Credentials.cs

// =============================================================================
// GPAL - Generally Positive Automation Library
// Copyright © 2026 Software Decisions, Inc. All rights reserved.
//
// This file is part of GPAL.
// Licensed under the Business Source License 1.1
//
// Primary development, architecture, and vision by Michael B. Vederman,
// CEO of Software Decisions, Inc., Texas.
//
// Internal development maintained privately.
// Public releases appear on GitHub: https://github.com/SoftwareDecisionsInc/GPAL.
//
// See LICENSE for full terms, including Additional Use Grant.
// =============================================================================
 
using System;
using System.Collections.Generic;
using System.Collections.Specialized;
using System.Diagnostics;
using System.Drawing;
using System.IO;
using System.Linq;
using System.Net;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Text.Json.Serialization;
using System.Threading;
using System.Threading.Tasks;
using GenerallyPositive;
using GenerallyPositive.Application;
using GenerallyPositive.Browser;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.OpenSsl;
using Org.BouncyCastle.Security;
using static GenerallyPositive.Enums;
 
 
namespace GenerallyPositive
{
    public class CredentialsConfig
    {
        private static string ConfigFilePath { get; set; } = "./credentialsConfig.json";

        public bool UseRestRedirect { get; set; } = true;  // passthru redirect to GPALRESTAPI vs manual auth url where the user gets an authcode string
 
        // Google
        public string GoogleConsentBase { get; set; } = "https://accounts.google.com";
        public string GoogleAuthBase { get; set; } = "https://oauth2.googleapis.com";
        public string GoogleAuthEndpoint { get; set; } = "/token";
        public string GoogleRedirectUri { get; set; } = "urn:ietf:wg:oauth:2.0:oob";
        public string GoogleRestRedirectUri { get; set; } = "http://localhost:3000/access-token";
        public string GoogleAuthCodeKey { get; set; } = "code";
        public string GoogleServiceAccountTokenUri { get; set; } = "https://oauth2.googleapis.com/token";
 
        // Azure
        public string AzureAuthBase { get; set; } = "https://login.microsoftonline.com/common";
        public string AzureAuthEndpoint { get; set; } = "/oauth2/v2.0/token";
        public string AzureRedirectUri { get; set; } = "urn:ietf:wg:oauth:2.0:oob";
 
        // AWS Cognito
        public string AWSAuthBase { get; set; } = "https://your-domain.auth.{region}.amazoncognito.com"; // Replace with your Cognito domain
        public string AWSAuthEndpoint { get; set; } = "/oauth2/token";
        public string AWSRedirectUri { get; set; } = "urn:ietf:wg:oauth:2.0:oob";
 
        // Bitwarden
        public string BitwardenAuthBase { get; set; } = "https://identity.bitwarden.com";
        public string BitwardenVaultBase { get; set; } = "https://api.bitwarden.com";
        public string BitwardenAuthEndpoint { get; set; } = "/connect/token";
        public string BitwardenVaultEndpoint { get; set; } = "/public/vault/items";
 
        // Shared
        public string AuthorizationHeader { get; set; } = "Authorization";
        public string GrantTypeKey { get; set; } = "grant_type";
        public string GrantTypeValue { get; set; } = "password";
        public string UsernameKey { get; set; } = "username";
        public string PasswordKey { get; set; } = "password";
        public string ClientIdKey { get; set; } = "client_id";
        public string ClientSecretKey { get; set; } = "client_secret";
        public string SearchKey { get; set; } = "search";
        public string AccessTokenKey { get; set; } = "access_token";

        public static CredentialsConfig Load(GPALFile file = null)
        {
            if (file != null) ConfigFilePath = file.Filename;
            if (true == File.Exists(ConfigFilePath))
            {
                try
                {
                    var loaded = new CredentialsConfig();
                    GPAL.Converter
                        .WithInput((GPALFile)ConfigFilePath)
                        .SaveTo(ref loaded);
                    return loaded;
                }
                catch (Exception ex)
                {
                    GPAL.PublishSimpleEvent(GPALEventType.WARNING, $"Failed to load credentials config from file", null, GPALObjectType.None, ex);
                }
            }
            else
                Save();
 
            return new CredentialsConfig();
        }

        public static void Save(GPALFile file = null)
        {
            if (file != null) ConfigFilePath = file.Filename;
            GPAL.Converter
                .WithInput(new CredentialsConfig())
                .SaveTo((GPALFile)ConfigFilePath);
        }
    }

    public class AuthCodePayload
    {
        public string Code { get; set; }
        public string Scope { get; set; }
 
        public AuthCodePayload()
        { }
    }

    public class GoogleServiceAccountKey
    {
        public string Type { get; set; }
        public string ProjectId { get; set; }
        public string PrivateKeyId { get; set; }
        public string PrivateKey { get; set; }
        public string ClientEmail { get; set; }
        public string ClientId { get; set; }
        public string AuthUri { get; set; }
        public string TokenUri { get; set; }
        public string AuthProviderX509CertUrl { get; set; }
        public string ClientX509CertUrl { get; set; }
 
        public GoogleServiceAccountKey() { }
    }

    public class BitwardenTokenResponse
    {
        [JsonPropertyName("access_token")]
        public string AccessToken { get; set; }

        [JsonPropertyName("expires_in")]
        public int ExpiresIn { get; set; }

        [JsonPropertyName("refresh_token")]
        public string RefreshToken { get; set; }

        [JsonPropertyName("token_type")]
        public string TokenType { get; set; }
    }
 

    internal class BitwardenVaultResponse
    {
        public List<BitwardenVaultItem> Data { get; set; }
    }

    internal class BitwardenVaultItem
    {
        public BitwardenLogin Login { get; set; }
    }

    internal class BitwardenLogin
    {
        public string Username { get; set; }
        public string Password { get; set; }
        public List<BitwardenUri> Uris { get; set; }
    }

    internal class BitwardenUri
    {
        public string Uri { get; set; }
    }

    public class GoogleTokenResponse
    {
        [JsonPropertyName("access_token")]
        public string AccessToken { get; set; }

        [JsonPropertyName("expires_in")]
        public int ExpiresIn { get; set; }

        [JsonPropertyName("refresh_token")]
        public string RefreshToken { get; set; }

        [JsonPropertyName("token_type")]
        public string TokenType { get; set; }
    }

    public class AzureTokenResponse
    {
        [JsonPropertyName("access_token")]
        public string AccessToken { get; set; }

        [JsonPropertyName("expires_in")]
        public int ExpiresIn { get; set; }

        [JsonPropertyName("refresh_token")]
        public string RefreshToken { get; set; }

        [JsonPropertyName("scope")]
        public string Scope { get; set; }

        [JsonPropertyName("token_type")]
        public string TokenType { get; set; }
    }

    public class AWSTokenResponse
    {
        [JsonPropertyName("access_token")]
        public string AccessToken { get; set; }

        [JsonPropertyName("expires_in")]
        public int ExpiresIn { get; set; }

        [JsonPropertyName("refresh_token")]
        public string RefreshToken { get; set; }

        [JsonPropertyName("token_type")]
        public string TokenType { get; set; }

        [JsonPropertyName("id_token")]
        public string IdToken { get; set; }
    }

    public class LastPassItem
    {
        public string Id { get; set; }
        public string Name { get; set; }
        public string Url { get; set; }
        public string Username { get; set; }
        public string Password { get; set; }
        public string Notes { get; set; }
    }

    public class OnePasswordItem
    {
        public string Id { get; set; }
        public string Title { get; set; }
        public string Vault { get; set; }           // vault name or id
        public List<OnePasswordField> Fields { get; set; } = new List<OnePasswordField>();
        public List<OnePasswordUrl> Urls { get; set; }
    }

    public class OnePasswordUrl
    {
        public string Href { get; set; }
    }

    public class OnePasswordField
    {
        public string Id { get; set; }
        public string Label { get; set; }
        public string Type { get; set; }
        public string Value { get; set; }
        public string Reference { get; set; }       // for secrets that are references
    }

    public class DashlaneItem
    {
        public string Id { get; set; }
        public string Title { get; set; }
        public string Url { get; set; }
        public string Username { get; set; }
        public string Password { get; set; }
        public string Otp { get; set; }
        public string Notes { get; set; }
    }

    public class KeeperRecord
    {
        public string RecordUid { get; set; }
        public string Title { get; set; }
        public string RecordType { get; set; }
        public KeeperLoginData Login { get; set; }
        public string Notes { get; set; }
    }

    public class KeeperLoginData
    {
        public string Username { get; set; }
        public string Password { get; set; }
        public string Url { get; set; }
    }
 
    [InProgress("Credential class to get access tokens and credentials from password managers. Untested. 50%")]
    public class Credentials : ICredentials
    {
        internal CredentialServiceType ServiceType { get; private set; }
        public string Username { get; private set; }
        internal string Password { get; private set; }
        public string ServiceKey { get; private set; }
        public WebAuthType WebAuthType { get; private set; }
        private IRESTClient _keyFromApiRestClient;
        public string ClientId { get; internal set; }
        public string ClientSecret { get; internal set; }
        public string AccessToken { get; internal set; }
        public string Target { get; private set; }
        public string Domain { get; private set; }
        public CredentialsConfig Config { get; private set; }
        public string AuthCode { get; set; }
        public string RefreshToken { get; set; }
        public OAuthScope OAuthScope { get; set; }
        internal GoogleTokenResponse GoogleTokenResponse { get; set; }
        internal AWSTokenResponse AWSTokenResponse { get; set; }
        internal AzureTokenResponse AzureTokenResponse { get; set; }
        internal BitwardenTokenResponse BitwardenTokenResponse { get; set; }
        internal string ServiceAccountKeyJson { get; set; }
        internal DateTime IssueTime { get; set; }
        private int _expiresIn = 0;
        internal int ExpiresIn
        {
            get => _expiresIn;
            set
            {
                _expiresIn = value;
                ExpiresAt = DateTime.UtcNow.AddSeconds(_expiresIn);
            }
        }
        internal DateTime ExpiresAt { get; set; }
        internal Browser.Browser Browser { get; set; }
 
        // =======================================================
        // HELPERS
        // =======================================================
        internal static (string, string) SafeSplit(string value)
        {
            if (string.IsNullOrEmpty(value)) return ("", "");
            var parts = value.Split(new[] { ':' }, 2);
            return (parts[0], parts.Length > 1 ? parts[1] : "");
        }

        internal static bool MatchesDomain(string url, string domain)
        {
            if (string.IsNullOrEmpty(domain)) return true;
            if (string.IsNullOrEmpty(url)) return false;
            return url.IndexOf(domain, StringComparison.OrdinalIgnoreCase) >= 0;
        }

        internal static bool MatchesDomain(IEnumerable<string> urls, string domain)
        {
            if (string.IsNullOrEmpty(domain)) return true;
            if (urls == null) return false;
            return urls.Any(url => MatchesDomain(url, domain));
        }

        private void EnsureValidToken(out string accessToken)
        {
            if (IsTokenExpired())
                FetchAccessToken(out accessToken);
            else
                accessToken = AccessToken;
        }
        internal static string GetScopeValue(OAuthScope scope)
        {
            switch (scope)
            {
                // Google
                case OAuthScope.Google_Sheets:
                    return "https://www.googleapis.com/auth/spreadsheets";
                case OAuthScope.Google_Drive:
                    return "https://www.googleapis.com/auth/drive";
                case OAuthScope.Google_CloudPlatform:
                    return "https://www.googleapis.com/auth/cloud-platform";
                case OAuthScope.YouTube_Upload:
                    return "https://www.googleapis.com/auth/youtube.upload";
                case OAuthScope.YouTube_Manage:
                    return "https://www.googleapis.com/auth/youtube";
 
                // Azure
                case OAuthScope.Azure_GraphUserRead:
                    return "https://graph.microsoft.com/User.Read";
                case OAuthScope.Azure_GraphMailRead:
                    return "https://graph.microsoft.com/Mail.Read";
                case OAuthScope.Azure_Storage:
                    return "https://storage.azure.com/user_impersonation";
                case OAuthScope.Azure_Management:
                    return "https://management.azure.com/user_impersonation";
 
                // AWS
                case OAuthScope.AWS_CognitoOpenId:
                    return "openid";
                case OAuthScope.AWS_CognitoProfile:
                    return "profile";
                case OAuthScope.AWS_APIGatewayCustom:
                    return "myapp/read"; // your custom
 
                default:
                    GPAL.PublishSimpleEvent(GPALEventType.ERROR, $"Unsupported scope: [{scope}]", scope, GPALObjectType.Other);
                    return string.Empty;
            }
        }
 
        // =======================================================
        // FLUENT interface
        // =======================================================
        public IAllowCredentialSettings WithScope(OAuthScope scope)
        {
            OAuthScope = scope;
            return this;
        }

        public IAllowCredentialSettings WithAuthCode(string authCode)
        {
            AuthCode = authCode;
            return this;
        }

        public IAllowCredentialSettings WithRefreshToken(string refreshToken)
        {
            RefreshToken = refreshToken;
            return this;
        }
 
        internal Credentials(Browser.Browser browser)
        {
            Config = CredentialsConfig.Load();
            Browser = browser;
        }

        public IAllowCredentialMethod WithService(CredentialServiceType serviceType)
        {
            ServiceType = serviceType;
            return this;
        }

        public IAllowCredentialsPassword WithUsername(string username)
        {
            Username = username;
            return this;
        }

        public IAllowOAuthClient WithPassword(string password)
        {
            Password = password;
            return this;
        }

        public IAllowOAuthClient WithWebAuth(WebAuthType webAuthType)
        {
            WebAuthType = webAuthType;
            return this;
        }

        public IAllowOAuthClient WithAuthRedirectUrl(string redirectUrl)
        {
            Config.GoogleRestRedirectUri = redirectUrl;
            return this;
        }

        public IAllowOAuthClient WithAccessToken(string accessToken)
        {
            AccessToken = accessToken;
            return this;
        }

        public IAllowCredentialSettings WithDomain(string domain)
        {
            Domain = domain;
            return this;
        }

        public IAllowClientSecret WithClientId(string clientId)
        {
            ClientId = clientId;
            return this;
        }

        public IAllowCredentialSettings WithClientSecret(string clientSecret)
        {
            ClientSecret = clientSecret;
            ServiceKey = $"{ClientId}:{clientSecret}";
            return this;
        }

        public IAllowCredentialSettings WithServiceKey(string key)
        {
            ServiceKey = key;
            var parts = SafeSplit(key);
            ClientId = parts.Item1;
            ClientSecret = parts.Item2;
            return this;
        }

        public IAllowCredentialSettings WithKeyFromEnv(string envVariableName)
        {
            string key = Environment.GetEnvironmentVariable(envVariableName, EnvironmentVariableTarget.Process)
                ?? Environment.GetEnvironmentVariable(envVariableName, EnvironmentVariableTarget.User)
                ?? Environment.GetEnvironmentVariable(envVariableName, EnvironmentVariableTarget.Machine);
 
            if (string.IsNullOrEmpty(key))
            {
                GPAL.PublishSimpleEvent(
                    GPALEventType.ERROR,
                    $"Environment variable [{envVariableName}] is not set or empty.",
                    null,
                    GPALObjectType.None);
                return this;
            }
 
            return WithServiceKey(key);
        }

        public IAllowKeyFromApiEndpoint WithKeyFromApi(IRESTClient restClient)
        {
            _keyFromApiRestClient = restClient;
            return this;
        }

        public IAllowCredentialSettings WithEndpoint(string endpoint)
        {
            string key = _keyFromApiRestClient
                .WithEndpoint(endpoint)
                .Execute();
 
            if (string.IsNullOrEmpty(key))
            {
                GPAL.PublishSimpleEvent(
                    GPALEventType.ERROR,
                    $"REST API returned no key for endpoint [{endpoint}].",
                    null,
                    GPALObjectType.None);
                return this;
            }
 
            return WithServiceKey(key);
        }

        public IAllowCredentialSettings WithServiceAccountKey(GPALFile serviceAccountKeyFile)
        {
            if (serviceAccountKeyFile == null || string.IsNullOrWhiteSpace(serviceAccountKeyFile.Filename) || !File.Exists(serviceAccountKeyFile.Filename))
            {
                GPAL.PublishSimpleEvent(
                    GPALEventType.ERROR,
                    $"Service account key file missing or not found: [{serviceAccountKeyFile?.Filename ?? "<null>"}]",
                    null,
                    GPALObjectType.None);
                return this;
            }
 
            ServiceAccountKeyJson = File.ReadAllText(serviceAccountKeyFile.Filename);
            return this;
        }

        public IAllowCredentialSettings WithServiceAccountKey(string serviceAccountKey)
        {
            if (string.IsNullOrWhiteSpace(serviceAccountKey))
            {
                GPAL.PublishSimpleEvent(
                    GPALEventType.ERROR,
                    "Service account key JSON string is empty.",
                    null,
                    GPALObjectType.None);
                return this;
            }
 
            ServiceAccountKeyJson = serviceAccountKey;
            return this;
        }

        public IAllowCredentialSettings WithServiceAccountKey(GoogleServiceAccountKey serviceAccountKey)
        {
            if (serviceAccountKey == null)
            {
                GPAL.PublishSimpleEvent(
                    GPALEventType.ERROR,
                    "Service account key object is null.",
                    null,
                    GPALObjectType.None);
                return this;
            }
 
            try
            {
                ServiceAccountKeyJson = System.Text.Json.JsonSerializer.Serialize(serviceAccountKey);
            }
            catch (Exception ex)
            {
                GPAL.PublishSimpleEvent(
                    GPALEventType.EXCEPTION,
                    $"Failed to serialize service account key object",
                    null,
                    GPALObjectType.None, ex);
            }
            return this;
        }

        public IAllowCredentialSettings WithMasterCredentials(ICredentials masterCredentials)
        {
            if (masterCredentials is Credentials master)
            {
                Username = master.Username;
                Password = master.Password;
                ServiceKey = master.ServiceKey;
                ClientId = master.ClientId;
                ClientSecret = master.ClientSecret;
                ServiceAccountKeyJson = master.ServiceAccountKeyJson;
                AccessToken = master.AccessToken;
                RefreshToken = master.RefreshToken;
                OAuthScope = master.OAuthScope;
            }
 
            return this;
        }

        public IAllowCredentialSettings GetCredentialsFor(string target)
        {
            Target = target;
            if (ServiceType != CredentialServiceType.None)
            {
                EnsureValidToken(out string accessToken);
            }
            return this;
        }

        public IAllowGetCredentials SaveTo(IGPALGrid<string> grid)
        {
            if (grid == null)
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR, "Grid cannot be null in SaveTo.", null, GPALObjectType.None);
                return this;
            }
 
            var credentials = ServiceType switch
            {
                CredentialServiceType.Bitwarden => BitwardenHandler.Handle(this),
                CredentialServiceType.LastPass => LastPassHandler.Handle(this),
                CredentialServiceType.OnePassword => OnePasswordHandler.Handle(this),
                CredentialServiceType.Dashlane => DashlaneHandler.Handle(this),
                CredentialServiceType.Keeper => KeeperHandler.Handle(this),
                CredentialServiceType.None => DirectHandler.Handle(this),
 
                _ => throw new NotSupportedException(
                        $"SaveTo is not supported for CredentialServiceType.{ServiceType}.")
            };
 
            GPAL.PublishSimpleEvent(GPALEventType.INFO, $"Saving [{credentials.Count()}] credentials from [{ServiceType}] to grid.", null, GPALObjectType.None);
 
            foreach (var credential in credentials)
            {
                grid.AddRow(new List<string> { credential.Username, credential.Password });
            }
 
            return this;
        }

        public ICredentials ToGPALObject()
        {
            return this;
        }

        public void FetchAccessToken(out string accessToken)
        {
            switch (ServiceType)
            {
                case CredentialServiceType.Google:
                    if (!string.IsNullOrEmpty(ServiceAccountKeyJson))
                    {
                        AccessToken = GoogleHandler.FetchServiceAccountToken(this);
                    }
                    else
                    {
                        AccessToken = GoogleHandler.FetchAccessToken(this); // Fallback to OAuth flow
                    }
                    break;
                case CredentialServiceType.AWS:
                    AccessToken = AWSHandler.FetchAccessToken(this);
                    break;
                case CredentialServiceType.Azure:
                    AccessToken = AzureHandler.FetchAccessToken(this);
                    break;
                case CredentialServiceType.Bitwarden:
                    AccessToken = BitwardenHandler.FetchAccessToken(this);
                    break;
                case CredentialServiceType.Dashlane:
                    AccessToken = DashlaneHandler.FetchAccessToken(this);
                    break;
                case CredentialServiceType.Keeper:
                    AccessToken = KeeperHandler.FetchAccessToken(this);
                    break;
                case CredentialServiceType.LastPass:
                    AccessToken = LastPassHandler.FetchAccessToken(this);
                    break;
                case CredentialServiceType.OnePassword:
                    AccessToken = OnePasswordHandler.FetchAccessToken(this);
                    break;
                case CredentialServiceType.StaticKey:
                    // The key supplied via .WithServiceKey/.WithKeyFromEnv/.WithKeyFromApi IS the credential,
                    // used directly as the Bearer/x-api-key header value - nothing to fetch.
                    AccessToken = ServiceKey;
                    break;
                default:
                    GPAL.PublishSimpleEvent(GPALEventType.ERROR, "No access token fetcher for service.", null, GPALObjectType.None);
                    break;
            }
            accessToken = AccessToken;
        }

        private bool IsTokenExpired()
        {
            if (string.IsNullOrEmpty(AccessToken) || IssueTime == DateTime.MinValue) return true;
            return DateTime.UtcNow > ExpiresAt;
        }
    }

    internal class CredentialResult
    {
        public string Username { get; }
        public string Password { get; }
 
        public CredentialResult(string username, string password)
        {
            Username = username;
            Password = password;
        }
    }

    internal static class DirectHandler
    {
        internal static List<CredentialResult> Handle(Credentials creds)
        {
            var results = new List<CredentialResult>();
 
            if (string.IsNullOrEmpty(creds.Username) && string.IsNullOrEmpty(creds.Password))
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR, "Username and Password are both empty.", null, GPALObjectType.None);
                return results;
            }
 
            results.Add(new CredentialResult(creds.Username ?? "", creds.Password ?? ""));
            return results;
        }
    }

    internal static class AWSHandler
    {
        internal static string FetchAccessToken(Credentials creds)
        {
            creds.AccessToken = "";
            if (string.IsNullOrEmpty(creds.ClientId) || string.IsNullOrEmpty(creds.ClientSecret))
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR, "Client ID or Client Secret is missing.", null, GPALObjectType.None);
                return creds.AccessToken;
            }
 
            string scopeUrl = Credentials.GetScopeValue(creds.OAuthScope);
 
            if (!string.IsNullOrEmpty(creds.RefreshToken))
            {
                // Refresh token flow
                var parameters = $"grant_type=refresh_token&" +
                                $"client_id={Uri.EscapeDataString(creds.ClientId)}&" +
                                $"client_secret={Uri.EscapeDataString(creds.ClientSecret)}&" +
                                $"refresh_token={Uri.EscapeDataString(creds.RefreshToken)}";
 
                var client = GPAL.RESTClient
                    .WithAPIBase(creds.Config.AWSAuthBase) // Use config property
                    .WithEndpoint(creds.Config.AWSAuthEndpoint)
                    .WithParameters(parameters);
                var response = client.Execute();
 
                try
                {
                    var authData = System.Text.Json.JsonSerializer.Deserialize<AWSTokenResponse>(response);
 
                    // Note: Cognito may not return a new refresh token
                    if (authData != null)
                    {
                        creds.AccessToken = authData.AccessToken ?? "";
 
                        if (string.IsNullOrEmpty(creds.AccessToken))
                        {
                            GPAL.PublishSimpleEvent(GPALEventType.ERROR, $"Failed to refresh AWS access token. Response: [{response}]", null, GPALObjectType.None);
                        }
                        else if (!string.IsNullOrEmpty(authData?.RefreshToken))
                        {
                            creds.WithRefreshToken(authData.RefreshToken);
                        }
 
                        if (!string.IsNullOrEmpty(creds.AccessToken))
                        {
                            creds.IssueTime = DateTime.UtcNow;
                            creds.ExpiresIn = authData.ExpiresIn;
                        }
                    }
                }
                catch (Exception ex)
                {
                    var errorResponse = System.Text.Json.JsonSerializer.Deserialize<Dictionary<string, string>>(response);
                    string error = errorResponse?.ContainsKey("error") == true ? errorResponse["error"] : "Unknown error";
                    string errorDescription = errorResponse?.ContainsKey("error_description") == true ? errorResponse["error_description"] : "No description";
                    GPAL.PublishSimpleEvent(GPALEventType.ERROR, $"Failed to refresh AWS access token. Error: [{error}], Description: [{errorDescription}]", null, GPALObjectType.None, ex);
                }
            }
            else
            {
                creds.AuthCode = AuthHandler.GetAuthCode(creds);
 
                if (string.IsNullOrEmpty(creds.AuthCode))
                {
                    GPAL.PublishSimpleEvent(GPALEventType.ERROR, "No authorization code provided.", null, GPALObjectType.None);
                }
                else
                {   
                    // Authorization code flow
                    var parameters = $"grant_type=authorization_code&" +
                                $"client_id={Uri.EscapeDataString(creds.ClientId)}&" +
                                $"client_secret={Uri.EscapeDataString(creds.ClientSecret)}&" +
                                $"code={Uri.EscapeDataString(creds.AuthCode)}&" +
                                $"redirect_uri={Uri.EscapeDataString(creds.Config.AWSRedirectUri)}"; // Use AWS-specific redirect URI
 
                    var client = GPAL.RESTClient
                        .WithAPIBase(creds.Config.AWSAuthBase) // Use config property
                        .WithEndpoint(creds.Config.AWSAuthEndpoint)
                        .WithParameters(parameters);
                    var response = client.Execute();
 
                    try
                    {
                        var authData = System.Text.Json.JsonSerializer.Deserialize<AWSTokenResponse>(response);
 
                        if (authData != null)
                        {
                            creds.AccessToken = authData.AccessToken ?? "";
                            if (string.IsNullOrEmpty(creds.AccessToken))
                            {
                                GPAL.PublishSimpleEvent(GPALEventType.ERROR, $"Failed to fetch AWS access token. Response: [{response}]", null, GPALObjectType.None);
                            }
                            else if (!string.IsNullOrEmpty(authData?.RefreshToken))
                            {
                                creds.WithRefreshToken(authData.RefreshToken);
                            }
 
                            if (!string.IsNullOrEmpty(creds.AccessToken))
                            {
                                creds.IssueTime = DateTime.UtcNow;
                                creds.ExpiresIn = authData.ExpiresIn;
                            }
                        }
                    }
                    catch (Exception ex)
                    {
                        var errorResponse = System.Text.Json.JsonSerializer.Deserialize<Dictionary<string, string>>(response);
                        string error = errorResponse?.ContainsKey("error") == true ? errorResponse["error"] : "Unknown error";
                        string errorDescription = errorResponse?.ContainsKey("error_description") == true ? errorResponse["error_description"] : "No description";
                        GPAL.PublishSimpleEvent(GPALEventType.ERROR, $"Failed to fetch AWS access token. Error: [{error}], Description: [{errorDescription}]", null, GPALObjectType.None, ex);
                    }
                }
            }
 
            return creds.AccessToken;
        }
    }
    internal static class AzureHandler
    {
        internal static string FetchAccessToken(Credentials creds)
        {
            creds.AccessToken = "";
            if (string.IsNullOrEmpty(creds.ClientId) || string.IsNullOrEmpty(creds.ClientSecret))
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR, "Client ID or Client Secret is missing.", null, GPALObjectType.None);
                return creds.AccessToken;
            }
 
            string scopeUrl = Credentials.GetScopeValue(creds.OAuthScope);
 
            if (!string.IsNullOrEmpty(creds.RefreshToken))
            {
                // Refresh token flow
                var parameters = $"grant_type=refresh_token&" +
                                $"client_id={Uri.EscapeDataString(creds.ClientId)}&" +
                                $"client_secret={Uri.EscapeDataString(creds.ClientSecret)}&" +
                                $"refresh_token={Uri.EscapeDataString(creds.RefreshToken)}&" +
                                $"scope={Uri.EscapeDataString(scopeUrl)}";
 
                var client = GPAL.RESTClient
                    .WithAPIBase(creds.Config.AzureAuthBase) // Use config property
                    .WithEndpoint(creds.Config.AzureAuthEndpoint)
                    .WithParameters(parameters);
                var response = client.Execute();
 
                try
                {
                    creds.AzureTokenResponse = System.Text.Json.JsonSerializer.Deserialize<AzureTokenResponse>(response);
 
                    if (creds.AzureTokenResponse != null)
                    {
                        creds.AccessToken = creds.AzureTokenResponse.AccessToken ?? "";
 
                        if (!string.IsNullOrEmpty(creds.AccessToken))
                        {
                            creds.ExpiresIn = creds.AzureTokenResponse.ExpiresIn;
                            creds.IssueTime = DateTime.UtcNow;
                        }
 
                        if (!string.IsNullOrEmpty(creds.AzureTokenResponse.RefreshToken))
                        {
                            creds.WithRefreshToken(creds.AzureTokenResponse.RefreshToken);
                        }
                    }
                    else if (string.IsNullOrEmpty(creds.AccessToken))
                    {
                        GPAL.PublishSimpleEvent(GPALEventType.ERROR, $"Failed to refresh Azure access token. Response: [{response}]", null, GPALObjectType.None);
                    }
                }
                catch (Exception ex)
                {
                    var errorResponse = System.Text.Json.JsonSerializer.Deserialize<Dictionary<string, string>>(response);
                    string error = errorResponse?.ContainsKey("error") == true ? errorResponse["error"] : "Unknown error";
                    string errorDescription = errorResponse?.ContainsKey("error_description") == true ? errorResponse["error_description"] : "No description";
                    GPAL.PublishSimpleEvent(GPALEventType.ERROR, $"Failed to refresh Azure access token. Error: [{error}], Description: [{errorDescription}]", null, GPALObjectType.None, ex);
                }
            }
            else
            {
                creds.AuthCode = AuthHandler.GetAuthCode(creds);
 
                if (string.IsNullOrEmpty(creds.AuthCode))
                {
                    GPAL.PublishSimpleEvent(GPALEventType.ERROR, "No authorization code provided.", null, GPALObjectType.None);
                }
                else
                {
                    // Authorization code flow
                    var parameters = $"grant_type=authorization_code&" +
                                $"client_id={Uri.EscapeDataString(creds.ClientId)}&" +
                                $"client_secret={Uri.EscapeDataString(creds.ClientSecret)}&" +
                                $"code={Uri.EscapeDataString(creds.AuthCode)}&" +
                                $"redirect_uri={Uri.EscapeDataString(creds.Config.AzureRedirectUri)}&" + // Use Azure-specific redirect URI
                                $"scope={Uri.EscapeDataString(scopeUrl)}";
 
                    var client = GPAL.RESTClient
                        .WithAPIBase(creds.Config.AzureAuthBase) // Use config property
                        .WithEndpoint(creds.Config.AzureAuthEndpoint)
                        .WithParameters(parameters);
                    var response = client.Execute();
 
                    try
                    {
                        creds.AzureTokenResponse = System.Text.Json.JsonSerializer.Deserialize<AzureTokenResponse>(response);
 
                        if (creds.AzureTokenResponse != null)
                        {
                            creds.AccessToken = creds.AzureTokenResponse.AccessToken ?? "";
 
                            if (string.IsNullOrEmpty(creds.AccessToken))
                            {
                                GPAL.PublishSimpleEvent(GPALEventType.ERROR, $"Failed to fetch Azure access token. Response: [{response}]", null, GPALObjectType.None);
                            }
                            else if (!string.IsNullOrEmpty(creds.AzureTokenResponse?.RefreshToken))
                            {
                                creds.WithRefreshToken(creds.AzureTokenResponse.RefreshToken);
                            }
 
                            if (!string.IsNullOrEmpty(creds.AccessToken))
                            {
                                creds.ExpiresIn = creds.AzureTokenResponse.ExpiresIn;
                                creds.IssueTime = DateTime.UtcNow;
                            }
                        }
                    }
                    catch (Exception ex)
                    {
                        var errorResponse = System.Text.Json.JsonSerializer.Deserialize<Dictionary<string, string>>(response);
                        string error = errorResponse?.ContainsKey("error") == true ? errorResponse["error"] : "Unknown error";
                        string errorDescription = errorResponse?.ContainsKey("error_description") == true ? errorResponse["error_description"] : "No description";
                        GPAL.PublishSimpleEvent(GPALEventType.ERROR, $"Failed to fetch Azure access token. Error: [{error}], Description: [{errorDescription}]", null, GPALObjectType.None, ex);
                    }
                }
            }
 
            return creds.AccessToken;
        }
    }

    internal static class GoogleHandler
    {
        internal static string FetchAccessToken(Credentials creds)
        {
             creds.AccessToken = "";
 
            // the pair Google is called with, whichever way the workflow gave it. WithServiceKey takes both
            // as one "id:secret" value and WithClientId and WithClientSecret take them apart, and both flows
            // below need the same answer, so it is worked out once here
            string clientId = creds.ClientId;
            string clientSecret = creds.ClientSecret;
 
            if (!string.IsNullOrEmpty(creds.ServiceKey))
            {
                var parts = Credentials.SafeSplit(creds.ServiceKey);
                clientId = parts.Item1;
                clientSecret = parts.Item2;
            }
 
            if (string.IsNullOrEmpty(clientId) || string.IsNullOrEmpty(clientSecret))
                GPAL.PublishSimpleEvent(GPALEventType.ERROR, "Google needs a client id and a client secret. Give them to WithClientId and WithClientSecret, or both to WithServiceKey as [id:secret].");
 
            if (!string.IsNullOrEmpty(creds.RefreshToken))
            {
                var parameters = $"grant_type=refresh_token&" +
                    $"client_id={Uri.EscapeDataString(clientId)}&" +
                    $"client_secret={Uri.EscapeDataString(clientSecret)}&" +
                    $"refresh_token={Uri.EscapeDataString(creds.RefreshToken)}";
 
                var response = GPAL.RESTClient
                    .WithAPIBase(creds.Config.GoogleAuthBase)
                    .WithEndpoint(creds.Config.GoogleAuthEndpoint)
                    .WithParameters(parameters)
                    .WithEncoding(ContentEncoding.UrlEncoded)
                    .Execute();
 
                creds.GoogleTokenResponse = System.Text.Json.JsonSerializer.Deserialize<GoogleTokenResponse>(response);
                creds.AccessToken = creds.GoogleTokenResponse?.AccessToken ?? "";
 
                if (!string.IsNullOrEmpty(creds.AccessToken))
                {
                    creds.IssueTime = DateTime.UtcNow;
                    creds.ExpiresIn = creds.GoogleTokenResponse.ExpiresIn;
                }
                else
                {
                    GPAL.PublishSimpleEvent(
                        GPALEventType.ERROR,
                        $"Failed to refresh Google access token. Response: [{response}]",
                        null,
                        GPALObjectType.None);
                }
            }
            else
            {
                creds.AuthCode = AuthHandler.GetAuthCode(creds);
 
                if (string.IsNullOrEmpty(creds.AuthCode))
                {
                    GPAL.PublishSimpleEvent(GPALEventType.ERROR, "No authorization code provided.", null, GPALObjectType.None);
                }
                else
                {
                    string redirectUri = creds.Config.UseRestRedirect
                                         ? creds.Config.GoogleRestRedirectUri
                                         : creds.Config.GoogleRedirectUri;
 
                    var parameters = $"{creds.Config.GrantTypeKey}=authorization_code&" +
                                     $"client_id={Uri.EscapeDataString(clientId)}&" +
                                     $"client_secret={Uri.EscapeDataString(clientSecret)}&" +
                                     $"{creds.Config.GoogleAuthCodeKey}={Uri.EscapeDataString(creds.AuthCode)}&" +
                                     $"redirect_uri={Uri.EscapeDataString(redirectUri)}";
 
                    var response = GPAL.RESTClient
                        .WithAPIBase(creds.Config.GoogleAuthBase)
                        .WithEndpoint(creds.Config.GoogleAuthEndpoint)
                        .WithParameters(parameters)
                        .WithEncoding(ContentEncoding.UrlEncoded)
                        .Execute();
 
                    creds.GoogleTokenResponse = System.Text.Json.JsonSerializer.Deserialize<GoogleTokenResponse>(response);
                    creds.AccessToken = creds.GoogleTokenResponse?.AccessToken ?? "";
 
                    if (!string.IsNullOrEmpty(creds.AccessToken))
                    {
                        creds.IssueTime = DateTime.UtcNow;
                        creds.ExpiresIn = creds.GoogleTokenResponse.ExpiresIn;
                    }
                    else
                    {
                        GPAL.PublishSimpleEvent(
                            GPALEventType.ERROR,
                            $"Failed to fetch Google access token. Response: [{response}]",
                            null,
                            GPALObjectType.None);
                    }
 
                    if (!string.IsNullOrEmpty(creds.GoogleTokenResponse?.RefreshToken))
                    {
                        creds.WithRefreshToken(creds.GoogleTokenResponse.RefreshToken);
                    }
                }
            }
 
            return creds.AccessToken;
        }

        public static string Base64UrlEncode(byte[] input)
        {
            return Convert.ToBase64String(input)
                .TrimEnd('=')          // remove padding
                .Replace('+', '-')     // URL safe
                .Replace('/', '_');    // URL safe
        }

        private static byte[] Base64UrlDecode(string input)
        {
            string padded = input
                .Replace('-', '+')
                .Replace('_', '/');
 
            switch (padded.Length % 4)
            {
                case 2: padded += "=="; break;
                case 3: padded += "="; break;
            }
 
            return Convert.FromBase64String(padded);
        }

        internal static string FetchServiceAccountToken(Credentials creds)
        {
            creds.AccessToken = "";
 
            if (string.IsNullOrEmpty(creds.ServiceAccountKeyJson))
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR, "Service account key JSON is missing.", null, GPALObjectType.None);
                return creds.AccessToken;
            }
 
            try
            {
                var serviceAccount = System.Text.Json.JsonSerializer.Deserialize<GoogleServiceAccountKey>(creds.ServiceAccountKeyJson);
 
                var iat = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
                var exp = iat + 3600;
 
                var pemReader = new PemReader(new StringReader(serviceAccount.PrivateKey));
                var keyPair = (AsymmetricCipherKeyPair)pemReader.ReadObject();
                var privateKey = (Org.BouncyCastle.Crypto.Parameters.RsaPrivateCrtKeyParameters)keyPair.Private;
 
                var header = new { alg = "RS256", typ = "JWT" };
 
                var payload = new
                {
                    iss = serviceAccount.ClientEmail,
                    scope = Credentials.GetScopeValue(creds.OAuthScope),
                    iat,
                    exp
                };
 
                var headerJson = JsonSerializer.Serialize(header);
                var payloadJson = JsonSerializer.Serialize(payload);
 
                var headerBytes = Encoding.UTF8.GetBytes(headerJson);
                var payloadBytes = Encoding.UTF8.GetBytes(payloadJson);
 
                string headerBase64Url = Base64UrlEncode(headerBytes);
                string payloadBase64Url = Base64UrlEncode(payloadBytes);
 
                string unsignedJwt = $"{headerBase64Url}.{payloadBase64Url}";
 
                var signer = SignerUtilities.GetSigner("SHA256withRSA");
                signer.Init(true, privateKey);
                var bytes = Encoding.UTF8.GetBytes(unsignedJwt);
                signer.BlockUpdate(bytes, 0, bytes.Length);
 
                var signatureBytes = signer.GenerateSignature();
                var signature = Base64UrlEncode(signatureBytes);
 
                var jwt = $"{unsignedJwt}.{signature}";
 
                var parameters = $"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion={Uri.EscapeDataString(jwt)}";
 
                var response = GPAL.RESTClient
                    .WithAPIBase(creds.Config.GoogleAuthBase)
                    .WithEndpoint(creds.Config.GoogleServiceAccountTokenUri)
                    .WithParameters(parameters)
                    .WithEncoding(ContentEncoding.UrlEncoded)
                    .WithHttpMethod("POST")
                    .Execute();
 
                var authData = System.Text.Json.JsonSerializer.Deserialize<Dictionary<string, string>>(response);
 
                creds.AccessToken = authData?[creds.Config.AccessTokenKey] ?? "";
 
                if (!string.IsNullOrEmpty(creds.AccessToken))
                {
                    creds.IssueTime = DateTime.UtcNow;
 
                    if (authData != null &&
                        authData.TryGetValue("expires_in", out var expStr) &&
                        int.TryParse(expStr, out int expires))
                    {
                        creds.ExpiresIn = expires;
                    }
                    else
                    {
                        creds.ExpiresIn = 0;
                    }
                }
                else
                {
                    GPAL.PublishSimpleEvent(
                        GPALEventType.ERROR,
                        $"Failed to fetch service account token. Response: [{response}]",
                        null,
                        GPALObjectType.None);
                }
            }
            catch (Exception ex)
            {
                GPAL.PublishSimpleEvent(
                    GPALEventType.ERROR,
                    $"Failed to fetch service account token",
                    null,
                    GPALObjectType.None, ex);
            }
 
            return creds.AccessToken;
        }
    }

    internal static class BitwardenHandler
    {
        internal static List<CredentialResult> Handle(Credentials creds)
        {
            var results = new List<CredentialResult>();
 
            creds.AccessToken = FetchAccessToken(creds);
 
            if (string.IsNullOrEmpty(creds.AccessToken))
                return results;
 
            var vaultJson = GPAL.RESTClient
                .WithAPIBase(creds.Config.BitwardenVaultBase)
                .WithEndpoint(creds.Config.BitwardenVaultEndpoint)
                .WithParameters(new Dictionary<string, string>
                {
                    { creds.Config.SearchKey, creds.Target }
                })
                .WithHeader(creds.Config.AuthorizationHeader, $"Bearer {creds.AccessToken}")
                .Execute();
 
            var vaultData = JsonSerializer.Deserialize<BitwardenVaultResponse>(vaultJson);
 
            if (vaultData?.Data != null)
            {
                foreach (var item in vaultData.Data)
                {
                    if (item.Login != null &&
                        Credentials.MatchesDomain(item.Login.Uris?.Select(u => u.Uri), creds.Domain))
                        results.Add(new CredentialResult(item.Login.Username, item.Login.Password));
                }
            }
 
            return results;
        }

        internal static string FetchAccessToken(Credentials creds)
        {
            var (clientId, clientSecret) = Credentials.SafeSplit(creds.ServiceKey);
 
            var response = GPAL.RESTClient
                .WithAPIBase(creds.Config.BitwardenAuthBase)
                .WithEndpoint(creds.Config.BitwardenAuthEndpoint)
                .WithParameters(new
                {
                    grant_type = "password",
                    username = creds.Username,
                    password = creds.Password,
                    client_id = clientId,
                    client_secret = clientSecret
                })
                .Execute();
 
            creds.BitwardenTokenResponse = JsonSerializer.Deserialize<BitwardenTokenResponse>(response);
            creds.AccessToken = creds.BitwardenTokenResponse?.AccessToken ?? "";
 
            if (!string.IsNullOrEmpty(creds.AccessToken))
            {
                creds.IssueTime = DateTime.UtcNow;
                creds.ExpiresIn = creds.BitwardenTokenResponse.ExpiresIn;
            }
            else
            {
                GPAL.PublishSimpleEvent(
                    GPALEventType.ERROR,
                    $"Bitwarden auth failed. Response: [{response}]",
                    null,
                    GPALObjectType.None);
            }
 
            return creds.AccessToken;
        }
    }

    internal static class LastPassHandler
    {
        internal static List<CredentialResult> Handle(Credentials creds)
        {
            var results = new List<CredentialResult>();
 
            // Step 1: Ensure we have an active LastPass session
            if (!EnsureLoggedIn(creds))
                return results;
 
            try
            {
                // Step 2: Get all items as JSON (most reliable way to search)
                var process = new Process
                {
                    StartInfo = new ProcessStartInfo
                    {
                        FileName = "lpass",
                        Arguments = "ls --json",
                        RedirectStandardOutput = true,
                        UseShellExecute = false,
                        CreateNoWindow = true
                    }
                };
 
                process.Start();
                string jsonOutput = process.StandardOutput.ReadToEnd();
                process.WaitForExit();
 
                if (process.ExitCode != 0)
                {
                    GPAL.PublishSimpleEvent(GPALEventType.ERROR, $"LastPass CLI returned exit code [{process.ExitCode}].", null, GPALObjectType.None);
                    return results;
                }
 
                var items = JsonSerializer.Deserialize<List<LastPassItem>>(jsonOutput);
 
                if (items != null)
                {
                    string searchTerm = (creds.Target ?? "").ToLowerInvariant();
 
                    foreach (var item in items)
                    {
                        if (string.IsNullOrEmpty(item.Username) && string.IsNullOrEmpty(item.Password))
                            continue;
 
                        bool matches = string.IsNullOrEmpty(searchTerm) ||
                                       (item.Name?.ToLowerInvariant().Contains(searchTerm) == true) ||
                                       (item.Url?.ToLowerInvariant().Contains(searchTerm) == true) ||
                                       (item.Username?.ToLowerInvariant().Contains(searchTerm) == true);
 
                        if (matches && Credentials.MatchesDomain(item.Url, creds.Domain))
                        {
                            results.Add(new CredentialResult(item.Username ?? "", item.Password ?? ""));
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR, $"LastPass vault retrieval failed", null, GPALObjectType.None, ex);
            }
 
            return results;
        }

        internal static string FetchAccessToken(Credentials creds)
        {
            // LastPass CLI doesn't use a traditional "access token" like the others.
            // We just ensure the session is valid (this is called by Handle).
            EnsureLoggedIn(creds);
            return "LastPass-CLI-Session"; // placeholder - not really used
        }

        private static bool EnsureLoggedIn(Credentials creds)
        {
            try
            {
                var statusProcess = new Process
                {
                    StartInfo = new ProcessStartInfo
                    {
                        FileName = "lpass",
                        Arguments = "status",
                        RedirectStandardOutput = true,
                        UseShellExecute = false,
                        CreateNoWindow = true
                    }
                };
 
                statusProcess.Start();
                string statusOutput = statusProcess.StandardOutput.ReadToEnd().Trim();
                statusProcess.WaitForExit();
 
                if (statusOutput.ToLower().Contains("logged in"))
                    return true;
 
                // Not logged in > give clear instruction
                GPAL.PublishSimpleEvent(
                    GPALEventType.ERROR,
                    $"LastPass CLI is not logged in. Please run this command once on the machine:\n" +
                    $"lpass login [{creds.Username}]\n" +
                    $"Then re-run your automation.",
                    null, GPALObjectType.None);
 
                return false;
            }
            catch (Exception ex)
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                    $"LastPass CLI check failed. Is the LastPass CLI (lpass) installed?",
                    null, GPALObjectType.None, ex);
                return false;
            }
        }
    }

    internal static class OnePasswordHandler
    {
        internal static List<CredentialResult> Handle(Credentials creds)
        {
            var results = new List<CredentialResult>();
 
            // Ensure we have a valid session
            if (!EnsureSession(creds))
                return results;
 
            try
            {
                string search = creds.Target?.Trim() ?? "";
 
                // Build command: list items and get full details in one go where possible
                string arguments = string.IsNullOrEmpty(search)
                    ? "item list --format=json"
                    : $"item list --search=\"{search}\" --format=json";
 
                var process = new Process
                {
                    StartInfo = new ProcessStartInfo
                    {
                        FileName = "op",
                        Arguments = arguments,
                        RedirectStandardOutput = true,
                        UseShellExecute = false,
                        CreateNoWindow = true
                    }
                };
 
                process.Start();
                string jsonOutput = process.StandardOutput.ReadToEnd();
                process.WaitForExit();
 
                if (process.ExitCode != 0)
                {
                    GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                        $"1Password CLI returned exit code [{process.ExitCode}]. Make sure you are signed in.",
                        null, GPALObjectType.None);
                    return results;
                }
 
                var items = JsonSerializer.Deserialize<List<OnePasswordItem>>(jsonOutput);
 
                if (items != null)
                {
                    foreach (var item in items)
                    {
                        // Try to extract username and password fields
                        string username = "";
                        string password = "";
 
                        foreach (var field in item.Fields)
                        {
                            if (string.Equals(field.Label, "username", StringComparison.OrdinalIgnoreCase) ||
                                string.Equals(field.Type, "username", StringComparison.OrdinalIgnoreCase))
                            {
                                username = field.Value ?? "";
                            }
                            else if (string.Equals(field.Label, "password", StringComparison.OrdinalIgnoreCase) ||
                                     string.Equals(field.Type, "password", StringComparison.OrdinalIgnoreCase))
                            {
                                password = field.Value ?? field.Reference ?? "";
                            }
                        }
 
                        if ((!string.IsNullOrEmpty(username) || !string.IsNullOrEmpty(password)) &&
                            Credentials.MatchesDomain(item.Urls?.Select(u => u.Href), creds.Domain))
                        {
                            results.Add(new CredentialResult(username, password));
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                    $"1Password vault retrieval failed", null, GPALObjectType.None, ex);
            }
 
            return results;
        }

        internal static string FetchAccessToken(Credentials creds)
        {
            // 1Password uses a session token instead of a traditional access token
            EnsureSession(creds);
            return "1Password-CLI-Session";
        }

        private static bool EnsureSession(Credentials creds)
        {
            try
            {
                // Simple check if CLI is ready
                var process = new Process
                {
                    StartInfo = new ProcessStartInfo
                    {
                        FileName = "op",
                        Arguments = "whoami --format=json",
                        RedirectStandardOutput = true,
                        UseShellExecute = false,
                        CreateNoWindow = true
                    }
                };
 
                process.Start();
                string output = process.StandardOutput.ReadToEnd();
                process.WaitForExit();
 
                if (process.ExitCode == 0 && !string.IsNullOrWhiteSpace(output))
                    return true;
 
                // Not signed in > give clear guidance
                GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                    $"1Password CLI is not signed in. Please run this once on the target machine:\n" +
                    $"op signin\n" +
                    $"Then re-run your automation. (Session lasts ~30 minutes of activity)",
                    null, GPALObjectType.None);
 
                return false;
            }
            catch (Exception ex)
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                    $"1Password CLI check failed. Is the 1Password CLI (`op`) installed and in PATH?",
                    null, GPALObjectType.None, ex);
                return false;
            }
        }
    }

    internal static class DashlaneHandler
    {
        internal static List<CredentialResult> Handle(Credentials creds)
        {
            var results = new List<CredentialResult>();
 
            // Ensure CLI session / login
            if (!EnsureLoggedIn(creds))
                return results;
 
            try
            {
                string search = creds.Target?.Trim() ?? "";
 
                // Use JSON output for reliable parsing
                string arguments = string.IsNullOrEmpty(search)
                    ? "password list --json"
                    : $"password list --search \"{search}\" --json";
 
                var process = new Process
                {
                    StartInfo = new ProcessStartInfo
                    {
                        FileName = "dcli",                    // or "dashlane" depending on installation
                        Arguments = arguments,
                        RedirectStandardOutput = true,
                        RedirectStandardError = true,
                        UseShellExecute = false,
                        CreateNoWindow = true
                    }
                };
 
                process.Start();
                string jsonOutput = process.StandardOutput.ReadToEnd();
                string errorOutput = process.StandardError.ReadToEnd();
                process.WaitForExit();
 
                if (process.ExitCode != 0)
                {
                    GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                        $"Dashlane CLI failed (exit code [{process.ExitCode}]). Error: [{errorOutput.Trim()}]",
                        null, GPALObjectType.None);
                    return results;
                }
 
                var items = JsonSerializer.Deserialize<List<DashlaneItem>>(jsonOutput);
 
                if (items != null)
                {
                    foreach (var item in items)
                    {
                        if (!string.IsNullOrEmpty(item.Username) || !string.IsNullOrEmpty(item.Password))
                        {
                            if (Credentials.MatchesDomain(item.Url, creds.Domain))
                                results.Add(new CredentialResult(item.Username ?? "", item.Password ?? ""));
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                    $"Dashlane vault retrieval failed", null, GPALObjectType.None, ex);
            }
 
            return results;
        }

        internal static string FetchAccessToken(Credentials creds)
        {
            // Dashlane CLI uses a local session, not a traditional token
            EnsureLoggedIn(creds);
            return "Dashlane-CLI-Session";
        }

        private static bool EnsureLoggedIn(Credentials creds)
        {
            try
            {
                var process = new Process
                {
                    StartInfo = new ProcessStartInfo
                    {
                        FileName = "dcli",
                        Arguments = "status --json",
                        RedirectStandardOutput = true,
                        UseShellExecute = false,
                        CreateNoWindow = true
                    }
                };
 
                process.Start();
                string output = process.StandardOutput.ReadToEnd();
                process.WaitForExit();
 
                if (process.ExitCode == 0 && output.ToLower().Contains("\"logged_in\":true"))
                    return true;
 
                // Not logged in > clear instruction
                GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                    $"Dashlane CLI is not logged in. Please run this once on the target machine:\n" +
                    $"dcli login\n" +
                    $"Then re-run your automation.",
                    null, GPALObjectType.None);
 
                return false;
            }
            catch (Exception ex)
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                    $"Dashlane CLI check failed. Is the Dashlane CLI (`dcli`) installed and in PATH?",
                    null, GPALObjectType.None, ex);
                return false;
            }
        }
    }

    internal static class KeeperHandler
    {
        internal static List<CredentialResult> Handle(Credentials creds)
        {
            var results = new List<CredentialResult>();
 
            if (!EnsureLoggedIn(creds))
                return results;
 
            try
            {
                string search = creds.Target?.Trim() ?? "";
 
                // Use "list" or "search" with JSON output
                string arguments = string.IsNullOrEmpty(search)
                    ? "list --format=json"
                    : $"search \"{search}\" --format=json";
 
                var process = new Process
                {
                    StartInfo = new ProcessStartInfo
                    {
                        FileName = "keeper",
                        Arguments = arguments,
                        RedirectStandardOutput = true,
                        RedirectStandardError = true,
                        UseShellExecute = false,
                        CreateNoWindow = true
                    }
                };
 
                process.Start();
                string jsonOutput = process.StandardOutput.ReadToEnd();
                string errorOutput = process.StandardError.ReadToEnd();
                process.WaitForExit();
 
                if (process.ExitCode != 0)
                {
                    GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                        $"Keeper Commander returned exit code [{process.ExitCode}]. Error: [{errorOutput.Trim()}]",
                        null, GPALObjectType.None);
                    return results;
                }
 
                var records = JsonSerializer.Deserialize<List<KeeperRecord>>(jsonOutput);
 
                if (records != null)
                {
                    foreach (var record in records)
                    {
                        string username = record.Login?.Username ?? "";
                        string password = record.Login?.Password ?? "";
 
                        if ((!string.IsNullOrEmpty(username) || !string.IsNullOrEmpty(password)) &&
                            Credentials.MatchesDomain(record.Login?.Url, creds.Domain))
                        {
                            results.Add(new CredentialResult(username, password));
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                    $"Keeper vault retrieval failed", null, GPALObjectType.None, ex);
            }
 
            return results;
        }

        internal static string FetchAccessToken(Credentials creds)
        {
            // Keeper uses a persistent session via Commander
            EnsureLoggedIn(creds);
            return "Keeper-Commander-Session";
        }

        private static bool EnsureLoggedIn(Credentials creds)
        {
            try
            {
                var process = new Process
                {
                    StartInfo = new ProcessStartInfo
                    {
                        FileName = "keeper",
                        Arguments = "whoami --format=json",
                        RedirectStandardOutput = true,
                        UseShellExecute = false,
                        CreateNoWindow = true
                    }
                };
 
                process.Start();
                string output = process.StandardOutput.ReadToEnd();
                process.WaitForExit();
 
                if (process.ExitCode == 0 && !string.IsNullOrWhiteSpace(output))
                    return true;
 
                GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                    $"Keeper Commander is not logged in. Please run this once on the target machine:\n" +
                    $"keeper shell\n" +
                    $"Then login with your email / master password (or use 'keeper login').\n" +
                    $"After login, you can use 'this-device' for persistent sessions.",
                    null, GPALObjectType.None);
 
                return false;
            }
            catch (Exception ex)
            {
                GPAL.PublishSimpleEvent(GPALEventType.ERROR,
                    $"Keeper Commander check failed. Is Keeper Commander (`keeper`) installed and in PATH?",
                    null, GPALObjectType.None, ex);
                return false;
            }
        }
    }
    internal static class LocalAuthCallbackServer
    {
        private static readonly object _lock = new object();
        private static HttpListener _listener;
        private static string _pendingAuthCode;
        private static string _pendingAuthScope;

        internal static bool StartIfNeeded(string baseUrl)
        {
            lock (_lock)
            {
                if (null != _listener)
                    return true;
 
                try
                {
                    var listener = new HttpListener();
                    listener.Prefixes.Add(baseUrl);
                    listener.Start();
                    _listener = listener;
 
                    new Thread(() => Listen(listener)) { IsBackground = true }.Start();
                    return true;
                }
                catch (HttpListenerException)
                {
                    // something else already owns this prefix. whether that something is GPALRestAPI is a
                    // separate question, and BrowserHelper.RestApiAnswering is how it gets asked
                    return false;
                }
            }
        }
 
        private static void Listen(HttpListener listener)
        {
            try
            {
                while (listener.IsListening)
                {
                    HttpListenerContext context = listener.GetContext();
                    HandleRequest(context);
                }
            }
            catch (Exception)
            {
                // listener was stopped
            }
        }
 
        private static void HandleRequest(HttpListenerContext context)
        {
            HttpListenerResponse response = context.Response;
            string path = context.Request.Url.AbsolutePath.Trim('/');
            string json;
 
            switch (path)
            {
                case "access-token": // Called by the provider's redirect after the user grants consent
                    NameValueCollection query = ParseQueryString(context.Request.Url.Query);
 
                    lock (_lock)
                    {
                        _pendingAuthCode = query["code"];
                        _pendingAuthScope = query["scope"];
                    }
 
                    SendResponse(response, "{\"message\":\"Authorization code received. You can now call /get-access-token.\"}");
                    break;
 
                case "get-access-token": // Polled by GetAuthCodeFromRest
                    string code, scope;
 
                    lock (_lock)
                    {
                        code = _pendingAuthCode ?? string.Empty;
                        scope = _pendingAuthScope ?? string.Empty;
 
                        // single use
                        _pendingAuthCode = null;
                        _pendingAuthScope = null;
                    }
 
                    json = System.Text.Json.JsonSerializer.Serialize(new { code, scope });
                    SendResponse(response, json);
                    break;
 
                default:
                    SendResponse(response, "{}");
                    break;
            }
        }
 
        private static NameValueCollection ParseQueryString(string query)
        {
            var result = new NameValueCollection();
 
            if (string.IsNullOrEmpty(query))
                return result;
 
            foreach (string pair in query.TrimStart('?').Split('&'))
            {
                if (string.IsNullOrEmpty(pair))
                    continue;
 
                string[] parts = pair.Split(new[] { '=' }, 2);
                string key = Uri.UnescapeDataString(parts[0]);
                string value = parts.Length > 1 ? Uri.UnescapeDataString(parts[1]) : string.Empty;
                result[key] = value;
            }
 
            return result;
        }
 
        private static void SendResponse(HttpListenerResponse response, string message)
        {
            try
            {
                response.StatusCode = (int)HttpStatusCode.OK;
                response.ContentType = "application/json";
                response.ContentEncoding = Encoding.UTF8;
 
                byte[] buffer = Encoding.UTF8.GetBytes(message ?? "");
                response.OutputStream.Write(buffer, 0, buffer.Length);
            }
            catch { /* client gone - ignore */ }
            finally
            {
                try { response.Close(); } catch { }
            }
        }

        internal static void Stop()
        {
            lock (_lock)
            {
                if (null == _listener)
                    return;
 
                try { _listener.Stop(); _listener.Close(); } catch { }
                _listener = null;
                _pendingAuthCode = null;
                _pendingAuthScope = null;
            }
        }
    }

    internal static class AuthHandler
    {
        // where a GPALRestAPI serves by default, and the first place looked before binding our own
        internal const string DefaultTokenUrl = "http://localhost:3000/";
        internal static string GetAuthCodeFromRest(Process browserProcess, int timeoutInSeconds)
        {
            string authCode = "";
 
            try
            {
                // NOTE: get the access token from the rest API which is started by OttoMagic
                // GPALRestApi gets it because we pass a local url callback creds.Config.GoogleRestRedirectUri
                // and then we can access the token
                var restClient = GPAL.RESTClient
                    .WithAPIBase(GPAL.OAuthTokenUrl)
                    .WithEndpoint("get-access-token");
 
                // Polling parameters
                TimeSpan timeout = TimeSpan.FromSeconds(timeoutInSeconds);
                TimeSpan interval = TimeSpan.FromSeconds(1);
                DateTime start = DateTime.UtcNow;
 
                while ((DateTime.UtcNow - start) < timeout)
                {
                    AuthCodePayload tokenInfo = restClient.Execute<AuthCodePayload>(); // returns AuthCodePayload directly
                    if (!string.IsNullOrEmpty(tokenInfo?.Code))
                    {
                        authCode = tokenInfo.Code;
                        GPAL.PublishSimpleEvent(
                            GPALEventType.INFO,
                            "Authorization code retrieved from REST server.",
                            null,
                            GPALObjectType.None
                        );
                        break; // stop polling
                    }
 
                    Thread.Sleep(interval);
                }
 
                if (string.IsNullOrEmpty(authCode))
                    GPAL.PublishSimpleEvent(GPALEventType.ERROR, "Timeout waiting for authorization code from REST server.", null, GPALObjectType.None);
            }
            catch (Exception ex)
            {
                GPAL.PublishSimpleEvent(
                    GPALEventType.ERROR,
                    $"REST redirect auth failed",
                    null,
                    GPALObjectType.None
                , ex);
            }
            if (null != browserProcess)
                BrowserHelper.KillProcess(browserProcess);  // only needed once to login
 
            return authCode;
        }

        internal static bool ResolveTokenUrl(Credentials creds)
        {
            bool retVal = false;
            string configured = creds?.Config?.GoogleRestRedirectUri;
 
            GPAL.OAuthTokenUrl = true == string.IsNullOrWhiteSpace(configured)
                ? DefaultTokenUrl
                : $"{new Uri(configured).GetLeftPart(UriPartial.Authority)}/";
 
            if (true == LocalAuthCallbackServer.StartIfNeeded(GPAL.OAuthTokenUrl))
            {
                retVal = true;
 
                GPAL.PublishSimpleEvent(GPALEventType.INFO, $"Listening on [{GPAL.OAuthTokenUrl}] to catch the token.", creds, GPALObjectType.Other);
            }
            else if (true == Browser.BrowserHelper.RestApiAnswering(GPAL.OAuthTokenUrl))
            {
                GPAL.PublishSimpleEvent(GPALEventType.INFO, $"The GPALRestAPI already on [{GPAL.OAuthTokenUrl}] will catch the token.", creds, GPALObjectType.Other);
            }
            else
            {
                // moving to another port would be a redirect the provider never agreed to, so there is no
                // recovery here worth making. one machine running two of these was always going to collide
                GPAL.PublishSimpleEvent(GPALEventType.ERROR, $"Something that is not GPALRestAPI is on [{GPAL.OAuthTokenUrl}], and the redirect registered with the provider cannot point anywhere else", creds, GPALObjectType.Other);
            }
 
            return retVal;
        }
 
        // whether this program has a console window. Zero for a form, which is a program that cannot be asked
        // to type anything
        [System.Runtime.InteropServices.DllImport("kernel32.dll")]
        private static extern IntPtr GetConsoleWindow();
 
        internal static string GetAuthCode(Credentials creds)
        {
            string authCode = "";
            int retry = 2;
            Process browserProcess = null;
            bool ownsLocalServer = false;
 
            bool publishToConsole = GPAL.GPALSettings.PublishToConsole;
 
            GPALEventType consoleEvents = GPAL.GPALSettings.ConsoleEvents;
 
            if (false == publishToConsole)
                GPAL.WithPublishToConsole();
            else if (false == consoleEvents.HasFlag(GPALEventType.INFO))
                GPAL.ConsoleEvents |= GPALEventType.INFO;
 
            // REST redirect flow
            // workflow : launch browser > user logs in (unknown length of time) > redirect to localhost > listener parses code
            //            meanwhile, GPAL is polling get-access-token until some value is returned or 1 minute passes
            if (creds.Config.UseRestRedirect)
            {
                // GPALRESTAPI normally serves the redirect target (e.g. http://localhost:3000/access-token) and
                // get-access-token. If it isn't running, start a minimal listener on the same base URL ourselves
                // so the OAuth redirect still has somewhere to land.
                ownsLocalServer = ResolveTokenUrl(creds);
 
                string authUrl = AuthHandler.GetAuthUrl(creds);
 
                browserProcess = creds.Browser.MagicHelper.LaunchBrowser(creds.Browser, authUrl);   // launch a new instance of the browser for authentication
                authCode = GetAuthCodeFromRest(browserProcess, 60);
            }
 
            // Manual fallback flow: either UseRestRedirect is false, or the REST redirect timed out
            if (string.IsNullOrEmpty(authCode))
            {
                string authUrl = AuthHandler.GetAuthUrl(creds);
 
                if (true == creds.Config.UseRestRedirect)
                    GPAL.PublishSimpleEvent(
                        GPALEventType.WARNING,
                        "No authorization code arrived via the local redirect listener. Falling back to manual entry.",
                        null,
                        GPALObjectType.None
                    );
 
                // there has to be somewhere to type the code. A program with a console window can be asked
                // for it, and a form has nowhere to answer: reading a console that does not exist never
                // returns and never times out, so the whole program stops with no way back. A workflow with a
                // form collects the code itself and hands it over with WithAuthCode
                if (IntPtr.Zero == GetConsoleWindow())
                {
                    GPAL.PublishSimpleEvent(
                        GPALEventType.ERROR,
                        $"An authorization code is needed and this program has no console to type it into. Open this URL, authorize, and hand the code back with WithAuthCode, or supply a refresh token with WithRefreshToken: [{authUrl}]");
                }
                else
                {
                    while (retry > 0)
                    {
                        GPAL.PublishSimpleEvent(
                            GPALEventType.INFO,
                            $"Open this URL in a browser, authorize, and provide the code: \n[{authUrl}]",
                            null,
                            GPALObjectType.None
                        );
 
                        Console.WriteLine("\nEnter auth code: ");   // a prompt for the ReadLine below, not an event
                        authCode = Console.ReadLine();
 
                        if (string.IsNullOrEmpty(authCode))
                        {
                            GPAL.PublishSimpleEvent(
                                GPALEventType.ERROR,
                                "No authorization code provided.",
                                null,
                                GPALObjectType.None
                            );
                            retry--;
                        }
                        else
                        {
                            break;
                        }
                    }
                }
            }
 
            if (ownsLocalServer)
                LocalAuthCallbackServer.Stop();
 
            if (false == publishToConsole)
                GPAL.WithPublishToConsole(GPALEventType.NONE);
            else if (false == consoleEvents.HasFlag(GPALEventType.INFO))
                GPAL.ConsoleEvents ^= GPALEventType.INFO;
 
            return authCode;
        }

        internal static string GetAuthUrl(Credentials creds)
        {
            switch (creds.ServiceType)
            {
                case CredentialServiceType.Google:
                    return $"{creds.Config.GoogleConsentBase}/o/oauth2/v2/auth" +
                           $"?client_id={Uri.EscapeDataString(creds.ClientId)}" +
                           $"&redirect_uri={Uri.EscapeDataString(creds.Config.UseRestRedirect ? creds.Config.GoogleRestRedirectUri : creds.Config.GoogleRedirectUri)}" +
                           $"&response_type=code" +
                           $"&scope={Uri.EscapeDataString(Credentials.GetScopeValue(creds.OAuthScope))}" +
                           $"&access_type=offline";
 
                case CredentialServiceType.Azure:
                    return $"{creds.Config.AzureAuthBase}/oauth2/v2.0/authorize" +
                           $"?client_id={Uri.EscapeDataString(creds.ClientId)}" +
                           $"&response_type=code" +
                           $"&redirect_uri={Uri.EscapeDataString(creds.Config.AzureRedirectUri)}" +
                           $"&response_mode=query" +
                           $"&scope={Uri.EscapeDataString(Credentials.GetScopeValue(creds.OAuthScope))}";
 
                case CredentialServiceType.AWS:
                    return $"{creds.Config.AWSAuthBase}/oauth2/authorize" +
                           $"?client_id={Uri.EscapeDataString(creds.ClientId)}" +
                           $"&response_type=code" +
                           $"&redirect_uri={Uri.EscapeDataString(creds.Config.AWSRedirectUri)}" +
                           $"&scope={Uri.EscapeDataString(Credentials.GetScopeValue(creds.OAuthScope))}";
 
                case CredentialServiceType.Bitwarden:
                    GPAL.PublishSimpleEvent(GPALEventType.WARNING, "Bitwarden OAuth not implemented.", creds, GPALObjectType.Other);
                    break;
            }
 
            return "";
        }
    }
}