https_a2a_server.php

<?php

declare(strict_types=1);

/**
 * HTTPS-Enabled A2A Protocol Server Implementation
 * 
 * This server provides HTTPS/TLS support for production security
 * while maintaining backward compatibility with HTTP for development.
 * 
 * Features:
 * - Complete A2A Protocol v0.3.0 compliance
 * - HTTPS/TLS support for production security
 * - Automatic SSL certificate handling
 * - HTTP to HTTPS redirect capability
 * - Development/production mode switching
 * - All existing functionality preserved
 * 
 * Usage:
 *   # Development mode (HTTP)
 *   php -S localhost:8081 https_a2a_server.php
 *   
 *   # Production mode (HTTPS with certificates)
 *   A2A_MODE=production php -S localhost:8443 https_a2a_server.php
 */

require_once __DIR__ . '/vendor/autoload.php';

use A2A\A2AServer;
use A2A\Events\EventBusManager;
use A2A\Execution\DefaultAgentExecutor;
use A2A\Exceptions\A2AErrorCodes;
use A2A\Models\AgentCapabilities;
use A2A\Models\v030\AgentCard;
use A2A\PushNotificationManager;
use A2A\Storage\Storage;
use A2A\Streaming\StreamingServer;
use A2A\TaskManager;
use A2A\Utils\JsonRpc;
use Psr\Log\LoggerInterface;

/**
 * HTTPS-aware Logger for A2A Server Operations
 */
class A2AHttpsServerLogger implements LoggerInterface
{
    private string $logFile;
    private bool $httpsMode;

    public function __construct(string $logFile = 'a2a_server.log', bool $httpsMode = false)
    {
        $this->logFile = $logFile;
        $this->httpsMode = $httpsMode;
    }

    public function emergency($message, array $context = []): void
    {
        $this->log('EMERGENCY', $message, $context);
    }

    public function alert($message, array $context = []): void
    {
        $this->log('ALERT', $message, $context);
    }

    public function critical($message, array $context = []): void
    {
        $this->log('CRITICAL', $message, $context);
    }

    public function error($message, array $context = []): void
    {
        $this->log('ERROR', $message, $context);
    }

    public function warning($message, array $context = []): void
    {
        $this->log('WARNING', $message, $context);
    }

    public function notice($message, array $context = []): void
    {
        $this->log('NOTICE', $message, $context);
    }

    public function info($message, array $context = []): void
    {
        $this->log('INFO', $message, $context);
    }

    public function debug($message, array $context = []): void
    {
        $this->log('DEBUG', $message, $context);
    }

    public function log($level, $message, array $context = []): void
    {
        $timestamp = date('Y-m-d H:i:s');
        $protocol = $this->httpsMode ? 'HTTPS' : 'HTTP';
        $contextStr = !empty($context) ? ' ' . json_encode($context) : '';
        $logEntry = "[{$timestamp}] {$level}: {$message}{$contextStr} (Protocol: {$protocol})" . PHP_EOL;

        file_put_contents($this->logFile, $logEntry, FILE_APPEND | LOCK_EX);
    }
}

/**
 * HTTPS/TLS Configuration Manager
 */
class HttpsConfigManager
{
    private string $certDir;
    private string $keyFile;
    private string $certFile;
    private LoggerInterface $logger;

    public function __construct(LoggerInterface $logger, string $certDir = '/tmp/a2a_certs')
    {
        $this->logger = $logger;
        $this->certDir = $certDir;
        $this->keyFile = $certDir . '/server.key';
        $this->certFile = $certDir . '/server.crt';
    }

    public function ensureCertificatesExist(): bool
    {
        if (!is_dir($this->certDir)) {
            mkdir($this->certDir, 0755, true);
        }

        if (file_exists($this->keyFile) && file_exists($this->certFile)) {
            $this->logger->info('Using existing SSL certificates', [
                'key_file' => $this->keyFile,
                'cert_file' => $this->certFile
            ]);
            return true;
        }

        return $this->generateSelfSignedCertificate();
    }

    private function generateSelfSignedCertificate(): bool
    {
        $this->logger->info('Generating self-signed SSL certificate for development');

        // Generate private key
        $privateKey = openssl_pkey_new([
            'private_key_bits' => 2048,
            'private_key_type' => OPENSSL_KEYTYPE_RSA,
        ]);

        if (!$privateKey) {
            $this->logger->error('Failed to generate private key');
            return false;
        }

        // Generate certificate signing request
        $csr = openssl_csr_new([
            'countryName' => 'US',
            'stateOrProvinceName' => 'Development',
            'localityName' => 'A2A Server',
            'organizationName' => 'A2A Development',
            'organizationalUnitName' => 'IT Department',
            'commonName' => 'localhost',
            'emailAddress' => 'dev@a2a-server.local'
        ], $privateKey, [
            'digest_alg' => 'sha256',
            'x509_extensions' => 'v3_req',
            'req_extensions' => 'v3_req',
        ]);

        if (!$csr) {
            $this->logger->error('Failed to generate certificate signing request');
            return false;
        }

        // Generate self-signed certificate valid for 1 year
        $cert = openssl_csr_sign($csr, null, $privateKey, 365, [
            'digest_alg' => 'sha256',
        ]);

        if (!$cert) {
            $this->logger->error('Failed to generate self-signed certificate');
            return false;
        }

        // Export private key
        openssl_pkey_export($privateKey, $privateKeyOut);
        file_put_contents($this->keyFile, $privateKeyOut);

        // Export certificate
        openssl_x509_export($cert, $certOut);
        file_put_contents($this->certFile, $certOut);

        // Set proper permissions
        chmod($this->keyFile, 0600);
        chmod($this->certFile, 0644);

        $this->logger->info('Self-signed SSL certificate generated successfully', [
            'key_file' => $this->keyFile,
            'cert_file' => $this->certFile,
            'valid_days' => 365
        ]);

        return true;
    }

    public function getKeyFile(): string
    {
        return $this->keyFile;
    }

    public function getCertFile(): string
    {
        return $this->certFile;
    }
}

/**
 * Enhanced A2A Server with HTTPS Support
 */
class A2AHttpsServer
{
    private A2AServer $server;
    private TaskManager $taskManager;
    private AgentCard $agentCard;
    private A2AHttpsServerLogger $logger;
    private bool $httpsMode;
    private HttpsConfigManager $httpsConfig;
    private int $port;
    private PushNotificationManager $pushNotificationManager;
    private EventBusManager $eventBusManager;
    private DefaultAgentExecutor $executor;
    private StreamingServer $streamingServer;

    public function __construct()
    {
        // Determine if we're in HTTPS mode
        $this->httpsMode = (getenv('A2A_MODE') === 'production') ||
            (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
            (isset($_SERVER['SERVER_PORT']) && (int)$_SERVER['SERVER_PORT'] === 8443);

        // Detect the actual port being used
        $this->port = (int)($_SERVER['SERVER_PORT'] ?? ($this->httpsMode ? 8443 : 8081));
        $this->logger = new A2AHttpsServerLogger('a2a_server.log', $this->httpsMode);

        if ($this->httpsMode) {
            $this->httpsConfig = new HttpsConfigManager($this->logger);
            $this->httpsConfig->ensureCertificatesExist();
        }

        $this->initializeServer();
        $this->setupAgentCard();
        $this->setupMessageHandlers();
    }

    private function initializeServer(): void
    {
        // Initialize shared storage and core components
        $storage = new Storage('array');

        $this->taskManager = new TaskManager($storage);
        $this->pushNotificationManager = new PushNotificationManager($storage);
        $this->eventBusManager = new EventBusManager();
        $this->executor = new DefaultAgentExecutor();
        $this->streamingServer = new StreamingServer();

        $this->logger->info('A2A Server components initialized', [
            'https_mode' => $this->httpsMode,
            'port' => $this->port
        ]);
    }

    private function setupAgentCard(): void
    {
        $baseUrl = $this->httpsMode ? "https://localhost:{$this->port}" : "http://localhost:{$this->port}";

        $capabilities = new AgentCapabilities(
            true,  // streaming
            true,  // pushNotifications
            false, // stateTransitionHistory
            []     // extensions
        );

        // Create skills
        $skills = [
            new \A2A\Models\AgentSkill(
                'text-processing',
                'Text Processing',
                'Process and respond to text-based requests',
                ['text', 'general']
            ),
            new \A2A\Models\AgentSkill(
                'file-processing',
                'File Processing',
                'Process and analyze file-based content',
                ['file', 'data']
            ),
            new \A2A\Models\AgentSkill(
                'secure-communication',
                'Secure Communication',
                'HTTPS/TLS encrypted communication support',
                ['security', 'https', 'tls']
            )
        ];

        $this->agentCard = new AgentCard(
            'complete-a2a-server',                                          // name
            'Complete A2A Server Implementation with HTTPS Support',       // description
            $baseUrl,                                                       // url
            '1.0.0',                                                        // version
            $capabilities,                                                  // capabilities
            ['text', 'file', 'data'],                                      // defaultInputModes
            ['text', 'file', 'data'],                                      // defaultOutputModes
            $skills,                                                        // skills
            '0.3.0'                                                         // protocolVersion
        );

        $this->agentCard->setSupportsAuthenticatedExtendedCard(true);

        // Initialize server with enhanced components and shared TaskManager
        // Enable A2A Protocol compliance mode for TCK tests
        $protocol = new \A2A\A2AProtocol_v030(
            $this->agentCard,
            null,
            $this->logger,
            $this->taskManager,
            $this->pushNotificationManager,
            $this->eventBusManager,
            $this->executor,
            $this->streamingServer
        );
        $this->server = new A2AServer($protocol, $this->logger);

        $this->logger->info('Agent card configured', [
            'agent_id' => $this->agentCard->getName(),
            'version' => $this->agentCard->getVersion(),
            'base_url' => $baseUrl,
            'https_enabled' => $this->httpsMode
        ]);
    }

    private function setupMessageHandlers(): void
    {
        $messageHandler = new class($this->logger, $this->taskManager, $this->httpsMode) implements \A2A\Interfaces\MessageHandlerInterface {
            private $logger;
            private $taskManager;
            private $httpsMode;
            
            public function __construct($logger, $taskManager, $httpsMode) {
                $this->logger = $logger;
                $this->taskManager = $taskManager;
                $this->httpsMode = $httpsMode;
            }
            
            public function canHandle(\A2A\Models\v030\Message $message): bool {
                return true;
            }
            
            public function handle(\A2A\Models\v030\Message $message, string $fromAgent): array {
                $this->logger->info('Processing message', [
                    'from' => $fromAgent,
                    'message_id' => $message->getMessageId(),
                    'role' => $message->getRole(),
                    'https_mode' => $this->httpsMode
                ]);

                $taskId = $message->getTaskId();
                if ($taskId) {
                    $task = $this->taskManager->getTask($taskId);
                    if ($task) {
                        $this->logger->info('Message task ready for interaction', [
                            'task_id' => $taskId,
                            'message_id' => $message->getMessageId(),
                            'state' => $task->getStatus()->getState()->value,
                            'secure' => $this->httpsMode
                        ]);
                    }
                }
                
                return [
                    'status' => [
                        'state' => 'completed',
                        'timestamp' => date('c')
                    ],
                    'metadata' => [
                        'secure' => $this->httpsMode,
                        'message' => 'HTTPS server processed the request'
                    ]
                ];
            }
        };
        
        $this->server->addMessageHandler($messageHandler);
    }

    public function handleHttpsRedirect(): bool
    {
        // Only redirect in production mode and if not already HTTPS
        if (!$this->httpsMode && getenv('A2A_FORCE_HTTPS') === 'true') {
            $httpsUrl = 'https://' . $_SERVER['HTTP_HOST'] . ':8443' . $_SERVER['REQUEST_URI'];
            header('Location: ' . $httpsUrl, true, 301);
            echo json_encode([
                'jsonrpc' => '2.0',
                'error' => [
                    'code' => -32001,
                    'message' => 'HTTPS required for production. Redirecting...',
                    'data' => ['redirect_url' => $httpsUrl]
                ],
                'id' => null
            ]);
            return true;
        }
        return false;
    }

    public function getAgentCard(): array
    {
        return $this->agentCard->toArray();
    }

    public function handleRequest(): void
    {
        // Handle HTTPS redirect if needed
        if ($this->handleHttpsRedirect()) {
            return;
        }

        // Set CORS headers for cross-origin requests
        $this->setCorsHeaders();

        // Handle preflight requests
        if (($_SERVER['REQUEST_METHOD'] ?? '') === 'OPTIONS') {
            http_response_code(200);
            return;
        }

        // Log security information
        $this->logger->info('Request received', [
            'method' => $_SERVER['REQUEST_METHOD'] ?? 'UNKNOWN',
            'uri' => $_SERVER['REQUEST_URI'] ?? '/',
            'https' => $this->httpsMode,
            'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? 'unknown',
            'remote_addr' => $_SERVER['REMOTE_ADDR'] ?? 'unknown'
        ]);

        // Only accept POST requests for A2A protocol
        if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') {
            $this->sendErrorResponse('Method not allowed', 405);
            return;
        }

        // Get request body
        $input = file_get_contents('php://input');
        if ($input === false || empty($input)) {
            $this->sendErrorResponse('Empty request body', 400);
            return;
        }

        // Parse JSON request
        $request = json_decode($input, true);
        if (json_last_error() !== JSON_ERROR_NONE) {
            $this->sendJsonRpcError(null, 'Parse error', A2AErrorCodes::PARSE_ERROR);
            return;
        }

        $this->logger->info('Request received', [
            'method' => $request['method'] ?? 'unknown',
            'id' => $request['id'] ?? 'none',
            'https_mode' => $this->httpsMode
        ]);

        // Handle streaming requests through A2AServer for proper validation
        if (isset($request['method']) && $request['method'] === 'message/stream') {
            try {
                $response = $this->server->handleRequest($request);
                // If validation passes and no response returned, it means streaming was started
                if (empty($response)) {
                    return;
                }
                // If response returned, it's an error
                $this->sendJsonResponse($response);
                return;
            } catch (\Exception $e) {
                $this->sendJsonRpcError(
                    $request['id'] ?? null,
                    'Streaming error: ' . $e->getMessage(),
                    A2AErrorCodes::INTERNAL_ERROR
                );
                return;
            }
        }

        // Process regular requests through enhanced A2AServer
        try {
            $response = $this->server->handleRequest($request);
            $this->sendJsonResponse($response);
        } catch (\Exception $e) {
            $this->logger->error('Request processing failed', [
                'error' => $e->getMessage(),
                'trace' => $e->getTraceAsString(),
                'https_mode' => $this->httpsMode
            ]);

            $this->sendJsonRpcError(
                $request['id'] ?? null,
                'Internal server error',
                A2AErrorCodes::INTERNAL_ERROR
            );
        }
    }

    private function setCorsHeaders(): void
    {
        header('Access-Control-Allow-Origin: *');
        header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
        header('Access-Control-Allow-Headers: Content-Type, Authorization');
        header('Content-Type: application/json');

        if ($this->httpsMode) {
            header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
        }
    }

    private function sendErrorResponse(string $message, int $httpCode): void
    {
        http_response_code($httpCode);
        echo json_encode(['error' => $message]);
    }

    private function sendJsonRpcError($id, string $message, int $code): void
    {
        $response = [
            'jsonrpc' => '2.0',
            'error' => [
                'code' => $code,
                'message' => $message
            ],
            'id' => $id
        ];
        $this->sendJsonResponse($response);
    }

    private function sendJsonResponse(array $response): void
    {
        echo json_encode($response, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    }

    public function getServerInfo(): array
    {
        return [
            'https_mode' => $this->httpsMode,
            'port' => $this->port,
            'ssl_enabled' => $this->httpsMode,
            'certificates' => $this->httpsMode ? [
                'key_file' => $this->httpsConfig->getKeyFile(),
                'cert_file' => $this->httpsConfig->getCertFile()
            ] : null,
            'agent_card_url' => ($this->httpsMode ? 'https' : 'http') . "://localhost:{$this->port}/.well-known/agent-card.json"
        ];
    }
}

// Initialize the HTTPS-enabled server
$server = new A2AHttpsServer();

// Handle well-known agent card endpoint
if (
    ($_SERVER['REQUEST_METHOD'] ?? '') === 'GET' &&
    ($_SERVER['REQUEST_URI'] ?? '') === '/.well-known/agent-card.json'
) {
    header('Content-Type: application/json');
    header('Access-Control-Allow-Origin: *');
    header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
    header('Access-Control-Allow-Headers: Content-Type, Authorization');

    if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
        exit;
    }

    echo json_encode($server->getAgentCard(), JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    exit;
}

// Handle server info endpoint for debugging
if (
    ($_SERVER['REQUEST_METHOD'] ?? '') === 'GET' &&
    ($_SERVER['REQUEST_URI'] ?? '') === '/server-info'
) {
    header('Content-Type: application/json');
    echo json_encode($server->getServerInfo(), JSON_PRETTY_PRINT);
    exit;
}

// Handle A2A protocol requests
$server->handleRequest();