/*
 *  Copyright 2016 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.core.right;

import java.io.InputStream;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Optional;
import java.util.Set;
import java.util.stream.Collectors;

import org.apache.avalon.framework.CascadingRuntimeException;
import org.apache.avalon.framework.component.Component;
import org.apache.avalon.framework.configuration.Configurable;
import org.apache.avalon.framework.configuration.Configuration;
import org.apache.avalon.framework.configuration.ConfigurationException;
import org.apache.avalon.framework.configuration.DefaultConfigurationBuilder;
import org.apache.avalon.framework.context.Context;
import org.apache.avalon.framework.context.ContextException;
import org.apache.avalon.framework.context.Contextualizable;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.avalon.framework.service.Serviceable;
import org.apache.avalon.framework.thread.ThreadSafe;
import org.apache.cocoon.components.ContextHelper;
import org.apache.cocoon.environment.Request;
import org.apache.commons.lang3.StringUtils;
import org.apache.excalibur.source.Source;
import org.apache.excalibur.source.SourceResolver;

import org.ametys.core.group.GroupDirectoryDAO;
import org.ametys.core.group.GroupIdentity;
import org.ametys.core.group.GroupManager;
import org.ametys.core.right.AccessController.AccessResult;
import org.ametys.core.user.CurrentUserProvider;
import org.ametys.core.user.UserIdentity;
import org.ametys.core.user.UserManager;
import org.ametys.core.user.population.PopulationContextHelper;
import org.ametys.core.user.population.UserPopulationDAO;
import org.ametys.runtime.i18n.I18nizableText;
import org.ametys.runtime.plugin.component.AbstractLogEnabled;

/**
 * Abstraction for testing a right associated with a resource and a user from a single source.
 */
public class RightManager extends AbstractLogEnabled implements Serviceable, Configurable, ThreadSafe, Component, Contextualizable
{
    /** For avalon service manager */
    public static final String ROLE = RightManager.class.getName();
    /** The id of the READER profile */
    public static final String READER_PROFILE_ID = "READER";
    /** The id of the READER profile */
    public static final String CACHE_REQUEST_ATTRIBUTE_NAME = RightManager.class.getName() + "$Cache";
    
    /** The instance of ObjectUserIdentity for anonymous */
    protected static final UserIdentity __ANONYMOUS_USER_IDENTITY = null; 
    /** The instance of ObjectUserIdentity for any connected user */
    protected static final UserIdentity __ANY_CONNECTED_USER_IDENTITY = new UserIdentity(null, null);       

    /**
     * This first cache is for right result on non-null contexts when calling {@link #hasRight(UserIdentity, String, Object)}
     * 
     * { 
     *      UserIdentity : 
     *      {
     *          RightId :
     *          {
     *              Context : RightResult
     *          }
     *      }
     * }
     */
    private static final String CACHE_1 = RightManager.class.getName() + "$Cache-1";
    /**
     * This second cache is for right result on null contexts when calling {@link #hasRight(UserIdentity, String, Object)}
     * 
     * { 
     *      UserIdentity : 
     *      {
     *          RightId :
     *          {
     *              WorkspaceContexts : RightResult
     *          }
     *      }
     * }
     */
    private static final String CACHE_2 = RightManager.class.getName() + "$Cache-2";
    
    /** Avalon ServiceManager */
    protected ServiceManager _manager;
    /** Avalon SourceResolver */
    protected SourceResolver _resolver;
    /** The rights' list container */
    protected RightsExtensionPoint _rightsEP;
    /** The extension point for the Right Context Convertors */
    protected RightContextConvertorExtensionPoint _rightContextConvertorEP;
    /** The extension point for Access Controllers */
    protected AccessControllerExtensionPoint _accessControllerEP;
    /** The user manager */
    protected UserManager _userManager;
    /** The group manager */
    protected GroupManager _groupManager;
    /** The DAO for user populations */
    protected UserPopulationDAO _userPopulationDAO;
    /** The DAO for group directories */
    protected GroupDirectoryDAO _groupDirectoryDAO;
    /** The current user provider */
    protected CurrentUserProvider _currentUserProvider;
    /** The rights DAO */
    protected RightProfilesDAO _profilesDAO;
    
    private Context _context;
    
    /**
     * Enumeration of all possible values returned by hasRight(user, right, context)
     */
    public enum RightResult
    {
        /**
         * Indicates that a given user has the required right.
         */
        RIGHT_ALLOW,
        
        /**
         * Indicates that a given user does NOT have the required right.
         */
        RIGHT_DENY,
        
        /**
         * Indicates that the system knows nothing about the fact that a given user has a right or not.
         */
        RIGHT_UNKNOWN;
    }
    
    @Override
    public void contextualize(Context context) throws ContextException
    {
        _context = context;
    }
    
    @Override
    public void service(ServiceManager manager) throws ServiceException
    {
        _manager = manager;
        _userManager = (UserManager) manager.lookup(UserManager.ROLE);
        _groupManager = (GroupManager) manager.lookup(GroupManager.ROLE);
        _userPopulationDAO = (UserPopulationDAO) manager.lookup(UserPopulationDAO.ROLE);
        _groupDirectoryDAO = (GroupDirectoryDAO) manager.lookup(GroupDirectoryDAO.ROLE);
        _rightsEP = (RightsExtensionPoint) manager.lookup(RightsExtensionPoint.ROLE);
        _rightContextConvertorEP = (RightContextConvertorExtensionPoint) manager.lookup(RightContextConvertorExtensionPoint.ROLE);
        _accessControllerEP = (AccessControllerExtensionPoint) manager.lookup(AccessControllerExtensionPoint.ROLE);
        _resolver = (SourceResolver) _manager.lookup(SourceResolver.ROLE);
        _currentUserProvider = (CurrentUserProvider) _manager.lookup(CurrentUserProvider.ROLE);
    }
    
    /**
     * Returns the DAO for profiles
     * @return The DAO 
     */
    protected RightProfilesDAO _getProfileDAO ()
    {
        try
        {
            if (_profilesDAO == null)
            {
                _profilesDAO = (RightProfilesDAO) _manager.lookup(RightProfilesDAO.ROLE);
            }
            return _profilesDAO;
        }
        catch (ServiceException e)
        {
            throw new RuntimeException("Failed to retrieve the DAO for profiles", e);
        }
    }
    
    @Override
    public void configure(Configuration configuration) throws ConfigurationException
    {
        Configuration rightsConfiguration = configuration.getChild("rights");

        String externalFile = rightsConfiguration.getAttribute("config", null);
        if (externalFile != null)
        {
            Source source = null;
            try
            {
                source = _resolver.resolveURI("context://" + externalFile);

                if (source.exists())
                {
                    Configuration externalConfiguration;
                    try (InputStream is = source.getInputStream();)
                    {
                        externalConfiguration = new DefaultConfigurationBuilder().build(is);
                    }

                    configureRights(externalConfiguration);
                }
                else if (getLogger().isInfoEnabled())
                {
                    getLogger().info("The optional external rights file '" + externalFile + "' is missing.");
                }
            }
            catch (Exception e)
            {
                String message = "An error occured while retriving external file '" + externalFile + "'";
                getLogger().error(message, e);
                throw new ConfigurationException(message, configuration, e);
            }
            finally
            {
                if (source != null)
                {
                    _resolver.release(source);
                }
            }
        }
        else
        {
            configureRights(rightsConfiguration);
        }
    }
    
    private void configureRights(Configuration configuration) throws ConfigurationException
    {
        Configuration[] rights = configuration.getChildren("right");
        for (Configuration rightConf : rights)
        {
            String id = rightConf.getAttribute("id", "");

            String label = rightConf.getChild("label").getValue("");
            I18nizableText i18nLabel = new I18nizableText("application", label);

            String description = rightConf.getChild("description").getValue("");
            I18nizableText i18nDescription = new I18nizableText("application", description);

            String category = rightConf.getChild("category").getValue("");
            I18nizableText i18nCategory = new I18nizableText("application", category);

            if (id.length() == 0 || label.length() == 0 || description.length() == 0 || category.length() == 0)
            {
                String message = "Error in " + RightManager.class.getName() + " configuration: attribute 'id' and elements 'label', 'description' and 'category' are mandatory.";
                getLogger().error(message);
                throw new ConfigurationException(message, configuration);
            }

            _rightsEP.addRight(id, i18nLabel, i18nDescription, i18nCategory);
        }
    }
    
    /* --------- */
    /* HAS RIGHT */
    /* --------- */
    
    /**
     * Checks a permission for the current logged user, on a given object (or context).<br>
     * If null, it checks if there is at least one object with this permission
     * @param rightId The name of the right to check. Cannot be null.
     * @param object The object to check the right. Can be null to search on any object.
     * @return {@link RightResult#RIGHT_ALLOW}, {@link RightResult#RIGHT_DENY} or {@link RightResult#RIGHT_UNKNOWN}
     * @throws RightsException if an error occurs.
     */
    public RightResult currentUserHasRight(String rightId, Object object) throws RightsException
    {
        return hasRight(_currentUserProvider.getUser(), rightId, object);
    }
    
    /**
     * Checks a permission for a user, on a given object (or context).<br>
     * If null, it checks if there is at least one object with this permission
     * @param userIdentity The user identity. Can be null for anonymous
     * @param rightId The name of the right to check. Cannot be null.
     * @param object The object to check the right. Can be null to search on any object.
     * @return {@link RightResult#RIGHT_ALLOW}, {@link RightResult#RIGHT_DENY} or {@link RightResult#RIGHT_UNKNOWN}
     * @throws RightsException if an error occurs.
     */
    public RightResult hasRight(UserIdentity userIdentity, String rightId, Object object) throws RightsException
    {
        UserIdentity objectUserIdentity = userIdentity == null ? __ANONYMOUS_USER_IDENTITY : userIdentity;
        
        return _hasRight(objectUserIdentity, rightId, object);
    }
    
    /**
     * Gets the right result for anonymous with given right on given object context
     * @param rightId The id of the right
     * @param object The object to check
     * @return the right result for anonymous with given profile on given object context
     */
    public RightResult hasAnonymousRight(String rightId, Object object)
    {
        return _hasRight(__ANONYMOUS_USER_IDENTITY, rightId, object);
    }

    /**
     * Gets the right result for any connected user with given profile on given object context
     * @param rightId The right id to test
     * @param object The object to check
     * @return the right result for any connected user with given profile on given object context
     */
    public RightResult hasAnyConnectedUserRight(String rightId, Object object)
    {
        return _hasRight(__ANY_CONNECTED_USER_IDENTITY, rightId, object);
    }

    private RightResult _hasRight(UserIdentity userIdentity, String rightId, Object object)
    {
        getLogger().debug("Try to determine if user {} has the right '{}' on the object context {}", userIdentity, rightId, object);

        if (StringUtils.isBlank(rightId))
        {
            throw new RightsException("The rightId cannot be null");
        }

        return _hasRightOrRead(userIdentity, rightId, object);
    }
    
    private RightResult _hasRightOrRead(UserIdentity userIdentity, String rightId, Object object)
    {
        if (object == null)
        {
            return _hasRightOrRead(userIdentity, rightId);
        }
        
        // Try to retrieve in first cache (the one which manages non-null contexts)
        RightResult cacheResult = _hasRightResultInFirstCache(userIdentity, rightId, object);
        if (cacheResult != null)
        {
            return cacheResult;
        }
        
        // Retrieve groups the user belongs to
        Set<GroupIdentity> groups = _getGroups(userIdentity);
        
        // Get the objects to check
        Set<Object> objects = _getConvertedObjects(object, new HashSet<>());
        
        // Retrieve the set of AccessResult
        Set<AccessResult> accessResults = _getAccessResults(userIdentity, groups, rightId, objects);
        
        // Compute access
        AccessResult access = AccessResult.merge(accessResults);
        
        RightResult rightResult = access.toRightResult();
        _putInFirstCache(userIdentity, rightId, object, rightResult);
        
        return rightResult;
    }
    
    /**
     * Has the user/anonymous/anyconnected the non null right on any content of the current workspace?
     * @param userIdentity The user connecter or the value for anonymous or any connected user
     * @param rightId The right id to test. Can be null to test read access
     * @return The computed right result
     */
    private RightResult _hasRightOrRead(UserIdentity userIdentity, String rightId)
    {
        // Resolve contexts
        Set<Object> workspacesContexts = _getConvertedObjects("/${WorkspaceName}", new HashSet<>());
        
        // Try to retrieve in second cache (the one which manages null context)
        RightResult cacheResult = _hasRightResultInSecondCache(workspacesContexts, userIdentity, rightId);
        if (cacheResult != null)
        {
            return cacheResult;
        }
        
        // Retrieve groups the user belongs to
        Set<GroupIdentity> groups = _getGroups(userIdentity);

        RightResult rightResult = RightResult.RIGHT_UNKNOWN;
        for (String controllerId : _accessControllerEP.getExtensionsIds())
        {
            AccessController accessController = _accessControllerEP.getExtension(controllerId);
            try
            {
                if (userIdentity == __ANONYMOUS_USER_IDENTITY && (rightId == null ? accessController.hasAnonymousAnyReadAccessPermissionOnWorkspace(workspacesContexts) : accessController.hasAnonymousAnyPermissionOnWorkspace(workspacesContexts, rightId))
                        || userIdentity == __ANY_CONNECTED_USER_IDENTITY && (rightId == null ? accessController.hasAnyConnectedUserAnyReadAccessPermissionOnWorkspace(workspacesContexts) : accessController.hasAnyConnectedUserAnyPermissionOnWorkspace(workspacesContexts, rightId))
                        || (rightId == null ? accessController.hasUserAnyReadAccessPermissionOnWorkspace(workspacesContexts, userIdentity, groups) : accessController.hasUserAnyPermissionOnWorkspace(workspacesContexts, userIdentity, groups, rightId)))
                {
                    rightResult = RightResult.RIGHT_ALLOW;
                    break;
                }
            }
            catch (Exception e)
            {
                getLogger().error("An error occured with controller '{}'. Thus, this controller will be ignored.", controllerId, e);
            }
        }
        
        getLogger().debug("Right result found for [{}, {}, {}] => {}", workspacesContexts, userIdentity, rightId, rightResult);
        _putInSecondCache(workspacesContexts, userIdentity, rightId, rightResult);
        return rightResult;
    }
    
    private Set<AccessResult> _getAccessResults(UserIdentity userIdentity, Set<GroupIdentity> groups, String rightId, Set<Object> objects)
    {
        Set<AccessResult> accessResults = new HashSet<>();
        for (Object obj : objects)
        {
            for (String controllerId : _accessControllerEP.getExtensionsIds())
            {
                AccessController accessController = _accessControllerEP.getExtension(controllerId);
                try
                {
                    if (accessController.isSupported(obj))
                    {
                        if (userIdentity == __ANONYMOUS_USER_IDENTITY)
                        {
                            accessResults.add(rightId == null ? accessController.getReadAccessPermissionForAnonymous(obj) : accessController.getPermissionForAnonymous(rightId, obj));
                        }
                        else if (userIdentity == __ANY_CONNECTED_USER_IDENTITY)
                        {
                            accessResults.add(rightId == null ? accessController.getReadAccessPermissionForAnyConnectedUser(obj) : accessController.getPermissionForAnyConnectedUser(rightId, obj));
                        }
                        else
                        {
                            accessResults.add(rightId == null ? accessController.getReadAccessPermission(userIdentity, groups, obj) : accessController.getPermission(userIdentity, groups, rightId, obj));
                        }
                    }
                    else
                    {
                        accessResults.add(AccessResult.UNKNOWN);
                    }
                }
                catch (Exception e)
                {
                    getLogger().error("An error occured with controller '{}' for object {}. Thus, this controller will be ignored.", controllerId, obj, e);
                }
            }
        }
        
        return accessResults;
    }
    
    /* --------------- */
    /* HAS READ ACCESS */
    /* --------------- */
    
    /**
     * Returns true if the current user has READ access on the given object
     * @param object The object to check the right. Can be null to search on any object.
     * @return true if the given user has READ access on the given object
     */
    public boolean currentUserHasReadAccess(Object object)
    {
        return hasReadAccess(_currentUserProvider.getUser(), object);
    }

    /**
     * Returns true if the given user has READ access on the given object
     * @param userIdentity The user identity. Cannot be null.
     * @param object The object to check the right. Can be null to search on any object.
     * @return true if the given user has READ access on the given object
     */
    public boolean hasReadAccess(UserIdentity userIdentity, Object object)
    {
        UserIdentity objectUserIdentity = userIdentity == null ? __ANONYMOUS_USER_IDENTITY : userIdentity;

        return _hasRightOrRead(objectUserIdentity, null, object) == RightResult.RIGHT_ALLOW;
    }
    
    /**
     * Returns true if the object is not restricted, i.e. an anonymous user has READ access (is allowed) on the object
     * @param object The object to check. Cannot be null
     * @return true if the object is restricted, i.e. an anonymous user has READ access (is allowed) on the object
     */
    public boolean hasAnonymousReadAccess(Object object)
    {
        return _hasRightOrRead(__ANONYMOUS_USER_IDENTITY, null, object) == RightResult.RIGHT_ALLOW;
    }
    
    /**
     * Returns true if any connected user has READ access allowed on the object
     * @param object The object to check. Cannot be null
     * @return true if any connected user has READ access allowed on the object
     */
    public boolean hasAnyConnectedUserReadAccess(Object object)
    {
        return _hasRightOrRead(__ANY_CONNECTED_USER_IDENTITY, null, object) == RightResult.RIGHT_ALLOW;
    }
    
    /* ------------- */
    /* ALLOWED USERS */
    /* ------------- */

    /**
     * Get the list of users that have a particular right in a particular context.
     * @param rightId The name of the right to check. Cannot be null.
     * @param object The object to check the right. Cannot be null.
     * @return The list of users allowed with that right as a Set of String (user identities).
     * @throws RightsException if an error occurs.
     */
    public AllowedUsers getAllowedUsers(String rightId, Object object)
    {
        if (StringUtils.isBlank(rightId))
        {
            throw new RightsException("The rightId cannot be null");
        }

        return _getAllowedUsers(rightId, object);
    }
    
    /**
     * Get the users with a READ access on given object
     * @param object The object
     * @return The representation of allowed users 
     */
    public AllowedUsers getReadAccessAllowedUsers(Object object)
    {
        return _getAllowedUsers(null, object);
    }
    
    private AllowedUsers _getAllowedUsers(String rightId, Object object)
    {
        Optional.ofNullable(object).orElseThrow(() -> 
        {
            return new RightsException("The object cannot be null");
        });
        
        // Get the objects to check
        Set<Object> objects = _getConvertedObjects(object, new HashSet<>());
        
        // For each object, retrieve the allowed and denied users/groups
        Boolean isAnyConnectedAllowed = null; // unknown
        Set<UserIdentity> allAllowedUsers = new HashSet<>();
        Set<UserIdentity> allDeniedUsers = new HashSet<>();
        Set<GroupIdentity> allAllowedGroups = new HashSet<>();
        Set<GroupIdentity> allDeniedGroups = new HashSet<>();
        
        for (Object obj : objects)
        {
            for (String controllerId : _accessControllerEP.getExtensionsIds())
            {
                AccessController accessController = _accessControllerEP.getExtension(controllerId);
                try
                {
                    if (accessController.isSupported(obj))
                    {
                        if ((rightId == null ? accessController.getReadAccessPermissionForAnonymous(obj) : accessController.getPermissionForAnonymous(rightId, obj)) == AccessResult.ANONYMOUS_ALLOWED)
                        {
                            // Any anonymous user is allowed
                            return new AllowedUsers(true, false, null, null, null, null, _userManager, _groupManager, null);
                        }
                        
                        AccessResult permissionForAnyConnectedUser = rightId == null ? accessController.getReadAccessPermissionForAnyConnectedUser(obj) : accessController.getPermissionForAnyConnectedUser(rightId, obj);
                        if (permissionForAnyConnectedUser == AccessResult.ANY_CONNECTED_DENIED)
                        {
                            // For having any connected user allowed, you need to not have the denied access for one object
                            isAnyConnectedAllowed = Boolean.FALSE;
                        }
                        else if (isAnyConnectedAllowed == null && permissionForAnyConnectedUser == AccessResult.ANY_CONNECTED_ALLOWED)
                        {
                            isAnyConnectedAllowed = Boolean.TRUE;
                        }
                        
                        Map<UserIdentity, AccessResult> permissionsByUser = rightId == null ? accessController.getReadAccessPermissionByUser(obj) : accessController.getPermissionByUser(rightId, obj);
                        
                        Set<UserIdentity> allowedUsersOnObj = permissionsByUser.entrySet().stream()
                                .filter(entry -> AccessResult.USER_ALLOWED.equals(entry.getValue()))
                                .map(Entry::getKey)
                                .collect(Collectors.toSet());
                        allAllowedUsers.addAll(allowedUsersOnObj);
                        
                        Set<UserIdentity> deniedUsersOnObj = permissionsByUser.entrySet().stream()
                                .filter(entry -> AccessResult.USER_DENIED.equals(entry.getValue()))
                                .map(Entry::getKey)
                                .collect(Collectors.toSet());
                        allDeniedUsers.addAll(deniedUsersOnObj);
                        
                        
                        Map<GroupIdentity, AccessResult> permissionsByGroup = rightId == null ? accessController.getReadAccessPermissionByGroup(obj) : accessController.getPermissionByGroup(rightId, obj);
                        
                        Set<GroupIdentity> allowedGroupsOnObj = permissionsByGroup.entrySet().stream()
                                .filter(entry -> AccessResult.GROUP_ALLOWED.equals(entry.getValue()))
                                .map(Entry::getKey)
                                .collect(Collectors.toSet());
                        allAllowedGroups.addAll(allowedGroupsOnObj);
                        
                        Set<GroupIdentity> deniedGroupsOnObj = permissionsByGroup.entrySet().stream()
                                .filter(entry -> AccessResult.GROUP_DENIED.equals(entry.getValue()))
                                .map(Entry::getKey)
                                .collect(Collectors.toSet());
                        allDeniedGroups.addAll(deniedGroupsOnObj);
                    }
                }
                catch (Exception e)
                {
                    getLogger().error("An error occured with controller '{}' for object {}. Thus, this controller will be ignored.", controllerId, obj, e);
                }
            }
        }
        
        Request request = ContextHelper.getRequest(_context);
        @SuppressWarnings("unchecked")
        List<String> populationContexts = (List<String>) request.getAttribute(PopulationContextHelper.POPULATION_CONTEXTS_REQUEST_ATTR);
        
        // Then, return the AllowedUsers object
        return new AllowedUsers(false, isAnyConnectedAllowed != null && isAnyConnectedAllowed.booleanValue(), allAllowedUsers, allDeniedUsers, allAllowedGroups, allDeniedGroups, _userManager, _groupManager, populationContexts != null ? new HashSet<>(populationContexts) : new HashSet<>());
    }
    
    /* --------------- */
    /* GET USER RIGHTS */
    /* --------------- */
    
    /**
     * Get the list of rights a user is allowed, on a particular object.
     * @param userIdentity the user identity. Cannot be null.
     * @param object The object to check the right. Cannot be null.
     * @return The list of rights as a Set of String (id).
     * @throws RightsException if an error occurs.
     */
    public Set<String> getUserRights(UserIdentity userIdentity, Object object) throws RightsException
    {
        if (userIdentity == null)
        {
            throw new RightsException("The userIdentity cannot be null");
        }
        else if (object == null)
        {
            throw new RightsException("The object cannot be null");
        }
        
        // Get the objects to check
        Set<Object> objects = _getConvertedObjects(object, new HashSet<>());
        
        // Retrieve groups the user belongs to
        Set<GroupIdentity> groups = _groupManager.getUserGroups(userIdentity);
        
        // Gets the access by rights
        Map<String, AccessResult> accessResultsByRight = _getAccessResultByRight(userIdentity, groups, objects);
        
        // Keep only positive rights
        Set<String> allowedRights = accessResultsByRight.entrySet().stream().filter(entry -> entry.getValue().toRightResult() == RightResult.RIGHT_ALLOW).map(entry -> entry.getKey()).collect(Collectors.toSet());
        return allowedRights;
    }
    
    private Map<String, AccessResult> _getAccessResultByRight(UserIdentity userIdentity, Set<GroupIdentity> groups, Set<Object> objects)
    {
        Map<String, AccessResult> result = new HashMap<>();
        
        for (Object obj : objects)
        {
            for (String controllerId : _accessControllerEP.getExtensionsIds())
            {
                AccessController accessController = _accessControllerEP.getExtension(controllerId);
                try
                {
                    if (accessController.isSupported(obj))
                    {
                        // Update the result map
                        Map<String, AccessResult> permissionsByRight = accessController.getPermissionByRight(userIdentity, groups, obj);
                        for (String rightId : permissionsByRight.keySet())
                        {
                            result.put(rightId, AccessResult.merge(result.get(rightId), permissionsByRight.get(rightId)));
                        }
                    }
                }
                catch (Exception e)
                {
                    getLogger().error("An error occured with controller '{}' for object {}. Thus, this controller will be ignored.", controllerId, obj, e);
                }
            }
        }
        
        return result;
    }

    /* ------- */
    /* PRIVATE */
    /* ------- */
    
    private Set<Object> _getConvertedObjects(Object object, Set<Object> alreadyHandledObjects)
    {
        Set<Object> finalObjects = new HashSet<>();
        
        if (!alreadyHandledObjects.contains(object))
        {
            alreadyHandledObjects.add(object);
            
            Set<Object> objects = _rightContextConvertorEP.getExtensionsIds().stream()
                    .map(_rightContextConvertorEP::getExtension)
                    .flatMap(convertor -> convertor.convert(object).stream())
                    .collect(Collectors.toSet());
            
            finalObjects.addAll(objects);
            finalObjects.add(object);
    
            for (Object convertedObject : objects)
            {
                finalObjects.addAll(_getConvertedObjects(convertedObject, alreadyHandledObjects));
            }
        }
        
        return finalObjects;
    }
    
    private Set<GroupIdentity> _getGroups(UserIdentity userIdentity)
    {
        if (userIdentity == __ANONYMOUS_USER_IDENTITY || userIdentity == __ANY_CONNECTED_USER_IDENTITY)
        {
            return Collections.EMPTY_SET;
        }
        else
        {
            Set<GroupIdentity> userGroups = _groupManager.getUserGroups(userIdentity);
            return userGroups;
        }
    }

    
    
    private RightResult _hasRightResultInFirstCache(UserIdentity userIdentity, String rightId, Object object)
    {
        @SuppressWarnings("unchecked")
        Map<UserIdentity, Map<String, Map<Object, RightResult>>> mapCache = getCache(CACHE_1, false);
        if (mapCache != null)
        {
            if (mapCache.containsKey(userIdentity))
            {
                Map<String, Map<Object, RightResult>> mapRight = mapCache.get(userIdentity);
                if (mapRight.containsKey(rightId))
                {
                    Map<Object, RightResult> mapContext = mapRight.get(rightId);
                    if (mapContext.containsKey(object))
                    {
                        RightResult cacheResult = mapContext.get(object); 
                        getLogger().debug("Find entry in cache for [{}, {}, {}] => {}", userIdentity, rightId, object, cacheResult);
                        return cacheResult;
                    }
                }
            }
        }
        
        getLogger().debug("Did not find entry in cache for [{}, {}, {}]", userIdentity, rightId, object);
        return null;
    }
    
    private void _putInFirstCache(UserIdentity userIdentity, String rightId, Object object, RightResult rightResult)
    {
        @SuppressWarnings("unchecked")
        Map<UserIdentity, Map<String, Map<Object, RightResult>>> mapCache = getCache(CACHE_1, true);
        if (mapCache != null)
        {
            if (!mapCache.containsKey(userIdentity))
            {
                mapCache.put(userIdentity, new HashMap<>());
            }
            Map<String, Map<Object, RightResult>> mapRight = mapCache.get(userIdentity);
            
            if (!mapRight.containsKey(rightId))
            {
                mapRight.put(rightId, new HashMap<>());
            }
            Map<Object, RightResult> mapContext = mapRight.get(rightId);
            
            mapContext.put(object, rightResult);
        }
    }
    
    private RightResult _hasRightResultInSecondCache(Set<Object> workspacesContexts, UserIdentity userIdentity, String rightId)
    {
        @SuppressWarnings("unchecked")
        Map<UserIdentity, Map<String, Map<Object, RightResult>>> mapCache = getCache(CACHE_2, false);
        if (mapCache != null)
        {
            if (mapCache.containsKey(userIdentity))
            {
                Map<String, Map<Object, RightResult>> mapRight = mapCache.get(userIdentity);
                if (mapRight.containsKey(rightId))
                {
                    Map<Object, RightResult> resultPerContext = mapRight.get(rightId);
                    if (resultPerContext.containsKey(workspacesContexts))
                    {
                        RightResult cacheResult = resultPerContext.get(workspacesContexts);
                        getLogger().debug("Find entry in cache2 for [{}, {}, {}] => {}", workspacesContexts, userIdentity, rightId, cacheResult);
                        return cacheResult;
                    }
                }
            }
        }
        
        getLogger().debug("Did not find entry in cache2 for [{}, {}, {}]", workspacesContexts, userIdentity, rightId);
        return null;
    }
    
    private void _putInSecondCache(Set<Object> workspacesContexts, UserIdentity userIdentity, String rightId, RightResult rightResult)
    {
        @SuppressWarnings("unchecked")
        Map<UserIdentity, Map<String, Map<Object, RightResult>>> mapCache = getCache(CACHE_2, true);
        if (mapCache != null)
        {
            if (!mapCache.containsKey(userIdentity))
            {
                mapCache.put(userIdentity, new HashMap<>());
            }
            Map<String, Map<Object, RightResult>> mapRights = mapCache.get(userIdentity);
            
            if (!mapRights.containsKey(rightId))
            {
                mapRights.put(rightId, new HashMap<>());            
            }
            Map<Object, RightResult> mapResult = mapRights.get(rightId);
            
            mapResult.put(workspacesContexts, rightResult);
        }
    }
    
    /**
     * Get the RightManager cache. Use this to store your information on rights
     * @param cacheKey The cache key
     * @param createIfUnexisting Creates a new HashMap if the cache does not exists yet
     * @return The existing cache. Can be null if there is no cache and createIfUnexisting is false, but can also be null if there is no running request to store the cache
     */
    public Map getCache(String cacheKey, boolean createIfUnexisting)
    {
        Request request;
        try
        {
            request = ContextHelper.getRequest(_context);
        }
        catch (CascadingRuntimeException e)
        {
            return null;
        }
        
        if (request == null)
        {
            return null;
        }
        
        @SuppressWarnings("unchecked")
        Map<String, Map> cache = (Map<String, Map>) request.getAttribute(CACHE_REQUEST_ATTRIBUTE_NAME);
        if (cache == null)
        {
            if (!createIfUnexisting)
            {
                return null;
            }
            
            cache = new HashMap<>();
            request.setAttribute(CACHE_REQUEST_ATTRIBUTE_NAME, cache);
        }
        
        Map mapCache = cache.get(cacheKey);
        if (mapCache == null && createIfUnexisting)
        {
            mapCache = new HashMap<>();
            cache.put(cacheKey, mapCache);
        }
        return mapCache;
    }
}