/**
 * Redirect the shopper for 3DSv1 authentication.
 * @param authenticationUrl The authentication URL.
 * @param postParameters The parameters to the post request.
 */
function redirectForThreeDsOneAuthentication(authenticationUrl, postParameters) {
    var form = document.createElement('form');
    document.body.appendChild(form);
    form.method = 'post';
    form.action = authenticationUrl;
    for (var name in postParameters) {
        var input = document.createElement('input');
        input.type = 'hidden';
        input.name = name;
        input.value = postParameters[name];
        form.appendChild(input);
    }
    form.submit();
}

/**
 * <em>SAMPLE SCRIPT for performing 3DS v2 authentication</em>
 * <p>
 * Executes the 3DS v2 ACS method URL of the browser and authentication instructions for the shopper.
 *
 * This function performs two things:
 * <ol>
 *     _It loads the ACS method URL, and after loading_
 *     _Executes the authentication call to CM Payments to authenticate the shopper._
 * </ol>
 *
 * The ACS Method URL is performed in an i-frame, hidden from the shopper, by posting the <code>acsMethodData</code>
 * to the <code>acsMethodURl</code>. The result is processed by the ACS and a notification of that is
 * directly received by CM payments from the ACS.
 * <br/>
 * Shopper authentication is performed by posting the <code>authenticationData</code> to the authentication URL
 * (<code>authenticationUrl</code>). For further details see handleThreeDsAuthentication().
 * <p>
 * For additional information see EMVCo 3DS spec 2.2.0 chapters '3.3 - Browser-based Requirements' and chapter
 * '5.8 - Browser-based Message Handling'.
 *
 * @param acsMethodUrl The ACS method URL.
 * @param acsMethodData The ACS method data.
 *                      <br/>The data should be posted as is using the parameter name 'threeDSMethodData'.
 * @param authenticationUrl The authentication URL.
 * @param authenticationData The authentication data.
 *                           <br/>The authentication data should be amended with additional information about the
 *                                browser and shopper.
 * @param forceAuthentication <code>true</code>, if the authentication of the shopper must be forced.
 *                            Otherwise, <code>false</code>, it is left to Payment System and/or issuer.
 */
function performThreeDsAuthentication(acsMethodUrl, acsMethodData,
                                      authenticationUrl, authenticationData,
                                      forceAuthentication) {
    if (!authenticationUrl || !authenticationData) {
        throw Error('Not all ACS Authentication parameters provided');
    }

    if (!acsMethodUrl) {
        // No ACS method URL, so can skip that part. Directly authenticate the shopper.
        handleThreeDsAuthentication(authenticationUrl, authenticationData, forceAuthentication);
    } else {
        if (!acsMethodData) {
            throw Error('Not all ACS 3DS method parameters provided');
        }
        window.nca3DSWebSDK.createIframeAndInit3DSMethod(acsMethodUrl, acsMethodData,
                                                         'threeDSMethodIFrame', document.body,
                                                         new function () {
                                                             handleThreeDsAuthentication(authenticationUrl,
                                                                                         authenticationData,
                                                                                         forceAuthentication)
                                                         });
    }
}

/**
 * Perform the authentication request at CM Payments. The request is then forwarded to the ACS for evaluation.
 *
 * <p>
 * The parameter <code>authenticationData</code> is used to provide additional authentication and has the
 * following structure:
 * <pre>
 * {
 *    "browser_info" : { ... },
 *    "shopper_info" : { ... }
 *  }
 * </pre>
 * The additional data is used to provide additional information about the shopper that was not provided in the original
 * create-order API request or if more precise information is available. The data is optional, but may allow the shopper
 * to experience the frictionless flow, in which case the shopper does not have to authenticate.
 *
 * @param authenticationUrl The authentication URL
 * @param authenticationData  The additional authentication data
 * @param forceAuthentication <code>true</code>, if the authentication of the shopper must be forced.
 *                            Otherwise, <code>false</code>, it is left to Payment System and/or issuer.
 */
function handleThreeDsAuthentication(authenticationUrl, authenticationData, forceAuthentication) {

    let xhttp = new XMLHttpRequest();

    xhttp.onreadystatechange = function() {
        if (this.readyState === 4) {
            if (this.status === 200) {

                /**
                 * The response structure is similar to the REST API start response; the error component is added to
                 * present a more detailed error message to the shopper. For sake of brevity only the used fields are
                 * mentioned here.
                 *
                 * <pre>
                 *     "result" : <"CHALLENGE" | "AUTHORIZED" | "SOFT_DECLINE" | "ERROR" | "CANCELED"> (mandatory)
                 *     "url"    : [ {
                 *                    "url" : "some URL", (mandatory)
                 *                    "order" : 1, (mandatory)
                 *                    "purpose" : <"REDIRECT" | "IFRAME" | "HIDDEN_IFRAME">, (mandatory)
                 *                    "parameters" : [{key, value}]
                 *                  },
                 *                  ...
                 *               ],
                 *     "error" : {
                 *                 "message" : "some message", (conditional, if result === ERROR or result === CANCELED)
                 *                 "message_key : "some key" (conditional, if result === ERROR or result === CANCELED)
                 *     }
                 * </pre>
                 */
                let response = JSON.parse(this.responseText);
                if (response.result === 'CHALLENGE') {
                    let redirectUrlData = findUrlWithPurpose(response.urls, 'REDIRECT');
                    if (redirectUrlData) {
                        redirectForThreeDsOneAuthentication(redirectUrlData.url, redirectUrlData.parameters);
                    } else {

                        /* We have some knowledge of the returned data here. All the URLs require POST and the parameter
                         * names are known. The parameter name is 'creq', which is the same as what is required in the form
                         * that needs to be posted to the ACS (see also EMVco 3DSv2 specification; table A.3 - CReq/CRes POST data).
                         */
                        let challengeUrlData = findUrlWithPurpose(response.urls, 'IFRAME');

                        // The authentication frame is created and maintained by the OPC menu. The i-frame itself must have
                        // a name/identifier.
                        let authenticationFrame = window.showAuthenticationFrame();
                        window.nca3DSWebSDK.init3DSChallengeRequest(challengeUrlData.url,
                            challengeUrlData.parameters['creq'],
                            authenticationFrame);
                    }
                } else if (response.result === 'SOFT_DECLINE') {
                        /* The payment authorization was soft-decline by the acquirer/issuer; the payment can be completed
                         * if the shopper is authenticated. This requires a restart of the authentication process, so the
                         * function 'performThreeDsAuthentication' is called again.
                         *
                         * We have some knowledge of the returned data here. All the URLs require POST and the parameter
                         * names are known. The ACS method is passed along under 'threeDSMethodData' and must be posted
                         * using the same (parameter) name (see also EMVco 3DSv2 specification; table A.2 - 3DS Method Data).
                         */

                        let acsMethodUrlData = findUrlWithPurpose(response.urls, 'HIDDEN_IFRAME');
                        let methodUrl = acsMethodUrlData === null ? null : acsMethodUrlData.url;
                        // The parameter is named 'threeDSMethodData'.
                        let methodData = acsMethodUrlData === null ? null : acsMethodUrlData.parameters['threeDSMethodData'];

                        // There is always an authentication URL and no parameter data
                        let authenticationUrlData = findUrlWithPurpose(response.urls, 'IFRAME');
                        let authUrl = authenticationUrlData.url;
                        performThreeDsAuthentication(methodUrl, methodData, authUrl, '{}', true);
                } else if (response.result === 'AUTHORIZED') {
                    // Payment is authorized, need to wait for the order status to be updated.
                    window.pollOrderStatus();
                } else {
                    // No need to poll the status, show the error message
                    window.showPaymentCanceled(response.error.message_key, response.error.message);
                }
            } else {
                // Show the payment canceled dialog
                window.showPaymentCanceled('payment_processing_error', this.statusText);
            }
        }
    };

    xhttp.open('POST', authenticationUrl, true);
    xhttp.setRequestHeader('Content-Type', 'application/json');
    xhttp.setRequestHeader('Accept', 'application/json');

    /* Add any additional browser information for the authentication request. The user-agent and browser-accept header
     * are retrieved from the request itself that is retrieved by the Payment system; so there is no need to specify
     * those.
     *
     * If a soft-decline is being handled, then the field 'force_authentication' is required. This field is passed along
     * as part of the initial authentication/authorization result as well. In this sample script, that particular
     * information is ignored and the value is directly set based on the passed-in parameters.
     */
    let data = JSON.parse(authenticationData);
    data.force_authentication = forceAuthentication;

    data.browser_info = {};
    data.browser_info.java_enabled = navigator.javaEnabled();
    /*always enabled*/
    data.browser_info.java_script_enabled = true;
    data.browser_info.language = navigator.language;
    data.browser_info.color_depth = screen.colorDepth;
    data.browser_info.screen_height = screen.height;
    data.browser_info.screen_width = screen.width;
    data.browser_info.time_zone_offset = new Date().getTimezoneOffset();
    data.browser_info.challenge_window_size = '05';

    xhttp.send(JSON.stringify(data));
}

/**
 * Helper logic to search for a particular URL with a specific purpose.
 *
 * @param urls The urls for 3DSv1 or 3DSv2 authentication.
 * @param purpose The purpose of URL.Can be 'REDIRECT', 'HIDDEN_IFRAME' or 'IFRAME'.
 *
 * @return the URL with given purpose.
 */
function findUrlWithPurpose(urls, purpose) {
    for (let url of urls) {
        if (url.purpose === purpose) {
            return url;
        }
    }
    return null;
}