cmake_minimum_required(VERSION 3.16)
project(cotp VERSION "4.2.2" LANGUAGES "C")

# Guard against drift between CMake project version and the COTP_VERSION_STRING macro in cotp.h
file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/src/cotp.h" _cotp_hdr_ver REGEX "^#define COTP_VERSION_STRING")
string(REGEX MATCH "\"([0-9]+\\.[0-9]+\\.[0-9]+)\"" _ "${_cotp_hdr_ver}")
if(NOT "${CMAKE_MATCH_1}" STREQUAL "${PROJECT_VERSION}")
    message(FATAL_ERROR "cotp.h COTP_VERSION_STRING (${CMAKE_MATCH_1}) does not match project VERSION (${PROJECT_VERSION}). Update both.")
endif()

set(CMAKE_C_STANDARD 11)

set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} ${CMAKE_CURRENT_SOURCE_DIR}/cmake)

include(GNUInstallDirs)
include(CMakePackageConfigHelpers)
include(CheckFunctionExists)

check_function_exists(explicit_bzero HAVE_EXPLICIT_BZERO)

find_package(PkgConfig)

option(BUILD_SHARED_LIBS "Build libcotp as a shared library" ON)
option(BUILD_TESTS "Build base32 and cotp tests" OFF)
set(HMAC_WRAPPER "gcrypt" CACHE STRING "Choose between gcrypt (default), openssl or mbedtls for HMAC computation")
set_property(CACHE HMAC_WRAPPER PROPERTY STRINGS "gcrypt" "openssl" "mbedtls")

if("${HMAC_WRAPPER}" STREQUAL "gcrypt")
    set(HMAC_SOURCE_FILES
            src/utils/whmac_gcrypt.c
    )
    set(HASH_SOURCE_FILES
            src/utils/whash_gcrypt.c
    )
    find_package(Gcrypt 1.8.0 REQUIRED)
    set(HMAC_INCLUDE_DIR ${GCRYPT_INCLUDE_DIR})
    set(HMAC_LIBRARIES ${GCRYPT_LIBRARIES})
    message(STATUS "libcotp: HMAC backend set to gcrypt")
elseif("${HMAC_WRAPPER}" STREQUAL "openssl")
    find_package(OpenSSL 3.0.0 REQUIRED)
    set(HMAC_SOURCE_FILES
            src/utils/whmac_openssl.c
    )
    set(HASH_SOURCE_FILES
            src/utils/whash_openssl.c
    )
    set(HMAC_INCLUDE_DIR ${OPENSSL_INCLUDE_DIR})
    set(HMAC_LIBRARIES ${OPENSSL_LIBRARIES})
    message(STATUS "libcotp: HMAC backend set to openssl")
elseif("${HMAC_WRAPPER}" STREQUAL "mbedtls")
    find_package(MbedTLS REQUIRED)
    set(HMAC_SOURCE_FILES
            src/utils/whmac_mbedtls.c
    )
    set(HASH_SOURCE_FILES
            src/utils/whash_mbedtls.c
    )
    set(HMAC_INCLUDE_DIR ${MBEDTLS_INCLUDE_DIRS})
    set(HMAC_LIBRARIES ${MBEDTLS_LIBRARIES})
    message(STATUS "libcotp: HMAC backend set to mbedtls")
else()
    message(FATAL_ERROR "libcotp: unknown HMAC_WRAPPER '${HMAC_WRAPPER}'. Choose gcrypt, openssl, or mbedtls.")
endif()

set(COTP_HEADERS
        src/cotp.h
)

option(COTP_ENABLE_VALIDATION "Enable helper APIs for OTP validation in a time window" OFF)

set(SOURCE_FILES
        src/otp.c
        src/yaotp.c
        ${HMAC_SOURCE_FILES}
        ${HASH_SOURCE_FILES}
        src/utils/base32.c
        src/utils/secure_zero.c
        src/utils/pct.c
        src/utils/otpauth_uri.c
        src/utils/yaotp_uri.c
        src/ctx.c
        src/strerror.c
)

if (COTP_ENABLE_VALIDATION)
    list(APPEND SOURCE_FILES src/utils/validation.c)
endif()

add_library(cotp ${SOURCE_FILES})

if (HAVE_EXPLICIT_BZERO)
    target_compile_definitions(cotp PRIVATE HAVE_EXPLICIT_BZERO)
endif()

if (COTP_ENABLE_VALIDATION)
    target_compile_definitions(cotp PUBLIC COTP_ENABLE_VALIDATION)
endif()

target_link_libraries(cotp PRIVATE ${HMAC_LIBRARIES})
target_include_directories(cotp
        PUBLIC
            $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/src>
            $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
        PRIVATE
            ${HMAC_INCLUDE_DIR})

if(NOT MSVC)
    target_compile_options(cotp PRIVATE
            -Wall -Wextra -Wformat=2 -Wmissing-format-attribute -fstack-protector-strong -Wundef -Wmissing-format-attribute
            -fdiagnostics-color=always -Wstrict-prototypes -Wunreachable-code -Wchar-subscripts -Wwrite-strings -Wpointer-arith -Wbad-function-cast
            -Wcast-align -Werror=format-security -Werror=implicit-function-declaration -Wno-sign-compare -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3
            -fvisibility=hidden
            $<$<CONFIG:Release>:-O3>)
endif()

if(NOT APPLE AND NOT MSVC)
    target_link_options(cotp PRIVATE
            "LINKER:-z,relro,-z,now"
            "LINKER:-z,noexecstack")
endif()

set_target_properties(cotp PROPERTIES VERSION ${CMAKE_PROJECT_VERSION} SOVERSION ${CMAKE_PROJECT_VERSION_MAJOR})

if (BUILD_TESTS)
    enable_testing()
    add_subdirectory(tests)
endif ()

option(COTP_BUILD_FUZZERS "Build libFuzzer harnesses (requires Clang with -fsanitize=fuzzer)" OFF)
if (COTP_BUILD_FUZZERS)
    add_subdirectory(fuzz)
endif ()

set(COTP_LIB_DIR "${CMAKE_INSTALL_LIBDIR}")
set(COTP_INC_DIR "${CMAKE_INSTALL_INCLUDEDIR}")

install(
  TARGETS cotp
  EXPORT cotpTargets
  ARCHIVE DESTINATION ${COTP_LIB_DIR}
  LIBRARY DESTINATION ${COTP_LIB_DIR}
  COMPONENT library
)

install(
  FILES ${COTP_HEADERS}
  DESTINATION ${COTP_INC_DIR}
)

# CMake package config for find_package(COTP CONFIG)
write_basic_package_version_file(
    "${CMAKE_CURRENT_BINARY_DIR}/COTPConfigVersion.cmake"
    VERSION ${PROJECT_VERSION}
    COMPATIBILITY SameMajorVersion
)
configure_package_config_file(
    "${CMAKE_CURRENT_SOURCE_DIR}/cmake/COTPConfig.cmake.in"
    "${CMAKE_CURRENT_BINARY_DIR}/COTPConfig.cmake"
    INSTALL_DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/COTP
)
install(FILES
    "${CMAKE_CURRENT_BINARY_DIR}/COTPConfig.cmake"
    "${CMAKE_CURRENT_BINARY_DIR}/COTPConfigVersion.cmake"
    DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/COTP
)
install(EXPORT cotpTargets NAMESPACE COTP:: DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/COTP)

if (PkgConfig_FOUND)
    # Let pkg-config expand the backend's own private link dependencies for
    # fully static consumers (for example, libgcrypt also needs gpg-error).
    # Keep Libs.private below as a fallback for installations without a backend
    # .pc file and for the explicitly resolved library paths.
    set(COTP_PKGCONFIG_REQUIRES_PRIVATE "")
    if(HMAC_WRAPPER STREQUAL "gcrypt")
        pkg_check_modules(COTP_GCRYPT_PC QUIET libgcrypt)
        if(COTP_GCRYPT_PC_FOUND)
            set(COTP_PKGCONFIG_REQUIRES_PRIVATE "libgcrypt")
        endif()
    elseif(HMAC_WRAPPER STREQUAL "openssl")
        pkg_check_modules(COTP_OPENSSL_PC QUIET openssl)
        if(COTP_OPENSSL_PC_FOUND)
            set(COTP_PKGCONFIG_REQUIRES_PRIVATE "openssl")
        endif()
    elseif(HMAC_WRAPPER STREQUAL "mbedtls")
        pkg_check_modules(COTP_MBEDTLS_PC QUIET mbedtls)
        if(COTP_MBEDTLS_PC_FOUND)
            set(COTP_PKGCONFIG_REQUIRES_PRIVATE "mbedtls")
        endif()
    endif()

    # Allow adding prefix if CMAKE_INSTALL_INCLUDEDIR not absolute.
    if(IS_ABSOLUTE "${CMAKE_INSTALL_INCLUDEDIR}")
        set(PKGCONFIG_TARGET_INCLUDES "${CMAKE_INSTALL_INCLUDEDIR}")
    else()
        set(PKGCONFIG_TARGET_INCLUDES "\${prefix}/${CMAKE_INSTALL_INCLUDEDIR}")
    endif()
    # Allow adding prefix if CMAKE_INSTALL_LIBDIR not absolute.
    if(IS_ABSOLUTE "${CMAKE_INSTALL_LIBDIR}")
        set(PKGCONFIG_TARGET_LIBS "${CMAKE_INSTALL_LIBDIR}")
    else()
        set(PKGCONFIG_TARGET_LIBS "\${exec_prefix}/${CMAKE_INSTALL_LIBDIR}")
    endif()

    # Static consumers need the selected crypto backend on the link line.
    # Derive -l flags from the resolved backend library paths.
    set(COTP_PKGCONFIG_LIBS_PRIVATE "")
    foreach(_cotp_lib IN LISTS HMAC_LIBRARIES)
        if(_cotp_lib MATCHES "^-l")
            string(APPEND COTP_PKGCONFIG_LIBS_PRIVATE " ${_cotp_lib}")
        else()
            get_filename_component(_cotp_libname "${_cotp_lib}" NAME_WE)
            string(REGEX REPLACE "^lib" "" _cotp_libname "${_cotp_libname}")
            if(_cotp_libname)
                string(APPEND COTP_PKGCONFIG_LIBS_PRIVATE " -l${_cotp_libname}")
            endif()
        endif()
    endforeach()

    configure_file("cotp.pc.in" "cotp.pc" @ONLY)
    install(FILES "${CMAKE_CURRENT_BINARY_DIR}/cotp.pc" DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig/)
endif()
