/*
 *  Copyright 2016 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.odf.rights;

import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Set;

import org.apache.avalon.framework.component.Component;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.avalon.framework.service.Serviceable;

import org.ametys.cms.repository.Content;
import org.ametys.core.group.GroupIdentity;
import org.ametys.core.right.AccessController;
import org.ametys.core.user.UserIdentity;
import org.ametys.odf.ODFHelper;
import org.ametys.odf.ProgramItem;
import org.ametys.odf.course.Course;
import org.ametys.odf.orgunit.OrgUnit;
import org.ametys.odf.program.AbstractProgram;
import org.ametys.runtime.plugin.component.AbstractLogEnabled;

/**
 * This access controller give access the content's creator, regardless of the required right, if and only if the ODF content is still orphan (during creation process for example)
 *
 */
public class ODFOrphanContentAccessController extends AbstractLogEnabled implements AccessController, Component, Serviceable
{
    private ODFHelper _odfHelper;

    public void service(ServiceManager manager) throws ServiceException
    {
        _odfHelper = (ODFHelper) manager.lookup(ODFHelper.ROLE);
    }
    
    @Override
    public boolean isSupported(Object object)
    {
        return object instanceof ProgramItem || object instanceof OrgUnit;
    }
    
    /**
     * Determines if the object is a orphan program item (without parent)
     * @param object the object
     * @return true if the object is a orphan program item 
     */
    protected boolean _isOrphan(Object object)
    {
        if (object instanceof ProgramItem)
        {
            List<ProgramItem> parentProgramItems = _odfHelper.getParentProgramItems((ProgramItem) object);
            return parentProgramItems.isEmpty();
        }
        else if (object instanceof OrgUnit)
        {
            return ((OrgUnit) object).getParentOrgUnit() == null;
        }
        
        return false;
    }
    
    /**
     * Get the user permission on object
     * @param user the user
     * @param object the object
     * @return The access result
     */
    protected AccessResult _getUserPermission(UserIdentity user, Object object)
    {
        if (_isOrphan(object) && !_hasOrgUnit(object))
        {
            if (user.equals(((Content) object).getCreator()))
            {
                return AccessResult.USER_ALLOWED;
            }
        }
        return AccessResult.UNKNOWN;
    }
    
    /**
     * Determines if the object has a orgunit
     * @param object the object
     * @return true if the object is attach to a orgunit
     */
    protected boolean _hasOrgUnit(Object object)
    {
        if (object instanceof AbstractProgram)
        {
            return !((AbstractProgram) object).getOrgUnits().isEmpty();
        }
        else if (object instanceof Course)
        {
            return !((Course) object).getOrgUnits().isEmpty();
        }
        return false;
    }
    
    /**
     * Get the permission by users
     * @param object the object
     * @return the permission by users
     */
    protected Map<UserIdentity, AccessResult> _getPermissionByUser(Object object)
    {
        Map<UserIdentity, AccessResult> permissions = new HashMap<>();
        if (_isOrphan(object) && !_hasOrgUnit(object))
        {
            permissions.put(((Content) object).getCreator(), AccessResult.USER_ALLOWED);
        }
        return permissions;
    }

    @Override
    public AccessResult getPermission(UserIdentity user, Set<GroupIdentity> userGroups, String rightId, Object object)
    {
        return _getUserPermission(user, object);
    }

    @Override
    public AccessResult getReadAccessPermission(UserIdentity user, Set<GroupIdentity> userGroups, Object object)
    {
        return _getUserPermission(user, object);
    }

    @Override
    public Map<String, AccessResult> getPermissionByRight(UserIdentity user, Set<GroupIdentity> userGroups, Object object)
    {
        return Collections.EMPTY_MAP;
    }

    @Override
    public AccessResult getPermissionForAnonymous(String rightId, Object object)
    {
        return AccessResult.UNKNOWN;
    }

    public AccessResult getReadAccessPermissionForAnonymous(Object object)
    {
        return AccessResult.UNKNOWN;
    }

    @Override
    public AccessResult getPermissionForAnyConnectedUser(String rightId, Object object)
    {
        return AccessResult.UNKNOWN;
    }

    @Override
    public AccessResult getReadAccessPermissionForAnyConnectedUser(Object object)
    {
        return AccessResult.UNKNOWN;
    }

    @Override
    public Map<UserIdentity, AccessResult> getPermissionByUser(String rightId, Object object)
    {
        return _getPermissionByUser(object);
    }

    @Override
    public Map<UserIdentity, AccessResult> getReadAccessPermissionByUser(Object object)
    {
        return _getPermissionByUser(object);
    }

    @Override
    public Map<GroupIdentity, AccessResult> getPermissionByGroup(String rightId, Object object)
    {
        return Collections.EMPTY_MAP;
    }

    @Override
    public Map<GroupIdentity, AccessResult> getReadAccessPermissionByGroup(Object object)
    {
        return Collections.EMPTY_MAP;
    }

    @Override
    public boolean hasUserAnyPermissionOnWorkspace(Set<Object> workspacesContexts, UserIdentity user, Set<GroupIdentity> userGroups, String rightId)
    {
        return false;
    }

    @Override
    public boolean hasUserAnyReadAccessPermissionOnWorkspace(Set<Object> workspacesContexts, UserIdentity user, Set<GroupIdentity> userGroups)
    {
        return false;
    }

    @Override
    public boolean hasAnonymousAnyPermissionOnWorkspace(Set<Object> workspacesContexts, String rightId)
    {
        return false;
    }

    @Override
    public boolean hasAnonymousAnyReadAccessPermissionOnWorkspace(Set<Object> workspacesContexts)
    {
        return false;
    }

    @Override
    public boolean hasAnyConnectedUserAnyPermissionOnWorkspace(Set<Object> workspacesContexts, String rightId)
    {
        return false;
    }

    @Override
    public boolean hasAnyConnectedUserAnyReadAccessPermissionOnWorkspace(Set<Object> workspacesContexts)
    {
        return false;
    }
}