/**
* Utility class to authenticate with Google Service Account
*/
public with sharing class GoogleServiceAccountCredential {
    private String email;
    private String key;
    private String scopes;
    
    private long expiration;
    private String accessToken;
    
	/**
	* Create a new Google Credential
	* @param jsonContent Content of a Service Account JSON Credential (generated from Cloud Console)
	* @param List of scopes to be used for authentication (space separated)
	*/
    public GoogleServiceAccountCredential(String jsonContent, String scopes) {
        ServiceAccountCredential sac = (ServiceAccountCredential)JSON.deserialize(jsonContent, ServiceAccountCredential.Class);
        
        this.email = sac.client_email;
        this.key = sac.private_key.replaceAll('-----END PRIVATE KEY-----', '').replaceAll('-----BEGIN PRIVATE KEY-----', '').replaceAll('\n', '');
        this.scopes = scopes;
    }
    
	/**
	* https://developers.google.com/identity/protocols/OAuth2ServiceAccount#authorizingrequests
	*/
    public String getAccessToken() {
        // Token already available and not expired
        if(this.accessToken != null && this.expiration > (datetime.now().getTime()/1000)) {
            return this.accessToken;
        }
        
        System.debug('Access-Token not available');
        System.debug('Email: ' + this.email);
        System.debug('Scopes: ' + this.scopes);
        
        // Header
        
        String header = getHeader();
        System.debug('Header: ' + header);
        
        String base64Header = EncodingUtil.base64Encode(Blob.valueOf(header));
        System.debug('BASE64 Header: ' + header);
        
        // Claim
        
        String claim = getClaim(this.email, this.scopes);
        System.debug('Claim: ' + claim);
        
        String base64Claim = EncodingUtil.base64Encode(Blob.valueOf(claim));
        System.debug('BASE64 Claim: ' + base64Claim);
        
        // Signature
        
        String inputSignature = base64Header + '.' + base64Claim;
        System.debug('Input Signature: ' + base64Claim);
        
        String signature = sign(this.key, inputSignature);
        System.debug('Signature: ' + signature);
        
        // Assertion
        
        String assertion = base64Header + '.' + base64Claim + '.' + signature;
        System.debug('Assertion: ' + assertion);
        
        String grantType = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
        System.debug('Grant Type: ' + grantType);
        
        // Fetch
        
        Token token = fetchToken(grantType, assertion);
        System.debug('Token: ' + token);
        
        // Store
        this.expiration = (datetime.now().getTime()/1000) + token.expires_in;
        this.accessToken = token.access_token;
        
        // Return
        
        return this.accessToken;
    }
    
    private String getHeader() {
        Map<String, Object> obj = new Map<String, Object>();
        obj.put('alg', 'RS256');
        obj.put('typ', 'JWT');
        
        return JSON.Serialize(obj);
    }
    
    private String getClaim(String email, String scopes) {
        long currentTime = datetime.now().getTime()/1000;
        long expiryTime = datetime.now().addHours(1).getTime()/1000;
        
        Map<String, Object> obj = new Map<String, Object>();
        obj.put('iss', email);
        obj.put('scope', scopes);
        obj.put('aud', 'https://www.googleapis.com/oauth2/v4/token');
        obj.put('exp', expiryTime);
        obj.put('iat', currentTime);
        
        return JSON.Serialize(obj);
    }
    
    private String sign(String key, String inputSignature) {
        String algorithmName = 'RSA-SHA256';
        Blob privateKey = EncodingUtil.base64Decode(key);
        Blob input = Blob.valueOf(inputSignature);
        
        Blob signed = Crypto.sign(algorithmName, input, privateKey);    
        return EncodingUtil.base64Encode(signed);
    }
    
    private Token fetchToken(String grantType, String assertion) {
        Httprequest req = new HttpRequest();
        req.setEndpoint('https://www.googleapis.com/oauth2/v4/token');
        req.setMethod('POST');
        req.setHeader('Content-Type','application/x-www-form-urlencoded');
        
        String body = '';
        body += 'grant_type=' + EncodingUtil.urlEncode(grantType,'UTF-8');
        body += '&';
        body += 'assertion=' + EncodingUtil.urlEncode(assertion, 'UTF-8');
        
        req.setBody(body);
        req.setHeader('Content-Length', body.length()+'');
        
        Http h = new Http();
        System.debug('request: ' + req);
        
        HttpResponse res = h.send(req);
        
        if(res.getStatusCode() != 200) {
            System.debug('Error Code: ' + res.getStatusCode());
            System.debug('Error Response: ' + res.getBody());
			
            CalloutException ce = new CalloutException();
            ce.setMessage('Google Authentication Error: ' + res.getBody());
            throw ce;
        } else {
            return (Token)JSON.deserialize(res.getBody(), Token.Class);
        }
    }
    
    private class ServiceAccountCredential {
        private String type;
        private String project_id;
        private String private_key_id;
        private String private_key;
        private String client_email;
        private String client_id;
        private String auth_uri;
        private String token_uri;
        private String auth_provider_x509_cert_url;
        private String client_x509_cert_url;
    }
    
    private class Token{
        private String access_token;
        private String token_type;
        private Long expires_in;
    }
}