/*
 *  Copyright 2018 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.cms.model.restrictions;

import java.util.List;
import java.util.Set;

import org.apache.avalon.framework.component.Component;
import org.apache.avalon.framework.configuration.Configuration;
import org.apache.avalon.framework.configuration.ConfigurationException;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.avalon.framework.service.Serviceable;

import org.ametys.cms.contenttype.DefaultContentType;
import org.ametys.cms.repository.Content;
import org.ametys.cms.repository.WorkflowAwareContent;
import org.ametys.core.right.RightManager;
import org.ametys.core.right.RightManager.RightResult;
import org.ametys.core.user.CurrentUserProvider;
import org.ametys.core.user.UserIdentity;
import org.ametys.plugins.repository.AmetysRepositoryException;
import org.ametys.plugins.workflow.support.WorkflowProvider;
import org.ametys.plugins.workflow.support.WorkflowProvider.AmetysObjectWorkflow;
import org.ametys.runtime.model.ModelItem;

import com.opensymphony.workflow.spi.Step;

/**
 * Helper for definitions with restrictions on contents 
 */
public class ContentRestrictedModelItemHelper implements Component, Serviceable
{
    /** The Avalon role name */
    public static final String ROLE = ContentRestrictedModelItemHelper.class.getName();
    
    /** The rights manager. */
    private RightManager _rightManager;
    /** Current user provider. */
    private CurrentUserProvider _currentUserProvider;
    /** The workflow provider */
    private WorkflowProvider _workflowProvider;
    
    /**
     * TODO NEWATTRIBUTEAPI_CONTENT: make this enum private when caller of {@link #_doFirstRestrictionsChecks(Content, Restrictions, boolean)} in DefaultContentType are removed
     */
    public enum FirstRestrictionsChecksState
    {
        /** First checks are OK */
        TRUE,
        
        /** First checks are not OK */
        FALSE,
        
        /** There are more checks to do */
        UNKNOWN,
    } 
    
    public void service(ServiceManager manager) throws ServiceException
    {
        _rightManager = (RightManager) manager.lookup(RightManager.ROLE);
        _currentUserProvider = (CurrentUserProvider) manager.lookup(CurrentUserProvider.ROLE);
        _workflowProvider = (WorkflowProvider) manager.lookup(WorkflowProvider.ROLE);
    }
    
    /**
     * Determine whether a model item can be read at this time.
     * @param item the model item on which check the restrictions
     * @param content The content where item is to be written on. Can be null, on content creation. 
     * @param restrictions the restrictions to check
     * @return <code>true</code> if the current user is allowed to write the model item of this content.
     * @throws AmetysRepositoryException if an error occurs while accessing the content.
     */
    @SuppressWarnings("unchecked")
    public boolean canRead(Content content, ModelItem item, Restrictions restrictions) throws AmetysRepositoryException
    {
        FirstRestrictionsChecksState state = _doFirstRestrictionsChecks(content, restrictions, true);
        if (!FirstRestrictionsChecksState.UNKNOWN.equals(state))
        {
            return FirstRestrictionsChecksState.TRUE.equals(state);
        }
        
        ModelItem parent = item.getParent();
        if (parent != null && parent instanceof RestrictedModelItem)
        {
            // Check write access on parent model item
            return ((RestrictedModelItem<Content>) parent).canRead(content);
        }
        
        return true;
    }

    /**
     * Determine whether a model item can be written at this time.
     * @param item the model item on which check the restrictions
     * @param content The content where item is to be written on. Can be null, on content creation. 
     * @param restrictions the restrictions to check
     * @return <code>true</code> if the current user is allowed to write the model item of this content.
     * @throws AmetysRepositoryException if an error occurs while accessing the content.
     */
    @SuppressWarnings("unchecked")
    public boolean canWrite(Content content, ModelItem item, Restrictions restrictions) throws AmetysRepositoryException
    {
        FirstRestrictionsChecksState state = _doFirstRestrictionsChecks(content, restrictions, false);
        if (!FirstRestrictionsChecksState.UNKNOWN.equals(state))
        {
            return FirstRestrictionsChecksState.TRUE.equals(state);
        }
        
        ModelItem parent = item.getParent();
        if (parent != null && parent instanceof RestrictedModelItem)
        {
            // Check write access on parent model item
            return ((RestrictedModelItem<Content>) parent).canWrite(content);
        }

        return canRead(content, item, restrictions);
    }
    
    /**
     * Does the first checks on restrictions
     * TODO NEWATTRIBUTEAPI_CONTENT: make this method private when caller in DefaultContentType are removed
     * @param content The content where item is to be read / written on. Can be null, on content creation.
     * @param restrictions The restrictions to apply
     * @param forReading <code>true</code> for reading checks, <code>false</code> for writting checks.
     * @return the state of the first checks
     */
    public FirstRestrictionsChecksState _doFirstRestrictionsChecks(Content content, Restrictions restrictions, boolean forReading)
    {
        if (restrictions == null)
        {
            return FirstRestrictionsChecksState.TRUE;
        }
    
        if (forReading && restrictions.cannotRead() || !forReading && restrictions.cannotWrite())
        {
            return FirstRestrictionsChecksState.FALSE;
        }
     
        if (content == null)
        {
            // Unable to check right (content is not yet created), assume user has right 
            return FirstRestrictionsChecksState.TRUE;
        }
        
        boolean hasRights = _hasRights(content, forReading ? restrictions.getReadRightIds() : restrictions.getWriteRightIds());
        
        if (!hasRights)
        {
            return FirstRestrictionsChecksState.FALSE;
        }
        
        if (content instanceof WorkflowAwareContent)
        {
            hasRights = _isInWorkflowStep((WorkflowAwareContent) content, forReading ? restrictions.getReadWorkflowfStepIds() : restrictions.getWriteWorkflowfStepIds());
            
            if (!hasRights)
            {
                return FirstRestrictionsChecksState.FALSE;
            }
        }
        
        return FirstRestrictionsChecksState.UNKNOWN;
    }
    
    /**
     * Check if current user has the given rights.
     * @param rightLimitations the right limitations.
     * @param content the content.
     * @return <code>true</code> if it is on at least one step,
     *         <code>false</code> otherwise.
     */
    private boolean _hasRights(Content content, Set<String> rightLimitations)
    {
        if (rightLimitations.isEmpty())
        {
            return true;
        }

        UserIdentity user = _currentUserProvider.getUser();

        for (String rightId : rightLimitations)
        {
            if (_rightManager.hasRight(user, rightId, content) == RightResult.RIGHT_ALLOW)
            {
                return true;
            }
        }

        return false;
    }

    /**
     * Check if the workflow of the content is in a given current step.
     * @param workflowLimitations the workflow limitations.
     * @param content the content.
     * @return <code>true</code> if it is on at least one step,
     *         <code>false</code> otherwise.
     * @throws AmetysRepositoryException if an error occurs.
     */
    private boolean _isInWorkflowStep(WorkflowAwareContent content, Set<Integer> workflowLimitations) throws AmetysRepositoryException
    {
        if (workflowLimitations.isEmpty())
        {
            return true;
        }
        
        AmetysObjectWorkflow workflow = _workflowProvider.getAmetysObjectWorkflow(content);
        
        List<Step> workflowCurrentSteps = workflow.getCurrentSteps(content.getWorkflowId());
        
        for (Step step : workflowCurrentSteps)
        {
            for (int stepId : workflowLimitations)
            {
                if (step.getStepId() == stepId)
                {
                    return true;
                }
            }
        }

        // No match
        return false;
    }
    
    /**
     * Parses the attribute definition's restrictions.
     * @param configuration the configuration of the element that have content restrictions
     * @return the parsed restrictions.
     * @throws ConfigurationException if the configuration is not valid.
     */
    public Restrictions _parseRestrictions(Configuration configuration) throws ConfigurationException
    {
        Restrictions restrictions = new Restrictions();
        populateRestrictions(configuration, restrictions);
        return restrictions;
    }
    
    /**
     * Parses the attribute definition's restrictions.
     * TODO NEWATTRIBUTEAPI_CONTENT: This method is public to be used in MetadataAndRepeaterDefinitionParser from {@link DefaultContentType}. Make this method private when it is deleted
     * @param attributeConfiguration the attribute configuration to use.
     * @param restrictions the restrictions.
     * @throws ConfigurationException if the configuration is not valid.
     */
    public void populateRestrictions(Configuration attributeConfiguration, Restrictions restrictions) throws ConfigurationException
    {
        Configuration restrictToConf = attributeConfiguration.getChild("restrict-to", true);

        _populateNegativeRestrictions(restrictToConf, restrictions);
        _populateRightRestrictions(restrictToConf, restrictions);
        _populateWorkflowRestrictions(restrictToConf, restrictions);
    }

    /**
     * Populates the negative restrictions.
     * @param restrictionsConfig the restrictions configuration to use.
     * @param restrictions the restrictions.
     * @throws ConfigurationException if the configuration is not valid.
     */
    private void _populateNegativeRestrictions(Configuration restrictionsConfig, Restrictions restrictions) throws ConfigurationException
    {
        for (Configuration noRightConfig : restrictionsConfig.getChildren("cannot"))
        {
            boolean isRead = _parseAccessType(noRightConfig);
            
            if (isRead)
            {
                restrictions.setCannotRead(true);
            }
            else
            {
                restrictions.setCannotWrite(true);
            }
        }
    }

    /**
     * Populates the rights restrictions.
     * @param restrictionsConfig the restrictions configuration to use.
     * @param restrictions the restrictions.
     * @throws ConfigurationException if the configuration is not valid.
     */
    private void _populateRightRestrictions(Configuration restrictionsConfig, Restrictions restrictions) throws ConfigurationException
    {
        for (Configuration rightConfig : restrictionsConfig.getChildren("right"))
        {
            String rightId = rightConfig.getAttribute("id", null);
            
            if (rightId == null)
            {
                throw new ConfigurationException("Attribute 'id' is mandatory on 'right' element in a content type configuration.", rightConfig);
            }

            boolean isRead = _parseAccessType(rightConfig);
            
            if (isRead)
            {
                restrictions.addReadRightIds(rightId);
            }
            else
            {
                restrictions.addWriteRightIds(rightId);
            }
        }
    }

    /**
     * Populates the workflows restrictions.
     * @param restrictionsConfig the restrictions configuration to use.
     * @param restrictions the restrictions.
     * @throws ConfigurationException if the configuration is not valid.
     */
    private void _populateWorkflowRestrictions(Configuration restrictionsConfig, Restrictions restrictions) throws ConfigurationException
    {
        for (Configuration workflowConfig : restrictionsConfig.getChildren("workflow"))
        {
            String stepId = workflowConfig.getAttribute("step", null);
            int stepIdValue = -1;
            
            if (stepId != null)
            {
                try
                {
                    stepIdValue = Integer.valueOf(stepId);
                }
                catch (NumberFormatException e)
                {
                    // Handled just below
                }
            }
            
            boolean isRead = _parseAccessType(workflowConfig);
            
            if (isRead)
            {
                restrictions.addReadWorkflowfStepIds(stepIdValue);
            }
            else
            {
                restrictions.addWriteWorkflowfStepIds(stepIdValue);
            }
        }
    }
    
    /**
     * Parses type attribute from a configuration.
     * @param configuration the configuration.
     * @return <code>true</code> for <code>read</code> type,
     *         <code>false</code> for <code>write</code> type.
     * @throws ConfigurationException if the configuration is not valid.
     */
    private boolean _parseAccessType(Configuration configuration) throws ConfigurationException
    {
        String type = configuration.getAttribute("read-write-direction");
        
        if ("read".equalsIgnoreCase(type))
        {
            return  true;
        }
        else if ("write".equalsIgnoreCase(type))
        {
            return false;
        }
        else
        {
            throw new ConfigurationException("Attribute 'type' must be 'read' or 'write'.", configuration);
        }
    }
}