/*

  Licensed to the Apache Software Foundation (ASF) under one
  or more contributor license agreements.  See the NOTICE file
  distributed with this work for additional information
  regarding copyright ownership.  The ASF licenses this file
  to you under the Apache License, Version 2.0 (the
  "License"); you may not use this file except in compliance
  with the License.  You may obtain a copy of the License at

  http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
*/

/**
 * @file plugin.cc
 * @brief traffic server plugin entry points.
 */

#include <ctime> /* strftime */

#include "common.h"         /* Common definitions */
#include "config.h"         /* AccessControlConfig */
#include "access_control.h" /* AccessToken */
#include "ts/remap.h"       /* TSRemapInterface, TSRemapStatus, apiInfo */
#include "ts/ts.h"          /* ATS API */
#include "utils.h"          /* cryptoBase64Decode.* functions */
#include "headers.h"        /* getHeader, setHeader, removeHeader */

static const std::string_view UNKNOWN{"unknown"};

static const char *
getEventName(TSEvent event)
{
  switch (event) {
  case TS_EVENT_HTTP_CONTINUE:
    return "TS_EVENT_HTTP_CONTINUE";
  case TS_EVENT_HTTP_ERROR:
    return "TS_EVENT_HTTP_ERROR";
  case TS_EVENT_HTTP_READ_REQUEST_HDR:
    return "TS_EVENT_HTTP_READ_REQUEST_HDR";
  case TS_EVENT_HTTP_OS_DNS:
    return "TS_EVENT_HTTP_OS_DNS";
  case TS_EVENT_HTTP_SEND_REQUEST_HDR:
    return "TS_EVENT_HTTP_SEND_REQUEST_HDR";
  case TS_EVENT_HTTP_READ_CACHE_HDR:
    return "TS_EVENT_HTTP_READ_CACHE_HDR";
  case TS_EVENT_HTTP_READ_RESPONSE_HDR:
    return "TS_EVENT_HTTP_READ_RESPONSE_HDR";
  case TS_EVENT_HTTP_SEND_RESPONSE_HDR:
    return "TS_EVENT_HTTP_SEND_RESPONSE_HDR";
  case TS_EVENT_HTTP_REQUEST_TRANSFORM:
    return "TS_EVENT_HTTP_REQUEST_TRANSFORM";
  case TS_EVENT_HTTP_RESPONSE_TRANSFORM:
    return "TS_EVENT_HTTP_RESPONSE_TRANSFORM";
  case TS_EVENT_HTTP_SELECT_ALT:
    return "TS_EVENT_HTTP_SELECT_ALT";
  case TS_EVENT_HTTP_TXN_START:
    return "TS_EVENT_HTTP_TXN_START";
  case TS_EVENT_HTTP_TXN_CLOSE:
    return "TS_EVENT_HTTP_TXN_CLOSE";
  case TS_EVENT_HTTP_SSN_START:
    return "TS_EVENT_HTTP_SSN_START";
  case TS_EVENT_HTTP_SSN_CLOSE:
    return "TS_EVENT_HTTP_SSN_CLOSE";
  case TS_EVENT_HTTP_CACHE_LOOKUP_COMPLETE:
    return "TS_EVENT_HTTP_CACHE_LOOKUP_COMPLETE";
  case TS_EVENT_HTTP_PRE_REMAP:
    return "TS_EVENT_HTTP_PRE_REMAP";
  case TS_EVENT_HTTP_POST_REMAP:
    return "TS_EVENT_HTTP_POST_REMAP";
  default:
    return "UNHANDLED";
  }
}

/**
 * @brief Plugin transaction data.
 */
class AccessControlTxnData
{
public:
  AccessControlTxnData(AccessControlConfig *config) : _config(config) {}
  const AccessControlConfig *_config;               /** @brief pointer to the plugin config */
  String                     _subject     = "";     /** @brief subject for debugging purposes */
  AccessTokenStatus          _vaState     = UNUSED; /** @brief VA access control token validation status */
  AccessTokenStatus          _originState = UNUSED; /** @brief Origin access control token validation status */
};

/**
 * @brief Plugin initialization.
 * @param apiInfo remap interface info pointer
 * @param errBuf error message buffer
 * @param errBufSize error message buffer size
 * @return always TS_SUCCESS.
 */
TSReturnCode
TSRemapInit(TSRemapInterface * /* apiInfo ATS_UNUSED */, char * /* errBuf ATS_UNUSED */, int /* erroBufSize ATS_UNUSED */)
{
  return TS_SUCCESS;
}

/**
 * @brief Plugin new instance entry point.
 *
 * Processes the configuration and initializes the plugin instance.
 * @param argc plugin arguments number
 * @param argv plugin arguments
 * @param instance new plugin instance pointer (initialized in this function)
 * @param errBuf error message buffer
 * @param errBufSize error message buffer size
 * @return TS_SUCCES if success or TS_ERROR if failure
 */
TSReturnCode
TSRemapNewInstance(int argc, char *argv[], void **instance, char * /* errBuf ATS_UNUSED */, int /* errBufSize ATS_UNUSED */)
{
  AccessControlConfig *config = new AccessControlConfig();
  if (nullptr != config && config->init(argc, argv)) {
    *instance = config;
  } else {
    AccessControlDebug("failed to initialize the " PLUGIN_NAME " plugin");
    *instance = nullptr;
    delete config;
    return TS_ERROR;
  }
  return TS_SUCCESS;
}

/**
 * @brief Plugin instance deletion clean-up entry point.
 * @param plugin instance pointer.
 */
void
TSRemapDeleteInstance(void *instance)
{
  AccessControlConfig *config = static_cast<AccessControlConfig *>(instance);
  delete config;
}

/**
 * @brief A mapping between various failures and HTTP status code and message to be returned to the UA.
 * @param state Access Token validation status
 * @param config pointer to the plugin configuration to get the desired response for each failure.
 * @return HTTP status
 */
static TSHttpStatus
accessTokenStateToHttpStatus(AccessTokenStatus state, AccessControlConfig *config)
{
  TSHttpStatus httpStatus = TS_HTTP_STATUS_NONE;
  const char  *message    = "VALID";
  switch (state) {
  case VALID:
    break;
  case INVALID_SIGNATURE:
    httpStatus = config->_invalidSignature;
    message    = "invalid signature";
    break;
  case UNUSED:
    httpStatus = config->_internalError;
    message    = "uninitialized token";
    break;
  case INVALID_SECRET:
    httpStatus = config->_internalError;
    message    = "failed to find secrets";
    break;
  case INVALID_SYNTAX:
  case MISSING_REQUIRED_FIELD:
  case INVALID_FIELD:
  case INVALID_FIELD_VALUE:
  case INVALID_VERSION:
  case INVALID_HASH_FUNCTION:
  case INVALID_KEYID:
    httpStatus = config->_invalidSyntax;
    message    = "invalid syntax";
    break;
  case INVALID_SCOPE:
  case OUT_OF_SCOPE:
    httpStatus = config->_invalidScope;
    message    = "invalid scope";
    break;
  case TOO_EARLY:
  case TOO_LATE:
    httpStatus = config->_invalidTiming;
    message    = "invalid timing ";
    break;
  default:
    /* Validation failed. */
    httpStatus = config->_invalidRequest;
    message    = "unknown error";
    break;
  }
  AccessControlDebug("token validation: %s", message);

  return httpStatus;
}

/**
 * @brief a quick utility function to trim leading spaces.
 */
static void
ltrim(String &target)
{
  String::size_type p(target.find_first_not_of(' '));

  if (p != target.npos) {
    target.erase(0, p);
  }
}

/**
 * @brief a quick utility function to get next duplicate header.
 */
static TSMLoc
nextDuplicate(TSMBuffer buffer, TSMLoc hdr, TSMLoc field)
{
  TSMLoc next = TSMimeHdrFieldNextDup(buffer, hdr, field);
  TSHandleMLocRelease(buffer, hdr, field);
  return next;
}

/**
 * @brief Append cookies by following the rules specified in the cookies config object.
 * @param config cookies-related configuration containing information about which cookies need to be appended to the key.
 * @note Add the cookies to "hier-part" (RFC 3986), always sort them in the cache key.
 */
bool
getCookieByName(TSHttpTxn /* txn ATS_UNUSED */, TSMBuffer buf, TSMLoc hdrs, const String &cookieName, String &cookieValue)
{
  TSMLoc field;

  for (field = TSMimeHdrFieldFind(buf, hdrs, TS_MIME_FIELD_COOKIE, TS_MIME_LEN_COOKIE); field != TS_NULL_MLOC;
       field = ::nextDuplicate(buf, hdrs, field)) {
    int count = TSMimeHdrFieldValuesCount(buf, hdrs, field);

    for (int i = 0; i < count; ++i) {
      const char *val;
      int         len;

      val = TSMimeHdrFieldValueStringGet(buf, hdrs, field, i, &len);
      if (val == nullptr || len == 0) {
        continue;
      }

      String             cookie;
      std::istringstream istr(String(val, len));

      while (std::getline(istr, cookie, ';')) {
        ::ltrim(cookie); // Trim leading spaces.

        String::size_type pos(cookie.find_first_of('='));
        String            name(cookie.substr(0, pos == String::npos ? cookie.size() : pos));

        AccessControlDebug("cookie name: %s", name.c_str());

        if (0 == cookieName.compare(name)) {
          cookieValue.assign(cookie.substr(pos == String::npos ? pos : pos + 1));
          return true;
        }
      }
    }
  }
  return false;
}

/**
 * @brief Handle token validation failures.
 * @param txn transaction handle
 * @param data transaction data
 * @param reject true - reject requests if configured, false - don't reject
 * @param httpStatus HTTP status
 * @param status Access Token validation status.
 */
static TSRemapStatus
handleInvalidToken(TSHttpTxn txnp, AccessControlTxnData *data, bool reject, const TSHttpStatus httpStatus, AccessTokenStatus status)
{
  TSRemapStatus resultStatus = TSREMAP_NO_REMAP;
  if (reject) {
    TSHttpTxnStatusSet(txnp, httpStatus);
    resultStatus = TSREMAP_DID_REMAP;
  } else {
    data->_vaState = status;
  }
  TSHttpTxnConfigIntSet(txnp, TS_CONFIG_HTTP_CACHE_HTTP, 0);

  return resultStatus;
}

/**
 * @brief Formats the time stamp into expires cookie field format
 * @param expires Unix Time
 * @return String containing the date in the appropriate format for the Expires cookie attribute.
 */
String
getCookieExpiresTime(time_t expires)
{
  struct tm tm;
  char      dateTime[1024];
  size_t    dateTimeLen = 1024;

  size_t len = strftime(dateTime, dateTimeLen, "%a, %d %b %Y %H:%M:%S GMT", gmtime_r(&expires, &tm));
  return String(dateTime, len);
}

/**
 * @brief Callback function that handles cache lookup complete state where the access token is checked before serving from cache.
 *
 * If cache-miss or cache-skip don't validate - request will be forwarded to the origin and will be validated anyway.
 * If cache-hit or cache-hit-stale - validate access token and if validation fails force a cache-miss so request will be forwarded
 * to origin and validated.
 *
 * @param contp continuation associated with this function.
 * @param event corresponding event triggered at different hooks.
 * @param edata HTTP transaction structures (access control plugin config).
 * @return always 0
 */
int
contHandleAccessControl(const TSCont contp, TSEvent event, void *edata)
{
  TSHttpTxn                  txnp        = static_cast<TSHttpTxn>(edata);
  AccessControlTxnData      *data        = static_cast<AccessControlTxnData *>(TSContDataGet(contp));
  const AccessControlConfig *config      = data->_config;
  TSEvent                    resultEvent = TS_EVENT_HTTP_CONTINUE;

  AccessControlDebug("event: '%s'", getEventName(event));

  switch (event) {
  case TS_EVENT_HTTP_SEND_RESPONSE_HDR: {
    if (VALID != data->_vaState && !config->_respTokenHeaderName.empty() && !config->_cookieName.empty()) {
      /* Set the cookie only if
       * - the initial client cookie validation failed (missing or invalid cookie)
       * - we expect a new access token from the origin
       * - provided token from the origin is valid
       * - and we know the name of the cookie to do set-cookie */

      TSMBuffer clientRespBufp;
      TSMLoc    clientRespHdrLoc;
      if (TS_SUCCESS == TSHttpTxnClientRespGet(txnp, &clientRespBufp, &clientRespHdrLoc)) {
        TSMBuffer serverRespBufp;
        TSMLoc    serverRespHdrLoc;
        if (TS_SUCCESS == TSHttpTxnServerRespGet(txnp, &serverRespBufp, &serverRespHdrLoc)) {
          AccessControlDebug("got the response now create the cookie");

          static const size_t MAX_HEADER_LEN = 4096;

          int  tokenHdrValueLen = MAX_HEADER_LEN;
          char tokenHdrValue[MAX_HEADER_LEN];

          getHeader(serverRespBufp, serverRespHdrLoc, config->_respTokenHeaderName.c_str(), config->_respTokenHeaderName.size(),
                    tokenHdrValue, &tokenHdrValueLen);

          if (0 < tokenHdrValueLen) {
            AccessControlDebug("origin response access token '%.*s'", tokenHdrValueLen, tokenHdrValue);

            AccessToken *token = config->_tokenFactory->getAccessToken();
            if (nullptr != token &&
                VALID == (data->_originState = token->validate(StringView(tokenHdrValue, tokenHdrValueLen), time(nullptr)))) {
              /*
               * From RFC 6265 "HTTP State Management Mechanism":
               * To maximize compatibility with user agents, servers that wish to
               * store arbitrary data in a cookie-value SHOULD encode that data, for
               * example, using Base64 [RFC4648].
               */
              int    b64TokenHdrValueLen = cryptoBase64EncodedSize(tokenHdrValueLen);
              char   b64TokenHdrValue[b64TokenHdrValueLen];
              size_t b64CookieLen =
                cryptoModifiedBase64Encode(tokenHdrValue, tokenHdrValueLen, b64TokenHdrValue, b64TokenHdrValueLen);

              String cookieValue;
              cookieValue.append(config->_cookieName).append("=").append(b64TokenHdrValue, b64CookieLen).append("; ");

              /** Currently Access Token implementation requires expiration to be set but the following is still a good
               * consideration. Set the cookie Expires field to the token expiration field set by the origin if the time specified
               * is invalid or not specified then don't set Expires attribute.
               * The "exp=0" is a special case to make Session Cookie by NOT appending the Expires attribute.
               * @todo TBD may be adding a default / overriding Expires attribute configured by parameter would make sense ? */
              time_t t = token->getExpiration();
              if (0 != t) {
                cookieValue.append("Expires=").append(getCookieExpiresTime(t)).append("; ");
              }

              /* Secure   - instructs the UA to include the cookie in an HTTP request only if the request is transmitted over
               *            a secure channel, typically HTTP over Transport Layer Security (TLS)
               * HttpOnly - instructs the UA to omit the cookie when providing access to cookies via "non-HTTP" APIs such as a web
               *            browser API that exposes cookies to scripts */
              cookieValue.append("path=/; Secure; HttpOnly");

              AccessControlDebug("%.*s: %s", TS_MIME_LEN_SET_COOKIE, TS_MIME_FIELD_SET_COOKIE, cookieValue.c_str());
              setHeader(clientRespBufp, clientRespHdrLoc, TS_MIME_FIELD_SET_COOKIE, TS_MIME_LEN_SET_COOKIE, cookieValue.c_str(),
                        cookieValue.size(), /* duplicateOk = */ true);

              delete token;
            } else {
              AccessControlDebug("failed to construct a valid origin access token, did not set-cookie with it");
              /* Don't set any cookie, fail the request here returning appropriate status code and body.*/
              TSHttpTxnStatusSet(txnp, config->_invalidOriginResponse);
              static const char *body    = "Unexpected Response From the Origin Server\n";
              size_t             bufsize = strlen(body) + 1;
              char              *buf     = static_cast<char *>(TSmalloc(bufsize));
              snprintf(buf, bufsize, "%s", body);
              TSHttpTxnErrorBodySet(txnp, buf, strlen(buf), nullptr);

              resultEvent = TS_EVENT_HTTP_ERROR;
              break;
            }
          } else {
            AccessControlDebug("no access token response header found");
          }

          /* Remove the origin response access token header. */
          int numberOfFields = removeHeader(clientRespBufp, clientRespHdrLoc, config->_respTokenHeaderName.c_str(),
                                            config->_respTokenHeaderName.size());
          AccessControlDebug("removed %d %s client response header(s)", numberOfFields, config->_respTokenHeaderName.c_str());

          TSHandleMLocRelease(serverRespBufp, TS_NULL_MLOC, serverRespHdrLoc);
        } else {
          int   len;
          char *url = TSHttpTxnEffectiveUrlStringGet(txnp, &len);
          AccessControlError("failed to retrieve server response header for request url:%.*s",
                             (len ? len : static_cast<int>(UNKNOWN.size())), (url ? url : UNKNOWN.data()));
        }

        TSHandleMLocRelease(clientRespBufp, TS_NULL_MLOC, clientRespHdrLoc);
      } else {
        int   len;
        char *url = TSHttpTxnEffectiveUrlStringGet(txnp, &len);
        AccessControlError("failed to retrieve client response header for request url:%.*s",
                           (len ? len : static_cast<int>(UNKNOWN.size())), (url ? url : UNKNOWN.data()));
      }
    }
  } break;

  case TS_EVENT_HTTP_TXN_CLOSE: {
    if (!config->_extrValidationHdrName.empty()) {
      TSMBuffer clientRespBufp;
      TSMLoc    clientRespHdrLoc;

      /* Add some debugging / logging to the client request so it can be extracted through headers */
      if (TS_SUCCESS == TSHttpTxnClientReqGet(txnp, &clientRespBufp, &clientRespHdrLoc)) {
        String     statusHeader;
        StringView vaState(accessTokenStatusToString(data->_vaState));
        StringView originState(accessTokenStatusToString(data->_originState));

        /* UC_ = UA Cookie, to store the token validation status when extracted from HTTP cookie */
        if (!vaState.empty()) {
          statusHeader.append("UC_").append(vaState);
        }
        /* OH_ = origin response header, to store the token validation status when extracted from origin response header. */
        if (!originState.empty()) {
          statusHeader.append(vaState.empty() ? "" : ",");
          statusHeader.append("OH_").append(originState);
        }
        AccessControlDebug("adding header %s: '%s'", config->_extrValidationHdrName.c_str(), statusHeader.c_str());
        setHeader(clientRespBufp, clientRespHdrLoc, config->_extrValidationHdrName.c_str(), config->_extrValidationHdrName.size(),
                  statusHeader.c_str(), statusHeader.length());

      } else {
        AccessControlError("failed to retrieve client response header");
      }
    }

    /* Destroy the txn continuation and its data */
    delete data;
    TSContDestroy(contp);
  } break;
  default:
    break;
  }

  TSHttpTxnReenable(txnp, resultEvent);
  return 0;
}

/**
 * @brief Enforces access control, currently supports access token from a cookie.
 *
 * @param instance plugin instance pointer
 * @param txn transaction handle
 * @param rri remap request info pointer
 * @param config pointer to the plugin configuration
 * @return TSREMAP_NO_REMAP (access validation = success)
 * TSREMAP_DID_REMAP (access validation = failure and rejection of failed requests is configured)
 */
TSRemapStatus
enforceAccessControl(TSHttpTxn txnp, TSRemapRequestInfo *rri, AccessControlConfig *config)
{
  if (config->_cookieName.empty()) {
    /* For now only checking a cookie is supported and if its name is unknown (checking cookie disabled) then do nothing. */
    return TSREMAP_NO_REMAP;
  }

  TSRemapStatus remapStatus = TSREMAP_NO_REMAP;

  /* Create txn data and register hooks */
  AccessControlTxnData *data = new AccessControlTxnData(config);
  TSCont                cont = TSContCreate(contHandleAccessControl, TSMutexCreate());
  TSContDataSet(cont, static_cast<void *>(data));
  TSHttpTxnHookAdd(txnp, TS_HTTP_SEND_RESPONSE_HDR_HOOK, cont);
  TSHttpTxnHookAdd(txnp, TS_HTTP_TXN_CLOSE_HOOK, cont);

  /* Validate the token */
  bool   reject = config->_rejectRequestsWithInvalidTokens;
  String cookie;
  bool   found = getCookieByName(txnp, rri->requestBufp, rri->requestHdrp, config->_cookieName, cookie);
  if (found) {
    AccessControlDebug("%s cookie: '%s'", config->_cookieName.c_str(), cookie.c_str());

    /*
     * From RFC 6265 "HTTP State Management Mechanism":
     * To maximize compatibility with user agents, servers that wish to
     * store arbitrary data in a cookie-value SHOULD encode that data, for
     * example, using Base64 [RFC4648].
     */
    size_t decodedCookieBufferSize = cryptoBase64DecodeSize(cookie.c_str(), cookie.size());
    char   decodedCookie[decodedCookieBufferSize];
    size_t decryptedCookieSize = cryptoModifiedBase64Decode(cookie.c_str(), cookie.size(), decodedCookie, decodedCookieBufferSize);
    if (0 < decryptedCookieSize) {
      AccessToken *token = config->_tokenFactory->getAccessToken();
      if (nullptr != token) {
        data->_vaState = token->validate(StringView(decodedCookie, decryptedCookieSize), time(nullptr));
        if (VALID != data->_vaState) {
          remapStatus =
            handleInvalidToken(txnp, data, reject, accessTokenStateToHttpStatus(data->_vaState, config), data->_vaState);
        } else {
          /* Valid token, if configured extract the token subject to a header,
           * only if we can trust it - token is valid to prevent using it by mistake */
          if (!config->_extrSubHdrName.empty()) {
            String sub(token->getSubject());
            setHeader(rri->requestBufp, rri->requestHdrp, config->_extrSubHdrName.c_str(), config->_extrSubHdrName.size(),
                      sub.c_str(), sub.size());
          }
        }
        /* If configure extract the UA token id into a header likely for debugging,
         * extract it even if token validation fails and we don't trust it */
        if (!config->_extrTokenIdHdrName.empty()) {
          String tokeId(token->getTokenId());
          setHeader(rri->requestBufp, rri->requestHdrp, config->_extrTokenIdHdrName.c_str(), config->_extrTokenIdHdrName.size(),
                    tokeId.c_str(), tokeId.size());
        }
        delete token;
      } else {
        AccessControlDebug("failed to construct access token");
        remapStatus = handleInvalidToken(txnp, data, reject, config->_internalError, UNUSED);
      }
    } else {
      AccessControlDebug("failed to decode cookie value");
      remapStatus = handleInvalidToken(txnp, data, reject, config->_invalidRequest, UNUSED);
    }
  } else {
    AccessControlDebug("failed to find cookie %s", config->_cookieName.c_str());
    remapStatus = handleInvalidToken(txnp, data, reject, config->_invalidRequest, UNUSED);
  }

  return remapStatus;
}

/**
 * @brief Remap and sets up access control based on whether access control is required, failed, etc.
 *
 * @param instance plugin instance pointer
 * @param txn transaction handle
 * @param rri remap request info pointer
 * @return TSREMAP_NO_REMAP (access validation = success)
 * TSREMAP_DID_REMAP (access validation = failure and rejection of failed requests is configured)
 */
TSRemapStatus
TSRemapDoRemap(void *instance, TSHttpTxn txnp, TSRemapRequestInfo *rri)
{
  TSRemapStatus        remapStatus = TSREMAP_NO_REMAP;
  AccessControlConfig *config      = static_cast<AccessControlConfig *>(instance);

  if (nullptr != config) {
    /* Plugin is designed to be used only with TLS, check the scheme */
    int         schemeLen = 0;
    const char *scheme    = TSUrlSchemeGet(rri->requestBufp, rri->requestUrl, &schemeLen);
    if (nullptr != scheme) {
      if (/* strlen("https") */ 5 == schemeLen && 0 == strncmp(scheme, "https", schemeLen)) {
        AccessControlDebug("validate the access token");

        String      reqPath;
        int         pathLen = 0;
        const char *path    = TSUrlPathGet(rri->requestBufp, rri->requestUrl, &pathLen);
        if (nullptr != path && 0 < pathLen) {
          reqPath.assign(path, pathLen);
        }
        /* Check if any of the uri-path multi-pattern matched and if yes enforce access control. */
        String filename;
        String pattern;
        if (config->_uriPathScope.empty()) {
          /* Scope match enforce access control */
          AccessControlDebug("no plugin scope specified, enforcing access control");
          remapStatus = enforceAccessControl(txnp, rri, config);
        } else {
          if (true == config->_uriPathScope.matchAll(reqPath, filename, pattern)) {
            AccessControlDebug("matched plugin scope enforcing access control for path %s", reqPath.c_str());

            /* Scope match enforce access control */
            remapStatus = enforceAccessControl(txnp, rri, config);
          } else {
            AccessControlDebug("not matching plugin scope (file: %s, pattern %s), skipping access control for path '%s'",
                               filename.c_str(), pattern.c_str(), reqPath.c_str());
          }
        }
      } else {
        TSHttpTxnStatusSet(txnp, config->_invalidRequest);
        AccessControlDebug("https is the only allowed scheme (plugin should be used only with TLS)");
        remapStatus = TSREMAP_DID_REMAP;
      }
    } else {
      TSHttpTxnStatusSet(txnp, config->_internalError);
      AccessControlError("failed to get request uri-scheme");
      remapStatus = TSREMAP_DID_REMAP;
    }
  } else {
    /* Something is terribly wrong, we cannot get the configuration */
    TSHttpTxnStatusSet(txnp, TS_HTTP_STATUS_INTERNAL_SERVER_ERROR);
    AccessControlError("configuration unavailable");
    remapStatus = TSREMAP_DID_REMAP;
  }

  return remapStatus;
}
