (oldfunc === null)
            {
                args = Array.prototype.slice.call(args);
                args.push(function(){
                        resolve.apply(self,arguments);
                    });
            }
            func.apply(self,args);
        });
    }
}

var get_firmware_http = wrap_promise(get_firmware_http_);

function WalletDevice() {
    var self = this;
    this.shared_secret = null;
    this.ec256k1 = new EC('secp256k1');
    this.ecp256 = new EC('p256');


    this.init = function(func){
        self.get_version(function(ver){
            self.version = ver;
            self.get_shared_secret(function(resp){
                if (resp.status == "CTAP1_SUCCESS") self.shared_secret = resp.data;
                else {
                }
                if (func) func(resp);
            });
        });
    };


    this.get_version = function(func){
        var req = formatRequest(CMD.version,0,0);
        send_msg(req, function(resp){
            var ver = new TextDecoder("utf-8").decode(resp.data);
            if (func) func(ver);
        });
    };

    this.get_shared_secret = get_shared_secret_;

    // getPinToken using set pin
    this.authenticate = authenticate_;

    this.sign = sign_;

    this.set_pin = set_pin_;

    this.is_pin_set = is_pin_set_;

    this.change_pin = change_pin_;

    this.get_retries = get_retries_;

    this.register = register_;

    this.reset = reset_;

    this.get_rng = get_rng_;

    this.get_pubkey = get_pubkey_;

    this.is_bootloader = is_bootloader_;

    this.bootloader_write = bootloader_write_;

    this.bootloader_finish = bootloader_finish_;

    this.init = wrap_promise.call(this, this.init);
    this.get_version = wrap_promise.call(this, this.get_version);
    this.get_shared_secret = wrap_promise.call(this, this.get_shared_secret );
    this.authenticate = wrap_promise.call(this,this.authenticate );
    this.sign = wrap_promise.call(this, this.sign );
    this.set_pin = wrap_promise.call(this,this.set_pin );
    this.is_pin_set = wrap_promise.call(this, this.is_pin_set );
    this.change_pin = wrap_promise.call(this, this.change_pin );
    this.get_retries = wrap_promise.call(this, this.get_retries );
    this.register = wrap_promise.call(this, this.register );
    this.reset = wrap_promise.call(this,this.reset );
    this.get_rng = wrap_promise.call(this,this.get_rng);
    this.get_pubkey = wrap_promise.call(this,this.get_pubkey);
    this.is_bootloader = wrap_promise.call(this,this.is_bootloader);
    this.bootloader_write = wrap_promise.call(this,this.bootloader_write);
    this.bootloader_finish = wrap_promise.call(this,this.bootloader_finish);

}

async function handleFirmware(files)
{
    var dev = new WalletDevice();

    var p = await dev.is_bootloader();

    document.getElementById('errors').textContent = '';
    if (p.status != 'CTAP1_SUCCESS')
    {
        document.getElementById('errors').textContent = 'Make sure device is in bootloader mode.  Unplug, hold button, plug in, wait for flashing yellow light.';
        return;
    }

    var reader = new FileReader();
    reader.onload = async function(ev){
        var resp = JSON.parse(ev.target.result);
        resp.firmware = websafe2string(resp.firmware);

        console.log(resp);
        var addr = 0x4000;
        var num_pages = 64;
        var sig = websafe2array(resp.signature);
        var badsig = websafe2array(resp.signature);
        badsig[40] = badsig[40] ^ 1;

        var blocks = MemoryMap.fromHex(resp.firmware);
        var addresses = blocks.keys();

        var addr = addresses.next();
        var chunk_size = 244;
        while(!addr.done) {
            var data = blocks.get(addr.value);
            var i;
            for (i = 0; i < data.length; i += chunk_size) {
                var chunk = data.slice(i,i+chunk_size);
                p = await dev.bootloader_write(addr.value + i, chunk);
                TEST(p.status == 'CTAP1_SUCCESS', 'Device wrote data');
                var progress = (((i/data.length) * 100 * 100) | 0)/100;
                document.getElementById('progress').textContent = ''+progress+' %';
            }

            addr = addresses.next();
        }
        p = await dev.bootloader_finish(sig);
        if(p.status != 'CTAP1_SUCCESS')
        {
            document.getElementById('errors').textContent = 'Firmware image signature denied';
        }
        else
        {
            document.getElementById('errors').textContent = 'Update successful';
        }

    };

    reader.readAsText(files[0]);
}

function TEST(bool, test){
    if (bool) {
        if (test ) console.log("PASS: " + test);
    }
    else {
        console.log("FAIL: " + test);
        throw new Error("FAIL: " + test);
    }
}

async function run_tests() {

    var dev = new WalletDevice();
    var pin = "Conor's pin 👽 ";
    var pin2 = "sogyhdxoh3qwli😀";

    function string2challenge(chal) {
        var hash = sha256.create();
        hash.update(chal);
        chal = hash.array();
        return chal;
    }

    async function device_start_over()
    {

        var p = await dev.init();
        if (p.status == 'CTAP2_ERR_NOT_ALLOWED') {   // its already locked
            p = await dev.reset();
            TEST(p.status == "CTAP1_SUCCESS", 'Device reset');
            p = await dev.init();
            TEST(p.status == "CTAP1_SUCCESS", 'Device initialize');
        } else {
            TEST(p.status == "CTAP1_SUCCESS", 'Device initialize');

            //console.log(dev);

            TEST(dev.version == "WALLET_V1.0", 'Device reports right version');

            p = await dev.is_pin_set();
            TEST(p.status == "CTAP1_SUCCESS", 'Check if pin is set');

            if (!p.data) {
            } else {

                p = await dev.authenticate(pin);

                if (p.status == "CTAP2_ERR_PIN_INVALID" ) {
                    p = await dev.authenticate(pin2);     // try second pin
                }
                else {
                }

                TEST(p.status == "CTAP1_SUCCESS", 'Authenticated');
            }

            p = await dev.reset();
            TEST(p.status == "CTAP1_SUCCESS", 'Device reset');
        }
    }

    async function test_pin()
    {
        var p = await dev.is_pin_set();
        TEST(p.status == "CTAP1_SUCCESS" && !p.data, 'Pin is not set');

        p = await dev.set_pin(pin);
        TEST(p.status == "CTAP1_SUCCESS", 'A pin was set');

        p = await dev.is_pin_set();
        TEST(p.status == "CTAP1_SUCCESS" && p.data, 'Pin set is detected');

        p = await dev.set_pin(pin);
        TEST(p.status == "CTAP2_ERR_NOT_ALLOWED", 'Trying to set a pin again will fail');

        p = await dev.change_pin(pin, pin2);
        TEST(p.status == "CTAP1_SUCCESS", 'Going through change pin process is successful');

        p = await dev.authenticate(pin);
        TEST(p.status == "CTAP2_ERR_PIN_INVALID", 'Authenticating to previous/wrong pin is denied');

        p = await dev.get_retries();
        TEST(p.status == "CTAP1_SUCCESS" && p.data > 2, 'Have at least 2 tries left ('+p.data+')');
        var tries = p.data;

        p = await dev.authenticate(pin);
        TEST(p.status == "CTAP2_ERR_PIN_INVALID");

        p = await dev.get_retries();
        TEST(p.status == "CTAP1_SUCCESS" && (p.data > 1) && (p.data < tries),
            'Have less attempts left after another failed attempt (' + p.data+')');

        p = await dev.authenticate(pin2);
        TEST(p.status == "CTAP1_SUCCESS", 'Authenticating with correct pin success');

        p = await dev.get_retries();
        TEST(p.status == "CTAP1_SUCCESS" && p.data > tries, 'Retries reset ('+ p.data+')');

        p = await dev.change_pin(pin2, pin);
        TEST(p.status == "CTAP1_SUCCESS", 'Change pin back');

        // Reset device for next set of tests
        p = await dev.authenticate(pin);
        TEST(p.status == "CTAP1_SUCCESS");

        p = await dev.reset();
        TEST(p.status == "CTAP1_SUCCESS");

    }

    async function test_crypto(leaveEarly, startLate,imkey){
        var ec = new EC('secp256k1');
        key = imkey || ec.genKeyPair();

        var priv = key.getPrivate('hex');

        var wif = key2wif(priv);  // convert to wif

        // Corrupt 1 byte
        var b = (wif[32] == 'A') ? 'B' : 'A';
        var badwif = wif.substring(0, 32) + b + wif.substring(32+1);
        var p;

        var chal = string2challenge('abc');

        if (!startLate) {

            p = await dev.set_pin(pin);
            TEST(p.status == "CTAP1_SUCCESS");

            p = await dev.sign({challenge: chal});
            TEST(p.status == 'CTAP2_ERR_PIN_AUTH_INVALID', 'No signature without authenticating first');

            p = await dev.register(wif);
            TEST(p.status == 'CTAP2_ERR_PIN_AUTH_INVALID', 'No key register without authenticating first');

            p = await dev.get_rng();
            TEST(p.status == "CTAP2_ERR_PIN_AUTH_INVALID", 'No rng without authenticating first');

            p = await dev.authenticate(pin);
            TEST(p.status == "CTAP1_SUCCESS");

            p = await dev.sign({challenge: chal});
            TEST(p.status == 'CTAP2_ERR_NO_CREDENTIALS', 'No signature without key');

            p = await dev.register(badwif);
            TEST(p.status == 'CTAP2_ERR_CREDENTIAL_NOT_VALID', 'Wallet does not accept corrupted key');

            p = await dev.register(wif);
            TEST(p.status == 'CTAP1_SUCCESS', 'Wallet accepts good WIF key');

        } else {
            p = await dev.authenticate(pin + 'A');
            TEST(p.status == "CTAP2_ERR_PIN_INVALID", 'Wrong pin fails');

            p = await dev.authenticate(pin);
            TEST(p.status == "CTAP1_SUCCESS", 'Right pin works');
        }

        p = await dev.get_pubkey();
        TEST(p.status == 'CTAP1_SUCCESS', '(1) Wallet derives public key from stored private key');

        p = await dev.register(wif);
        TEST(p.status == 'CTAP2_ERR_KEY_STORE_FULL', 'Wallet does not accept another key');

        p = await dev.sign({challenge: chal});
        TEST(p.status == 'CTAP1_SUCCESS', 'Wallet returns signature');
        var sig = p.sig;

        var ver = key.verify(chal, sig);
        TEST(ver, 'Signature is valid');

        p = await dev.get_pubkey();
        TEST(p.status == 'CTAP1_SUCCESS', '(2) Wallet derives public key from stored private key');

        var key2 = ec.keyFromPublic('04'+array2hex(p.data), 'hex');
        ver = key2.verify(chal, sig);
        TEST(ver, 'Signature verifies with the derived public key');

        var count = p.count;
        p = await dev.sign({challenge: chal});
        ver = key.verify(chal, p.sig);
        TEST(p.status == 'CTAP1_SUCCESS' && p.count > count && ver, 'Count increments for each signature ' + p.count);

        if (leaveEarly) return;

        // Test lockout
        console.log("Exceeding all pin attempts...");
        p = await dev.get_retries();
        TEST(p.status == "CTAP1_SUCCESS");
        var tries = p.data;

        while (tries > 0) {
            p = await dev.authenticate('1234'); // wrong pin
            TEST(p.status == "CTAP2_ERR_PIN_INVALID");

            p = await dev.get_retries();
            TEST(p.status == "CTAP1_SUCCESS");
            tries = p.data;
        }

        p = await dev.get_retries();
        TEST(p.status == "CTAP1_SUCCESS");
        tries = p.data;
        TEST(tries == 0, 'Device has 0 tries left (lockout)');

        p = await dev.register(wif);
        TEST(p.status == 'CTAP2_ERR_PIN_AUTH_INVALID', 'Register is denied');

        p = await dev.sign({challenge: chal});
        TEST(p.status == 'CTAP2_ERR_PIN_AUTH_INVALID', 'Sign is denied');

        p = await dev.set_pin(pin);
        TEST(p.status == "CTAP2_ERR_NOT_ALLOWED", 'set_pin is locked out');

        p = await dev.change_pin(pin,pin2);
        TEST(p.status == "CTAP2_ERR_NOT_ALLOWED", 'change_pin is locked out');

        p = await dev.get_rng();
        TEST(p.status == "CTAP2_ERR_NOT_ALLOWED", 'get_rng is locked out');

        p = await dev.init();
        TEST(p.status == "CTAP2_ERR_NOT_ALLOWED", 'init (getKeyAgreement) is locked out');

        p = await dev.reset();
        TEST(p.status == "CTAP1_SUCCESS");

        p = await dev.get_retries();
        TEST(p.status == "CTAP1_SUCCESS");
        tries = p.data;

        p = await dev.is_pin_set();
        TEST(p.status == "CTAP1_SUCCESS");
        var is_pin_set = p.data;

        p = await dev.sign({challenge: chal});
        TEST(p.status == 'CTAP2_ERR_NO_CREDENTIALS');

        TEST(tries > 2 && is_pin_set == false, 'Device is no longer locked after reset and pin and key are gone');

        TEST(p.count >= count, 'Counter did not reset');
    }

    async function test_rng(){

        var pool = '';

        var p = await dev.get_rng();
        TEST(p.status == "CTAP1_SUCCESS", 'Rng responds');

        pool += array2hex(p.data);

        console.log("Gathering many RNG bytes..");

        while (pool.length < 1024 * 10) {
            var p = await dev.get_rng();
            TEST(p.status == "CTAP1_SUCCESS");
            pool += array2hex(p.data);
        }

        var entropy = shannon.entropy(pool) * 2;
        TEST(entropy > 7.99, 'Rng has good entropy: ' + entropy);
    }


    async function test_persistence()
    {

        var ec = new EC('secp256k1');
        var key = ec.keyFromPrivate('693e3c441129af84ed10693e3c441129af84ed10693e3c441129af84ed10aabb');
        var p = await dev.init();
        p = await dev.is_pin_set();
        TEST(p.status == "CTAP1_SUCCESS");
        var is_pin_set = p.data;
        if (! is_pin_set) {
            console.log("Pin is not set, resetting and loading new pin and key.");

            await device_start_over();
            await test_crypto(true,false,key);
            console.log("Now restart device and reload page.");
        } else {
            await test_crypto(true,true,key);
        }
    }

    async function benchmark()
    {
        var t1,t2,i;
        var ec = new EC('secp256k1');
        var key = ec.genKeyPair();
        var priv = key.getPrivate('hex');

        var wif = key2wif(priv);  // convert to wif

        var chal = string2challenge('abc');

        var p = await dev.register(wif);
        TEST(p.status == 'CTAP1_SUCCESS', 'Wallet accepts good WIF key');

        var count,lcount;
        lcount = -1;
        for (i = 0; i < 2048; i++)
        {
            t1 = performance.now();
            p = await dev.sign({challenge: chal});
            t2 = performance.now();
            var ver = key.verify(chal, p.sig);
            count = p.count;
            TEST(ver && p.status == 'CTAP1_SUCCESS', 'Wallet returns signature ('+(t2-t1)+' ms)');
            if (i != 0) TEST(count == (lcount+1), 'Count increased by 1 ('+count+')');

            lcount = count;
        }
    }

    async function test_bootloader()
    {
        var addr = 0x4000;
        var num_pages = 64;

        var p = await dev.is_bootloader();
        TEST(p.status == 'CTAP1_SUCCESS', 'Device is in bootloader mode');

        var randdata = new Uint8Array(16);

        p = await dev.bootloader_write(0, randdata);
        TEST(p.status == 'CTAP2_ERR_NOT_ALLOWED', 'Denies accessing invalid address');

        p = await dev.bootloader_write(addr-4, randdata);
        TEST(p.status == 'CTAP2_ERR_NOT_ALLOWED', 'Denies accessing invalid address');

        p = await dev.bootloader_write(2048 * (num_pages-3)-4, randdata);
        TEST(p.status == 'CTAP2_ERR_NOT_ALLOWED', 'Denies accessing invalid address');

        p = await dev.bootloader_write(2048 * (num_pages-2), randdata);
        TEST(p.status == 'CTAP2_ERR_NOT_ALLOWED', 'Denies accessing invalid address');

        p = await dev.bootloader_write(2048 * (num_pages+1), randdata);
        TEST(p.status == 'CTAP2_ERR_NOT_ALLOWED', 'Denies accessing invalid address');


        p = await get_firmware_http();
        var sig = websafe2array(p.signature);
        var badsig = websafe2array(p.signature);
        badsig[40] = badsig[40] ^ 1;

        var blocks = MemoryMap.fromHex(p.firmware);
        var addresses = blocks.keys();

        var addr = addresses.next();
        var chunk_size = 244;
        while(!addr.done) {
            var data = blocks.get(addr.value);
            var i;
            for (i = 0; i < data.length; i += chunk_size) {
                var chunk = data.slice(i,i+chunk_size);
                p = await dev.bootloader_write(addr.value + i, chunk);
                TEST(p.status == 'CTAP1_SUCCESS', 'Device wrote data');
                var progress = (((i/data.length) * 100 * 100) | 0)/100;
                document.getElementById('progress').textContent = ''+progress+' %';
            }

            addr = addresses.next();
        }

        p = await dev.bootloader_finish(badsig);
        TEST(p.status == 'CTAP2_ERR_OPERATION_DENIED', 'Device rejected new image with bad signature');

        p = await dev.bootloader_finish(sig);
        TEST(p.status == 'CTAP1_SUCCESS', 'Device booted new image with correct signature');

        document.getElementById('progress').textContent = ''+100+' %';
    }

    //while(1)
    {
        await device_start_over();
        //await test_pin();
        await test_crypto();
        //await test_rng();
    }
    //await benchmark();
    //await test_persistence();

    //await test_bootloader();


}
var test;

EC = elliptic.ec

//run_tests()

