/*
 *  Copyright 2016 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.plugins.repository.jcr;

import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import java.util.stream.Collectors;

import javax.jcr.Node;
import javax.jcr.NodeIterator;
import javax.jcr.PathNotFoundException;
import javax.jcr.Repository;
import javax.jcr.RepositoryException;
import javax.jcr.Session;
import javax.jcr.Value;
import javax.jcr.lock.Lock;
import javax.jcr.lock.LockManager;
import javax.jcr.query.Query;

import org.apache.avalon.framework.component.Component;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.avalon.framework.service.Serviceable;
import org.apache.jackrabbit.util.ISO9075;
import org.apache.jackrabbit.util.Text;

import org.ametys.core.group.GroupIdentity;
import org.ametys.core.user.UserIdentity;
import org.ametys.core.util.LambdaUtils;
import org.ametys.plugins.repository.ACLAmetysObject;
import org.ametys.plugins.repository.AmetysObjectResolver;
import org.ametys.plugins.repository.AmetysRepositoryException;
import org.ametys.plugins.repository.ModifiableACLAmetysObject;
import org.ametys.plugins.repository.ModifiableACLAmetysObjectProfileAssignmentStorage;
import org.ametys.plugins.repository.RepositoryConstants;
import org.ametys.plugins.repository.provider.AbstractRepository;
import org.ametys.plugins.repository.query.expression.Expression;
import org.ametys.plugins.repository.query.expression.OrExpression;

/**
 * Helper for implementing {@link ModifiableACLAmetysObject} in JCR under its node.
 */
public class ACLJCRAmetysObjectHelper implements Component, Serviceable
{
    /** The AmetysObject resolver */
    protected static AmetysObjectResolver _resolver;
    /** The repository */
    protected static Repository _repository;
    
    private static final String __NODE_NAME_ROOT_ACL = RepositoryConstants.NAMESPACE_PREFIX_INTERNAL + ":acl";
    private static final String __NODETYPE_ROOT_ACL = RepositoryConstants.NAMESPACE_PREFIX + ":acl";
    
    private static final String __NODE_NAME_ACL_USERS = "users";
    private static final String __NODE_NAME_ACL_GROUPS = "groups";
    private static final String __NODETYPE_ACL_USER = RepositoryConstants.NAMESPACE_PREFIX + ":acl-user";
    private static final String __NODETYPE_ACL_GROUP = RepositoryConstants.NAMESPACE_PREFIX + ":acl-group";
    private static final String __NODETYPE_UNSTRUCTURED = "nt:unstructured";
    
    private static final String __PROPERTY_NAME_ALLOWED_ANY_CONNECTED_PROFILES = RepositoryConstants.NAMESPACE_PREFIX + ":allowed-any-connected-profiles";
    private static final String __PROPERTY_NAME_DENIED_ANY_CONNECTED_PROFILES = RepositoryConstants.NAMESPACE_PREFIX + ":denied-any-connected-profiles";
    private static final String __PROPERTY_NAME_ALLOWED_ANONYMOUS_PROFILES = RepositoryConstants.NAMESPACE_PREFIX + ":allowed-anonymous-profiles";
    private static final String __PROPERTY_NAME_DENIED_ANONYMOUS_PROFILES = RepositoryConstants.NAMESPACE_PREFIX + ":denied-anonymous-profiles";
    
    private static final String __PROPERTY_NAME_ALLOWED_PROFILES = RepositoryConstants.NAMESPACE_PREFIX + ":allowed-profiles";
    private static final String __PROPERTY_NAME_DENIED_PROFILES = RepositoryConstants.NAMESPACE_PREFIX + ":denied-profiles";
    
    @Override
    public void service(ServiceManager manager) throws ServiceException
    {
        _resolver = (AmetysObjectResolver) manager.lookup(AmetysObjectResolver.ROLE);
        _repository = (Repository) manager.lookup(AbstractRepository.ROLE);
    }
    
    
    /* -------------- */
    /* HAS PERMISSION */
    /* -------------- */
    
    private static Set<String> _convertNodeToPath(Set<? extends Object> rootNodes)
    {
        return rootNodes.stream().map(JCRAmetysObject.class::cast).map(LambdaUtils.wrap(ao -> ISO9075.encodePath(ao.getNode().getPath()))).collect(Collectors.toSet());
    }
    
    /**
     * Returns true if any ACL Ametys object has one of the given profiles as denied for the user
     * @param user The user
     * @param profileIds The ids of the profiles
     * @param rootNodes The JCR root nodes where starts the query search (must be something like "//element(myNode, ametys:collection)"), it will be the beginning of the JCR query. Can be null to not restrict the search.
     * @return true if any ACL Ametys object has one of the given profiles as denied for the user
     */
    public static boolean hasUserDeniedProfile(Set<? extends Object> rootNodes, UserIdentity user, Set<String> profileIds)
    {
        Expression expr = new DeniedProfileExpression(profileIds.toArray(new String[profileIds.size()]));
        for (String rootPath : _convertNodeToPath(rootNodes))
        {
            NodeIterator nodes = getACLUsers(user, rootPath, expr);
            
            if (nodes.hasNext())
            {
                return true;
            }
        }
        return false;
    }
    
    /**
     * Returns true if any ACL Ametys object has one of the given profiles as allowed for the user
     * @param user The user
     * @param profileIds The ids of the profiles
     * @param rootNodes The JCR root nodes where starts the query search (must be something like "//element(myNode, ametys:collection)"), it will be the beginning of the JCR query. Can be null to not restrict the search.
     * @return true if any ACL Ametys object has one of the given profiles as allowed for the user
     */
    public static boolean hasUserAllowedProfile(Set<? extends Object> rootNodes, UserIdentity user, Set<String> profileIds)
    {
        Expression expr = new AllowedProfileExpression(profileIds.toArray(new String[profileIds.size()]));
        for (String rootPath : _convertNodeToPath(rootNodes))
        {
            NodeIterator nodes = getACLUsers(user, rootPath, expr);
            
            if (nodes.hasNext())
            {
                return true;
            }
        }
        return false;
    }
    
    /**
     * Returns true if any ACL Ametys object has one of the given profiles as denied for the group
     * @param group The group
     * @param profileIds The ids of the profiles
     * @param rootNodes The JCR root nodes where starts the query search (must be something like "//element(myNode, ametys:collection)"), it will be the beginning of the JCR query. Can be null to not restrict the search.
     * @return true if any ACL Ametys object has one of the given profiles as denied for the group
     */
    public static boolean hasGroupDeniedProfile(Set<? extends Object> rootNodes, GroupIdentity group, Set<String> profileIds)
    {
        Expression expr = new DeniedProfileExpression(profileIds.toArray(new String[profileIds.size()]));
        for (String rootPath : _convertNodeToPath(rootNodes))
        {
            NodeIterator nodes = getACLGroups(group, rootPath, expr);
            
            if (nodes.hasNext())
            {
                return true;
            }
        }
        return false;
    }
    
    /**
     * Returns true if any ACL Ametys object has one of the given profiles as allowed for the group
     * @param group The group
     * @param profileIds The ids of the profiles
     * @param rootNodes The JCR root nodes where starts the query search (must be something like "//element(myNode, ametys:collection)"), it will be the beginning of the JCR query. Can be null to not restrict the search.
     * @return true if any ACL Ametys object has one of the given profiles as allowed for the group
     */
    public static boolean hasGroupAllowedProfile(Set<? extends Object> rootNodes, GroupIdentity group, Set<String> profileIds)
    {
        Expression expr = new AllowedProfileExpression(profileIds.toArray(new String[profileIds.size()]));
        for (String rootPath : _convertNodeToPath(rootNodes))
        {
            NodeIterator nodes = getACLGroups(group, rootPath, expr);
            
            if (nodes.hasNext())
            {
                return true;
            }
        }
        return false;
    }
    
    /**
     * Returns true if any ACL Ametys object has one of the given profiles as denied for any connected user
     * @param profileIds The ids of the profiles
     * @param rootNodes The JCR root nodes where starts the query search (must be something like "//element(myNode, ametys:collection)"), it will be the beginning of the JCR query. Can be null to not restrict the search.
     * @return true if any ACL Ametys object has one of the given profiles as denied for any connected user
     */
    public static boolean hasAnyConnectedDeniedProfile(Set<? extends Object> rootNodes, Set<String> profileIds)
    {
        Expression expr = new AnyConnectedDeniedProfileExpression(profileIds.toArray(new String[profileIds.size()]));
        for (String rootPath : _convertNodeToPath(rootNodes))
        {
            NodeIterator nodes = getACLRoots(rootPath, expr);
            
            if (nodes.hasNext())
            {
                return true;
            }
        }
        return false;
    }
    
    /**
     * Returns true if any ACL Ametys object has one of the given profiles as allowed for any connected user
     * @param profileIds The ids of the profiles
     * @param rootNodes The JCR root nodes where starts the query search (must be something like "//element(myNode, ametys:collection)"), it will be the beginning of the JCR query. Can be null to not restrict the search.
     * @return true if any ACL Ametys object has one of the given profiles as allowed for any connected user
     */
    public static boolean hasAnyConnectedAllowedProfile(Set<? extends Object> rootNodes, Set<String> profileIds)
    {
        Expression expr = new AnyConnectedAllowedProfileExpression(profileIds.toArray(new String[profileIds.size()]));
        for (String rootPath : _convertNodeToPath(rootNodes))
        {
            NodeIterator nodes = getACLRoots(rootPath, expr);
            
            if (nodes.hasNext())
            {
                return true;
            }
        }
        return false;
    }
    
    /**
     * Returns true if any ACL Ametys object has one of the given profiles as denied for anonymous
     * @param profileIds The ids of the profiles
     * @param rootNodes The JCR root nodes where starts the query search (must be something like "//element(myNode, ametys:collection)"), it will be the beginning of the JCR query. Can be null to not restrict the search.
     * @return true if any ACL Ametys object has one of the given profiles as denied for anonymous
     */
    public static boolean hasAnonymousDeniedProfile(Set<? extends Object> rootNodes, Set<String> profileIds)
    {
        Expression expr = new AnonymousDeniedProfileExpression(profileIds.toArray(new String[profileIds.size()]));
        for (String rootPath : _convertNodeToPath(rootNodes))
        {
            NodeIterator nodes = getACLRoots(rootPath, expr);
            
            if (nodes.hasNext())
            {
                return true;
            }
        }
        return false;
    }
    
    /**
     * Returns true if any ACL Ametys object has one of the given profiles as allowed for anonymous
     * @param profileIds The ids of the profiles
     * @param rootNodes The JCR root nodes where starts the query search (must be something like "//element(myNode, ametys:collection)"), it will be the beginning of the JCR query. Can be null to not restrict the search.
     * @return true if any ACL Ametys object has one of the given profiles as allowed for anonymous
     */
    public static boolean hasAnonymousAllowedProfile(Set<? extends Object> rootNodes, Set<String> profileIds)
    {
        Expression expr = new AnonymousAllowedProfileExpression(profileIds.toArray(new String[profileIds.size()]));
        for (String rootPath : _convertNodeToPath(rootNodes))
        {
            NodeIterator nodes = getACLRoots(rootPath, expr);
            
            if (nodes.hasNext())
            {
                return true;
            }
        }
        return false;
    }
    
    /**
     * Returns all ACL root objects (ametys:acl nodes)
     * @param rootPath The root path to restrict the search. Can be null.
     * @return The ACL root objects
     */
    public static NodeIterator getACLRoots (String rootPath)
    {
        return getACLRoots(rootPath, null);
    }
    
    /**
     * Returns all ACL root objects (ametys:acl nodes)
     * @param rootPath The root path to restrict the search. Can be null.
     * @param predicat The predicat expression. Can be null.
     * @return The ACL root objects
     */
    public static NodeIterator getACLRoots (String rootPath, Expression predicat)
    {
        StringBuilder sb = new StringBuilder("/jcr:root");
        
        if (rootPath != null)
        {
            sb.append(rootPath);
        }
        
        sb.append("//element(*, ").append(__NODETYPE_ROOT_ACL).append(")");
        
        if (predicat != null)
        {
            sb.append("[").append(predicat.build()).append("]");
        }
        
        return _query(sb.toString());
    }
    
    /**
     * Returns all ACL objects for a given user (ametys:acl-user nodes)
     * @param user The user
     * @param rootPath The root path to restrict the search. Can be null.
     * @return The ACL user objects for user
     */
    public static NodeIterator getACLUsers (UserIdentity user, String rootPath)
    {
        return getACLUsers(user, rootPath, null);
    }
    
    /**
     * Returns all ACL objects for a given user (ametys:acl-user nodes)
     * @param user The user
     * @param rootPath The root path to restrict the search. Can be null.
     * @param predicat The predicat expression. Can be null.
     * @return The ACL user objects for user
     */
    public static NodeIterator getACLUsers (UserIdentity user, String rootPath, Expression predicat)
    {
        StringBuilder sb = new StringBuilder("/jcr:root");
        
        if (rootPath != null)
        {
            sb.append(rootPath);
        }
        
        sb.append("//element(*, ").append(__NODETYPE_ROOT_ACL).append(")")
            .append("/").append(__NODE_NAME_ACL_USERS)
            .append("/").append(user.getPopulationId())
            .append("/").append(ISO9075.encode(user.getLogin()));
        
        if (predicat != null)
        {
            sb.append("[").append(predicat.build()).append("]");
        }
        
        String jcrQuery = sb.toString();
        return _query(jcrQuery);
    }
    
    /**
     * Returns all ACL objects for users (ametys:acl-user nodes)
     * @return The ACL user objects for users
     */
    public static NodeIterator getACLUsers ()
    {
        return getACLUsers(null);
    }
    
    /**
     * Returns all ACL objects for users (ametys:acl-user nodes)
     * @param predicat The predicat expression. Can be null.
     * @return The ACL user objects for users
     */
    public static NodeIterator getACLUsers (Expression predicat)
    {
        StringBuilder sb = new StringBuilder();
        
        sb.append("//element(*, ").append(__NODETYPE_ACL_USER).append(")");
        
        if (predicat != null)
        {
            sb.append("[").append(predicat.build()).append("]");
        }
        
        return _query(sb.toString());
    }
    
    /**
     * Returns all ACL objects for groups (ametys:acl-group nodes)
     * @param predicat The predicat expression. Can be null.
     * @return The ACL group objects for groups
     */
    public static NodeIterator getACLGroups (Expression predicat)
    {
        StringBuilder sb = new StringBuilder();
        
        sb.append("//element(*, ").append(__NODETYPE_ACL_GROUP).append(")");
        
        if (predicat != null)
        {
            sb.append("[").append(predicat.build()).append("]");
        }
        
        return _query(sb.toString());
    }
    
    /**
     * Returns all ACL objects for a given group (ametys:acl-group nodes)
     * @param group The group
     * @param rootPath The root path to restrict the search. Can be null.
     * @return The ACL user objects for groups
     */
    public static NodeIterator getACLGroups (GroupIdentity group, String rootPath)
    {
        return getACLGroups(group, rootPath, null);
    }
    
    /**
     * Returns all ACL objects for a given group (ametys:acl-group nodes)
     * @param group The group
     * @param rootPath The root path to restrict the search. Can be null.
     * @param predicat The predicat expression. Can be null.
     * @return The ACL user objects for groups
     */
    public static NodeIterator getACLGroups (GroupIdentity group, String rootPath, Expression predicat)
    {
        StringBuilder sb = new StringBuilder("/jcr:root");
        
        if (rootPath != null)
        {
            sb.append(rootPath);
        }
        
        sb.append("//element(*, ").append(__NODETYPE_ROOT_ACL).append(")")
            .append("/").append(__NODE_NAME_ACL_GROUPS)
            .append("/").append(group.getDirectoryId())
            .append("/").append(ISO9075.encode(Text.escapeIllegalJcrChars(group.getId())));
        
        if (predicat != null)
        {
            sb.append("[").append(predicat.build()).append("]");
        }
        
        return _query(sb.toString());
    }
    
    /**
     * Returns the allowed profiles for the user on any ACL Ametys object (and not denied on the same object)
     * @param user The user
     * @param rootPath The JCR root path where starts the query search (must be something like "//element(myNode, ametys:collection)"), it will be the beginning of the JCR query. Can be null to not restrict the search.
     * @return the allowed profiles for the user on any ACL Ametys object (and not denied on the same object)
     */
    protected static Set<String> _getAllowedProfiles(UserIdentity user, String rootPath)
    {
        Set<String> profiles = new HashSet<>();
        
        NodeIterator users = getACLUsers(user, rootPath);
        
        while (users.hasNext())
        {
            Node userNode = (Node) users.next();
            
            Set<String> allowedProfiles = _getProperty(userNode, __PROPERTY_NAME_ALLOWED_PROFILES);
            Set<String> deniedProfiles = _getProperty(userNode, __PROPERTY_NAME_DENIED_PROFILES);
            allowedProfiles.removeAll(deniedProfiles); // we want to keep only the not allowed profiles
            profiles.addAll(allowedProfiles);
        }
        
        return profiles;
    }
    
    /**
     * Returns the allowed profiles for the group on any ACL Ametys object (and not denied on the same object)
     * @param group The group
     * @param rootPath The JCR root path where starts the query search (must be something like "//element(myNode, ametys:collection)"), it will be the beginning of the JCR query. Can be null to not restrict the search.
     * @return Returns the allowed profiles for the group on any ACL Ametys object (and not denied on the same object)
     */
    protected static Set<String> _getAllowedProfiles(GroupIdentity group, String rootPath)
    {
        Set<String> profiles = new HashSet<>();
        
        NodeIterator groups = getACLGroups(group, rootPath);
        
        while (groups.hasNext())
        {
            Node groupNode = (Node) groups.next();
            
            Set<String> allowedProfiles = _getProperty(groupNode, __PROPERTY_NAME_ALLOWED_PROFILES);
            Set<String> deniedProfiles = _getProperty(groupNode, __PROPERTY_NAME_DENIED_PROFILES);
            allowedProfiles.removeAll(deniedProfiles); // we want to keep only the not allowed profiles
            profiles.addAll(allowedProfiles);
        }
        return profiles;
    }
    
    /**
     * Returns the allowed profiles for any connected user on any ACL Ametys object (and not denied on the same object)
     * @param rootPath The JCR root path where starts the query search (must be something like "//element(myNode, ametys:collection)"), it will be the beginning of the JCR query. Can be null to not restrict the search.
     * @return the allowed profiles for any connected user on any ACL Ametys object (and not denied on the same object)
     */
    protected static Set<String> _getAnyConnectedAllowedProfiles(String rootPath)
    {
        Set<String> profiles = new HashSet<>();
      
        NodeIterator objects = getACLRoots(rootPath);
        while (objects.hasNext())
        {
            Node node = (Node) objects.next();
            
            Set<String> allowedProfiles = _getProperty(node, __PROPERTY_NAME_ALLOWED_ANY_CONNECTED_PROFILES);
            Set<String> deniedProfiles = _getProperty(node, __PROPERTY_NAME_DENIED_ANY_CONNECTED_PROFILES);
            allowedProfiles.removeAll(deniedProfiles); // we want to keep only the not allowed profiles
            profiles.addAll(allowedProfiles);
        }
        
        return profiles;
    }
    
    /**
     * Returns the allowed profiles for anonymous on any ACL Ametys object (and not denied on the same object)
     * @param rootPath The JCR root path where starts the query search (must be something like "//element(myNode, ametys:collection)"), it will be the beginning of the JCR query. Can be null to not restrict the search.
     * @return the allowed profiles for anonymous on any ACL Ametys object (and not denied on the same object)
     */
    protected static Set<String>  _getAnonymousAllowedProfiles(String rootPath)
    {
        Set<String> profiles = new HashSet<>();
     
        NodeIterator objects = getACLRoots(rootPath);
        while (objects.hasNext())
        {
            Node node = (Node) objects.next();
            
            Set<String> allowedProfiles = _getProperty(node, __PROPERTY_NAME_ALLOWED_ANONYMOUS_PROFILES);
            Set<String> deniedProfiles = _getProperty(node, __PROPERTY_NAME_DENIED_ANONYMOUS_PROFILES);
            allowedProfiles.removeAll(deniedProfiles); // we want to keep only the not allowed profiles
            profiles.addAll(allowedProfiles);
        }
        
        return profiles;
    }
    
    
    private static NodeIterator _query (String jcrQuery)
    {
        Session session = null;
        try
        {
            session = _repository.login();
            
            @SuppressWarnings("deprecation")
            Query query = session.getWorkspace().getQueryManager().createQuery(jcrQuery, Query.XPATH);
            return query.execute().getNodes();
        }
        catch (RepositoryException ex)
        {
            if (session != null)
            {
                session.logout();
            }

            throw new AmetysRepositoryException("An error occured executing the JCR query : " + jcrQuery, ex);
        }
    }
    
    /* --------------------------------------- */
    /* ALLOWED PROFILES FOR ANY CONNECTED USER */
    /* --------------------------------------- */
    
    /**
     * Helper for {@link ACLAmetysObject#getAllowedProfilesForAnyConnectedUser()}
     * @param node The JCR node for the Ametys object
     * @return the allowed profiles any connected user has on the given node
     */
    public static Set<String> getAllowedProfilesForAnyConnectedUser(Node node)
    {
        Node aclNode = _getACLNode(node);
        if (aclNode == null)
        {
            return Collections.EMPTY_SET;
        }
        else
        {
            return _getProperty(aclNode, __PROPERTY_NAME_ALLOWED_ANY_CONNECTED_PROFILES);
        }
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#addAllowedProfilesForAnyConnectedUser(Set)}
     * @param node The JCR node for the Ametys object
     * @param profileIds The profiles to add
     */
    public static void addAllowedProfilesForAnyConnectedUser(Node node, Set<String> profileIds)
    {
        Node aclNode = _getOrCreateACLNode(node);
        for (String profile : profileIds)
        {
            _addProperty(aclNode, __PROPERTY_NAME_ALLOWED_ANY_CONNECTED_PROFILES, profile);
        }
        _save(node);
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#removeAllowedProfilesForAnyConnectedUser(Set)}
     * @param node The JCR node for the Ametys object
     * @param profileIds The profiles to remove
     */
    public static void removeAllowedProfilesForAnyConnectedUser(Node node, Set<String> profileIds)
    {
        Node aclNode = _getOrCreateACLNode(node);
        for (String profile : profileIds)
        {
            _removeProperty(aclNode, __PROPERTY_NAME_ALLOWED_ANY_CONNECTED_PROFILES, profile);
        }
        _save(node);
    }

    
    /* -------------------------------------- */
    /* DENIED PROFILES FOR ANY CONNECTED USER */
    /* -------------------------------------- */
    
    /**
     * Helper for {@link ACLAmetysObject#getDeniedProfilesForAnyConnectedUser()}
     * @param node The JCR node for the Ametys object
     * @return the denied profiles any connected user has on the given node
     */
    public static Set<String> getDeniedProfilesForAnyConnectedUser(Node node)
    {
        Node aclNode = _getACLNode(node);
        if (aclNode == null)
        {
            return Collections.EMPTY_SET;
        }
        else
        {
            return _getProperty(aclNode, __PROPERTY_NAME_DENIED_ANY_CONNECTED_PROFILES);
        }
    }
    
    /**
     * Helper for {@link ModifiableACLAmetysObject#addDeniedProfilesForAnyConnectedUser(Set)}
     * @param node The JCR node for the Ametys object
     * @param profileIds The profiles to add
     */
    public static void addDeniedProfilesForAnyConnectedUser(Node node, Set<String> profileIds)
    {
        Node aclNode = _getOrCreateACLNode(node);
        for (String profile : profileIds)
        {
            _addProperty(aclNode, __PROPERTY_NAME_DENIED_ANY_CONNECTED_PROFILES, profile);
        }
        _save(node);
    }
    
    /**
     * Helper for {@link ModifiableACLAmetysObject#removeDeniedProfilesForAnyConnectedUser(Set)}
     * @param node The JCR node for the Ametys object
     * @param profileIds The profiles to remove
     */
    public static void removeDeniedProfilesForAnyConnectedUser(Node node, Set<String> profileIds)
    {
        Node aclNode = _getOrCreateACLNode(node);
        for (String profile : profileIds)
        {
            _removeProperty(aclNode, __PROPERTY_NAME_DENIED_ANY_CONNECTED_PROFILES, profile);
        }
        _save(node);
    }
    
    
    /* ------------------------------ */
    /* ALLOWED PROFILES FOR ANONYMOUS */
    /* ------------------------------ */
    
    /**
     * Helper for {@link ACLAmetysObject#getAllowedProfilesForAnonymous()}
     * @param node The JCR node for the Ametys object
     * @return the allowed profiles an anonymous user has on the given node
     */
    public static Set<String> getAllowedProfilesForAnonymous(Node node)
    {
        Node aclNode = _getACLNode(node);
        if (aclNode == null)
        {
            return Collections.EMPTY_SET;
        }
        else
        {
            return _getProperty(aclNode, __PROPERTY_NAME_ALLOWED_ANONYMOUS_PROFILES);
        }
    }
    
    /**
     * Helper for {@link ModifiableACLAmetysObject#addAllowedProfilesForAnonymous(Set)}
     * @param node The JCR node for the Ametys object
     * @param profileIds The profiles to add
     */
    public static void addAllowedProfilesForAnonymous(Node node, Set<String> profileIds)
    {
        Node aclNode = _getOrCreateACLNode(node);
        for (String profile : profileIds)
        {
            _addProperty(aclNode, __PROPERTY_NAME_ALLOWED_ANONYMOUS_PROFILES, profile);
        }
        _save(node);
    }
    
    /**
     * Helper for {@link ModifiableACLAmetysObject#removeAllowedProfilesForAnonymous(Set)}
     * @param node The JCR node for the Ametys object
     * @param profileIds The profiles to remove
     */
    public static void removeAllowedProfilesForAnonymous(Node node, Set<String> profileIds)
    {
        Node aclNode = _getOrCreateACLNode(node);
        for (String profile : profileIds)
        {
            _removeProperty(aclNode, __PROPERTY_NAME_ALLOWED_ANONYMOUS_PROFILES, profile);
        }
        _save(node);
    }
    
    
    /* ----------------------------- */
    /* DENIED PROFILES FOR ANONYMOUS */
    /* ----------------------------- */
    
    /**
     * Helper for {@link ACLAmetysObject#getDeniedProfilesForAnonymous()}
     * @param node The JCR node for the Ametys object
     * @return the denied profiles an anonymous user has on the given node
     */
    public static Set<String> getDeniedProfilesForAnonymous(Node node)
    {
        Node aclNode = _getACLNode(node);
        if (aclNode == null)
        {
            return Collections.EMPTY_SET;
        }
        else
        {
            return _getProperty(aclNode, __PROPERTY_NAME_DENIED_ANONYMOUS_PROFILES);
        }
    }
    
    /**
     * Helper for {@link ModifiableACLAmetysObject#addDeniedProfilesForAnyConnectedUser(Set)}
     * @param node The JCR node for the Ametys object
     * @param profileIds The profiles to add
     */
    public static void addDeniedProfilesForAnonymous(Node node, Set<String> profileIds)
    {
        Node aclNode = _getOrCreateACLNode(node);
        for (String profile : profileIds)
        {
            _addProperty(aclNode, __PROPERTY_NAME_DENIED_ANONYMOUS_PROFILES, profile);
        }
        _save(node);
    }
    
    /**
     * Helper for {@link ModifiableACLAmetysObject#removeDeniedProfilesForAnyConnectedUser(Set)}
     * @param node The JCR node for the Ametys object
     * @param profileIds The profiles to remove
     */
    public static void removeDeniedProfilesForAnonymous(Node node, Set<String> profileIds)
    {
        Node aclNode = _getOrCreateACLNode(node);
        for (String profile : profileIds)
        {
            _removeProperty(aclNode, __PROPERTY_NAME_DENIED_ANONYMOUS_PROFILES, profile);
        }
        _save(node);
    }
    
    
    /* --------------------------- */
    /* MANAGEMENT OF ALLOWED USERS */
    /* --------------------------- */
    /**
     * Helper for {@link ACLAmetysObject#getAllowedProfilesForUser(UserIdentity)}
     * @param node The JCR node for the Ametys object
     * @param user The user
     * @return The denied profiles
     */
    public static Set<String> getAllowedProfilesForUser (Node node, UserIdentity user)
    {
        Node userNode = _getUserNode(node, user);
        if (userNode == null)
        {
            return new HashSet<>();
        }
        
        return _getProperty(userNode, __PROPERTY_NAME_ALLOWED_PROFILES);
    }
    
    /**
     * Helper for {@link ACLAmetysObject#getAllowedProfilesForUsers()}
     * @param node The JCR node for the Ametys object
     * @return The map of allowed users (keys) with their assigned profiles (values)
     */
    public static Map<UserIdentity, Set<String>> getAllowedProfilesForUsers(Node node)
    {
        Map<UserIdentity, Set<String>> result = new HashMap<>();
        
        try
        {
            Node usersNode = _getUsersNode(node);
            if (usersNode == null)
            {
                return result;
            }
            
            NodeIterator populationsIterator = usersNode.getNodes();
            while (populationsIterator.hasNext())
            {
                Node population = populationsIterator.nextNode();
                NodeIterator usersIterator = population.getNodes();
                while (usersIterator.hasNext())
                {
                    Node user = usersIterator.nextNode();
                    Set<String> allowedProfiles = _getProperty(user, __PROPERTY_NAME_ALLOWED_PROFILES);
                    if (!allowedProfiles.isEmpty())
                    {
                        result.put(new UserIdentity(user.getName(), population.getName()), allowedProfiles);
                    }
                }
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Unable to get allowed users", e);
        }
        return result;
    }

    /**
     * Helper for {@link ACLAmetysObject#getAllowedUsers(String)}
     * @param node The JCR node for the Ametys object
     * @param profileId The id of the profile
     * @return The allowed users with that profile on that ametys object
     */
    public static Set<UserIdentity> getAllowedUsers(Node node, String profileId)
    {
        try
        {
            Set<UserIdentity> allowedUsers = new HashSet<>();
            
            Node usersNode = _getUsersNode(node);
            if (usersNode == null)
            {
                return allowedUsers;
            }
            
            NodeIterator popNodes = usersNode.getNodes();
            
            while (popNodes.hasNext())
            {
                Node popNode = (Node) popNodes.next();
                
                NodeIterator userNodes = popNode.getNodes();
                
                while (userNodes.hasNext())
                {
                    Node userNode = (Node) userNodes.next();
                    Set<String> allowedProfiles = _getProperty(userNode, __PROPERTY_NAME_ALLOWED_PROFILES);
                    if (allowedProfiles.contains(profileId))
                    {
                        allowedUsers.add(new UserIdentity(userNode.getName(), popNode.getName()));
                    }
                }
            }
            
            return allowedUsers;
            
            /*Expression expr = new AllowedProfileExpression(profileId);
            AmetysObjectIterable<JCRAmetysObject> users = getACLUsers(node, expr);
            
            return users.stream()
                    .map(LambdaUtils.wrap(aclUser -> new UserIdentity(aclUser.getName(), aclUser.getNode().getParent().getName())))
                    .collect(Collectors.toSet());*/
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException(e);
        }
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#addAllowedUsers(Set, String)}
     * @param users The users to add
     * @param node The JCR node for the Ametys object
     * @param profileId The id of the profile
     */
    public static void addAllowedUsers(Set<UserIdentity> users, Node node, String profileId)
    {
        for (UserIdentity userIdentity : users)
        {
            Node userNode = _getOrCreateUserNode(node, userIdentity);
            _addProperty(userNode, __PROPERTY_NAME_ALLOWED_PROFILES, profileId);
        }
        _save(node);
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#removeAllowedUsers(Set, String)}
     * @param users The users to remove
     * @param node The JCR node for the Ametys object
     * @param profileId The id of the profile
     */
    public static void removeAllowedUsers(Set<UserIdentity> users, Node node, String profileId)
    {
        for (UserIdentity userIdentity : users)
        {
            Node userNode = _getOrCreateUserNode(node, userIdentity);
            _removeProperty(userNode, __PROPERTY_NAME_ALLOWED_PROFILES, profileId);
        }
        _save(node);
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#removeAllowedGroups(Set)}
     * @param users The users to remove
     * @param node The JCR node for the Ametys object
     */
    public static void removeAllowedUsers(Set<UserIdentity> users, Node node)
    {
        for (UserIdentity userIdentity : users)
        {
            Node userNode = _getOrCreateUserNode(node, userIdentity);
            _setProperty(userNode, __PROPERTY_NAME_ALLOWED_PROFILES, Collections.EMPTY_SET);
        } 
        _save(node);
    }
    
    
    /* ---------------------------- */
    /* MANAGEMENT OF ALLOWED GROUPS */
    /* ---------------------------- */

    /**
     * Helper for {@link ACLAmetysObject#getAllowedProfilesForGroups()} 
     * @param node The JCR node for the Ametys object
     * @return The map of allowed groups (keys) with their assigned profiles (values)
     */
    public static Map<GroupIdentity, Set<String>> getAllowedProfilesForGroups(Node node)
    {
        Map<GroupIdentity, Set<String>> result = new HashMap<>();
        
        try
        {
            Node groupsNode = _getGroupsNode(node);
            if (groupsNode == null)
            {
                return result;
            }
            
            NodeIterator groupDirectoriesIterator = groupsNode.getNodes();
            while (groupDirectoriesIterator.hasNext())
            {
                Node groupDirectory = groupDirectoriesIterator.nextNode();
                NodeIterator groupsIterator = groupDirectory.getNodes();
                while (groupsIterator.hasNext())
                {
                    Node group = groupsIterator.nextNode();
                    Set<String> allowedProfiles = _getProperty(group, __PROPERTY_NAME_ALLOWED_PROFILES);
                    if (!allowedProfiles.isEmpty())
                    {
                        result.put(new GroupIdentity(Text.unescapeIllegalJcrChars(group.getName()), groupDirectory.getName()), allowedProfiles);
                    }
                }
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Unable to get allowed groups", e);
        }
        return result;
    }

    /**
     * Helper for {@link ACLAmetysObject#getAllowedGroups(String)} 
     * @param node The JCR node for the Ametys object
     * @param profileId The id of the profile
     * @return The allowed groups with that profile on that ametys object
     */
    public static Set<GroupIdentity> getAllowedGroups(Node node, String profileId)
    {
        try
        {
            Set<GroupIdentity> deniedGroups = new HashSet<>();
            
            Node groupsNode = _getGroupsNode(node);
            if (groupsNode == null)
            {
                return deniedGroups;
            }
            
            NodeIterator gpDirNodes = groupsNode.getNodes();
            
            while (gpDirNodes.hasNext())
            {
                Node gpDirNode = (Node) gpDirNodes.next();
                
                NodeIterator gpNodes = gpDirNode.getNodes();
                
                while (gpNodes.hasNext())
                {
                    Node gpNode = (Node) gpNodes.next();
                    Set<String> allowedProfiles = _getProperty(gpNode, __PROPERTY_NAME_ALLOWED_PROFILES);
                    if (allowedProfiles.contains(profileId))
                    {
                        deniedGroups.add(new GroupIdentity(gpNode.getName(), gpDirNode.getName()));
                    }
                }
            }
            
            return deniedGroups;
            
            /*Expression expr = new AllowedProfileExpression(profileId);
            AmetysObjectIterable<JCRAmetysObject> groups = getACLGroups(node, expr);
            
            return groups.stream()
                    .map(LambdaUtils.wrap(aclGroup -> new GroupIdentity(aclGroup.getName(), aclGroup.getNode().getParent().getName())))
                    .collect(Collectors.toSet());*/
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException(e);
        }
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#addAllowedGroups(Set, String)}
     * @param groups The groups to add
     * @param node The JCR node for the Ametys object
     * @param profileId The id of the profile
     */
    public static void addAllowedGroups(Set<GroupIdentity> groups, Node node, String profileId)
    {
        for (GroupIdentity groupIdentity : groups)
        {
            Node groupNode = _getOrCreateGroupNode(node, groupIdentity);
            _addProperty(groupNode, __PROPERTY_NAME_ALLOWED_PROFILES, profileId);
        }
        _save(node);
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#removeAllowedGroups(Set, String)}
     * @param groups The groups to remove
     * @param node The JCR node for the Ametys object
     * @param profileId The id of the profile
     */
    public static void removeAllowedGroups(Set<GroupIdentity> groups, Node node, String profileId)
    {
        for (GroupIdentity groupIdentity : groups)
        {
            Node groupNode = _getOrCreateGroupNode(node, groupIdentity);
            _removeProperty(groupNode, __PROPERTY_NAME_ALLOWED_PROFILES, profileId);
        }
        _save(node);
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#removeAllowedGroups(Set)}
     * @param groups The groups to remove
     * @param node The JCR node for the Ametys object
     */
    public static void removeAllowedGroups(Set<GroupIdentity> groups, Node node)
    {
        for (GroupIdentity groupIdentity : groups)
        {
            Node groupNode = _getOrCreateGroupNode(node, groupIdentity);
            _setProperty(groupNode, __PROPERTY_NAME_ALLOWED_PROFILES, Collections.EMPTY_SET);
        } 
        _save(node);
    }

    
    /* ---------------------------- */
    /* MANAGEMENT OF DENIED USERS */
    /* ---------------------------- */
    /**
     * Helper for {@link ACLAmetysObject#getDeniedProfilesForUser(UserIdentity)}
     * @param node The JCR node for the Ametys object
     * @param user The user
     * @return The denied profiles
     */
    public static Set<String> getDeniedProfilesForUser (Node node, UserIdentity user)
    {
        Node userNode = _getUserNode(node, user);
        if (userNode == null)
        {
            return new HashSet<>();
        }
        
        return _getProperty(userNode, __PROPERTY_NAME_DENIED_PROFILES);
    }
    
    /**
     * Helper for {@link ACLAmetysObject#getDeniedProfilesForUsers()}
     * @param node The JCR node for the Ametys object
     * @return The map of denied users (keys) with their assigned profiles (values)
     */
    public static Map<UserIdentity, Set<String>> getDeniedProfilesForUsers(Node node)
    {
        Map<UserIdentity, Set<String>> result = new HashMap<>();
        
        try
        {
            Node usersNode = _getUsersNode(node);
            if (usersNode == null)
            {
                return result;
            }
            
            NodeIterator populationsIterator = usersNode.getNodes();
            while (populationsIterator.hasNext())
            {
                Node population = populationsIterator.nextNode();
                NodeIterator usersIterator = population.getNodes();
                while (usersIterator.hasNext())
                {
                    Node user = usersIterator.nextNode();
                    Set<String> allowedProfiles = _getProperty(user, __PROPERTY_NAME_DENIED_PROFILES);
                    if (!allowedProfiles.isEmpty())
                    {
                        result.put(new UserIdentity(user.getName(), population.getName()), allowedProfiles);
                    }
                }
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Unable to get denied users", e);
        }
        return result;
    }

    /**
     * Helper for {@link ACLAmetysObject#getDeniedUsers(String)}
     * @param node The JCR node for the Ametys object
     * @param profileId The id of the profile
     * @return The denied users with that profile on that ametys object
     */
    public static Set<UserIdentity> getDeniedUsers(Node node, String profileId)
    {
        
        try
        {
            Set<UserIdentity> deniedUsers = new HashSet<>();
            
            Node usersNode = _getUsersNode(node);
            if (usersNode == null)
            {
                return deniedUsers;
            }
            
            NodeIterator popNodes = usersNode.getNodes();
            while (popNodes.hasNext())
            {
                Node popNode = (Node) popNodes.next();
                
                NodeIterator userNodes = popNode.getNodes();
                
                while (userNodes.hasNext())
                {
                    Node userNode = (Node) userNodes.next();
                    Set<String> allowedProfiles = _getProperty(userNode, __PROPERTY_NAME_DENIED_PROFILES);
                    if (allowedProfiles.contains(profileId))
                    {
                        deniedUsers.add(new UserIdentity(userNode.getName(), popNode.getName()));
                    }
                }
            }
            
            return deniedUsers;
            
            /*Expression expr = new DeniedProfileExpression(profileId);
            AmetysObjectIterable<JCRAmetysObject> users = getACLUsers(node, expr);
            
            return users.stream()
                    .map(LambdaUtils.wrap(aclUser -> new UserIdentity(aclUser.getName(), aclUser.getNode().getParent().getName())))
                    .collect(Collectors.toSet());*/
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException(e);
        }
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#addDeniedUsers(Set, String)}
     * @param users The users to add
     * @param node The JCR node for the Ametys object
     * @param profileId The id of the profile
     */
    public static void addDeniedUsers(Set<UserIdentity> users, Node node, String profileId)
    {
        for (UserIdentity userIdentity : users)
        {
            Node userNode = _getOrCreateUserNode(node, userIdentity);
            _addProperty(userNode, __PROPERTY_NAME_DENIED_PROFILES, profileId);
        }
        _save(node);
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#removeDeniedUsers(Set, String)}
     * @param users The users to remove
     * @param node The JCR node for the Ametys object
     * @param profileId The id of the profile
     */
    public static void removeDeniedUsers(Set<UserIdentity> users, Node node, String profileId)
    {
        for (UserIdentity userIdentity : users)
        {
            Node userNode = _getOrCreateUserNode(node, userIdentity);
            _removeProperty(userNode, __PROPERTY_NAME_DENIED_PROFILES, profileId);
        }
        _save(node);
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#removeDeniedUsers(Set)}
     * @param users The users to remove
     * @param node The JCR node for the Ametys object
     */
    public static void removeDeniedUsers(Set<UserIdentity> users, Node node)
    {
        for (UserIdentity userIdentity : users)
        {
            Node userNode = _getOrCreateUserNode(node, userIdentity);
            _setProperty(userNode, __PROPERTY_NAME_DENIED_PROFILES, Collections.EMPTY_SET);
        } 
        _save(node);
    }

    
    /* ----------------------------- */
    /* MANAGEMENT OF DENIED GROUPS */
    /* ----------------------------- */

    /**
     * Helper for {@link ACLAmetysObject#getDeniedProfilesForGroups()}
     * @param node The JCR node for the Ametys object
     * @return The map of denied groups (keys) with their assigned profiles (values)
     */
    public static Map<GroupIdentity, Set<String>> getDeniedProfilesForGroups(Node node)
    {
        Map<GroupIdentity, Set<String>> result = new HashMap<>();
        
        try
        {
            Node groupsNode = _getGroupsNode(node);
            if (groupsNode == null)
            {
                return result;
            }
            
            NodeIterator groupDirectoriesIterator = groupsNode.getNodes();
            while (groupDirectoriesIterator.hasNext())
            {
                Node groupDirectory = groupDirectoriesIterator.nextNode();
                NodeIterator groupsIterator = groupDirectory.getNodes();
                while (groupsIterator.hasNext())
                {
                    Node group = groupsIterator.nextNode();
                    Set<String> allowedProfiles = _getProperty(group, __PROPERTY_NAME_DENIED_PROFILES);
                    if (!allowedProfiles.isEmpty())
                    {
                        result.put(new GroupIdentity(group.getName(), groupDirectory.getName()), allowedProfiles);
                    }
                }
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Unable to get allowed groups", e);
        }
        return result;
    }

    /**
     * Helper for {@link ACLAmetysObject#getDeniedGroups(String)}
     * @param node The JCR node for the Ametys object
     * @param profileId The id of the profile
     * @return The denied groups with that profile on that ametys object
     */
    public static Set<GroupIdentity> getDeniedGroups(Node node, String profileId)
    {
        try
        {
            Set<GroupIdentity> deniedGroups = new HashSet<>();
            
            Node groupsNode = _getGroupsNode(node);
            if (groupsNode == null)
            {
                return deniedGroups;
            }
            
            NodeIterator gpDirNodes = groupsNode.getNodes();
            
            while (gpDirNodes.hasNext())
            {
                Node gpDirNode = (Node) gpDirNodes.next();
                
                NodeIterator gpNodes = gpDirNode.getNodes();
                
                while (gpNodes.hasNext())
                {
                    Node gpNode = (Node) gpNodes.next();
                    Set<String> allowedProfiles = _getProperty(gpNode, __PROPERTY_NAME_DENIED_PROFILES);
                    if (allowedProfiles.contains(profileId))
                    {
                        deniedGroups.add(new GroupIdentity(gpNode.getName(), gpDirNode.getName()));
                    }
                }
            }
            
            return deniedGroups;
            
            /*Expression expr = new DeniedProfileExpression(profileId);
            AmetysObjectIterable<JCRAmetysObject> groups = getACLGroups(node, expr);
            
            return groups.stream()
                    .map(LambdaUtils.wrap(aclGroup -> new GroupIdentity(aclGroup.getName(), aclGroup.getNode().getParent().getName())))
                    .collect(Collectors.toSet());*/
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException(e);
        }
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#addDeniedGroups(Set, String)}
     * @param groups The groups to add
     * @param node The JCR node for the Ametys object
     * @param profileId The id of the profile
     */
    public static void addDeniedGroups(Set<GroupIdentity> groups, Node node, String profileId)
    {
        for (GroupIdentity groupIdentity : groups)
        {
            Node groupNode = _getOrCreateGroupNode(node, groupIdentity);
            _addProperty(groupNode, __PROPERTY_NAME_DENIED_PROFILES, profileId);
        }
        _save(node);
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#removeDeniedGroups(Set, String)}
     * @param groups The groups to remove
     * @param node The JCR node for the Ametys object
     * @param profileId The id of the profile
     */
    public static void removeDeniedGroups(Set<GroupIdentity> groups, Node node, String profileId)
    {
        for (GroupIdentity groupIdentity : groups)
        {
            Node groupNode = _getOrCreateGroupNode(node, groupIdentity);
            _removeProperty(groupNode, __PROPERTY_NAME_DENIED_PROFILES, profileId);
        }
        _save(node);
    }

    /**
     * Helper for {@link ModifiableACLAmetysObject#removeDeniedGroups(Set)}
     * @param groups The groups to remove
     * @param node The JCR node for the Ametys object
     */
    public static void removeDeniedGroups(Set<GroupIdentity> groups, Node node)
    {
        for (GroupIdentity groupIdentity : groups)
        {
            Node groupNode = _getOrCreateGroupNode(node, groupIdentity);
            _setProperty(groupNode, __PROPERTY_NAME_DENIED_PROFILES, Collections.EMPTY_SET);
        } 
        _save(node);
    }
    
    
    /* ------ */
    /* REMOVE */
    /* ------ */
    
    /**
     * Helper for {@link ModifiableACLAmetysObjectProfileAssignmentStorage#removeProfile(String)}
     * @param profileId The id of the profile
     */
    public static void removeProfile(String profileId)
    {
        // Remove this profile set as allowed or denied in users 
        Expression expr = new OrExpression(new AllowedProfileExpression(profileId), new DeniedProfileExpression(profileId));
        NodeIterator users = getACLUsers(expr);
        while (users.hasNext())
        {
            Node userNode = (Node) users.next();
            _removeProperty(userNode, __PROPERTY_NAME_ALLOWED_PROFILES, profileId);
            _removeProperty(userNode, __PROPERTY_NAME_DENIED_PROFILES, profileId);
            _save(userNode);
        }
        
        // Remove this profile set as allowed or denied in groups 
        NodeIterator groups = getACLGroups(expr);
        while (groups.hasNext())
        {
            Node groupNode = (Node) groups.next();
            _removeProperty(groupNode, __PROPERTY_NAME_ALLOWED_PROFILES, profileId);
            _removeProperty(groupNode, __PROPERTY_NAME_DENIED_PROFILES, profileId);
            _save(groupNode);
        }
        
        // Remove this profile set as allowed or denied for anonymous and any connected 
        expr = new OrExpression(new AnonymousAllowedProfileExpression(profileId), new AnonymousDeniedProfileExpression(profileId), new AnyConnectedAllowedProfileExpression(profileId), new AnyConnectedDeniedProfileExpression(profileId));
        NodeIterator nodes = getACLRoots(null, expr);
        while (nodes.hasNext())
        {
            Node node = (Node) nodes.next();
            _removeProperty(node, __PROPERTY_NAME_ALLOWED_ANY_CONNECTED_PROFILES, profileId);
            _removeProperty(node, __PROPERTY_NAME_DENIED_ANY_CONNECTED_PROFILES, profileId);
            _removeProperty(node, __PROPERTY_NAME_ALLOWED_ANONYMOUS_PROFILES, profileId);
            _removeProperty(node, __PROPERTY_NAME_DENIED_ANONYMOUS_PROFILES, profileId);
            _save(node);
        }
    }
    
    /**
     * Helper for {@link ModifiableACLAmetysObjectProfileAssignmentStorage#removeUser(UserIdentity)}
     * @param user The user
     */
    public static void removeUser(UserIdentity user)
    {
        NodeIterator users = getACLUsers(user, null);
        
        while (users.hasNext())
        {
            Node userNode = (Node) users.next();
            try
            {
                userNode.remove();
                _save(userNode);
            }
            catch (RepositoryException e)
            {
                throw new AmetysRepositoryException(e);
            }
        }
    }
    
    /**
     * Helper for {@link ModifiableACLAmetysObjectProfileAssignmentStorage#removeGroup(GroupIdentity)}
     * @param group The group
     */
    public static void removeGroup(GroupIdentity group)
    {
        NodeIterator groups = getACLGroups(group, null);
        while (groups.hasNext())
        {
            Node gpNode = (Node) groups.next();
            try
            {
                gpNode.remove();
                _save(gpNode);
            }
            catch (RepositoryException e)
            {
                throw new AmetysRepositoryException(e);
            }
        }
    }
    
    
    /* --------------- */
    /* PRIVATE METHODS */
    /* --------------- */
    
    private static void _checkLock(Node node) throws AmetysRepositoryException
    {
        try
        {
            if (node.isLocked())
            {
                LockManager lockManager = node.getSession().getWorkspace().getLockManager();
                
                Lock lock = lockManager.getLock(node.getPath());
                Node lockHolder = lock.getNode();
                
                lockManager.addLockToken(lockHolder.getProperty(RepositoryConstants.METADATA_LOCKTOKEN).getString());
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Unable to add lock token on ACL node", e);
        }
    }
    
    private static Node _getOrCreateACLNode(Node node)
    {
        try
        {
            if (node.hasNode(__NODE_NAME_ROOT_ACL))
            {
                return node.getNode(__NODE_NAME_ROOT_ACL);
            }
            else
            {
                _checkLock(node);
                return node.addNode(__NODE_NAME_ROOT_ACL, __NODETYPE_ROOT_ACL);
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Error while getting root ACL node.", e);
        }
    }
    
    private static Node _getACLNode(Node node)
    {
        try
        {
            if (node.hasNode(__NODE_NAME_ROOT_ACL))
            {
                return node.getNode(__NODE_NAME_ROOT_ACL);
            }
            else
            {
                return null;
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Error while getting root ACL node.", e);
        }
    }
    
    private static Node _getOrCreateUsersNode(Node node)
    {
        try
        {
            Node aclNode = _getOrCreateACLNode(node);
            if (aclNode.hasNode(__NODE_NAME_ACL_USERS))
            {
                return aclNode.getNode(__NODE_NAME_ACL_USERS);
            }
            else
            {
                return aclNode.addNode(__NODE_NAME_ACL_USERS, __NODETYPE_UNSTRUCTURED);
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Error while getting 'users' ACL node.", e);
        }
    }
    
    private static Node _getUserNode(Node node, UserIdentity user)
    {
        try
        {
            Node aclNode = _getACLNode(node);
            if (aclNode != null && aclNode.hasNode(__NODE_NAME_ACL_USERS))
            {
                Node aclUsersNode = aclNode.getNode(__NODE_NAME_ACL_USERS);
                if (aclUsersNode.hasNode(user.getPopulationId()))
                {
                    Node popNode = aclUsersNode.getNode(user.getPopulationId());
                    if (popNode.hasNode(user.getLogin()))
                    {
                        return popNode.getNode(user.getLogin());
                    }
                }
            }
            
            return null;
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Error while getting 'users' ACL node.", e);
        }
    }
    
    private static Node _getUsersNode(Node node)
    {
        try
        {
            Node aclNode = _getACLNode(node);
            if (aclNode != null && aclNode.hasNode(__NODE_NAME_ACL_USERS))
            {
                return aclNode.getNode(__NODE_NAME_ACL_USERS);
            }
            else
            {
                return null;
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Error while getting 'users' ACL node.", e);
        }
    }
    
    private static Node _getOrCreateGroupsNode(Node node)
    {
        try
        {
            Node aclNode = _getOrCreateACLNode(node);
            if (aclNode.hasNode(__NODE_NAME_ACL_GROUPS))
            {
                return aclNode.getNode(__NODE_NAME_ACL_GROUPS);
            }
            else
            {
                return aclNode.addNode(__NODE_NAME_ACL_GROUPS, __NODETYPE_UNSTRUCTURED);
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Error while getting 'groups' ACL node.", e);
        }
    }
    
    private static Node _getGroupsNode(Node node)
    {
        try
        {
            Node aclNode = _getACLNode(node);
            if (aclNode != null && aclNode.hasNode(__NODE_NAME_ACL_GROUPS))
            {
                return aclNode.getNode(__NODE_NAME_ACL_GROUPS);
            }
            else
            {
                return null;
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Error while getting 'groups' ACL node.", e);
        }
    }
    
    private static Node _getOrCreateUserNode(Node node, UserIdentity userIdentity)
    {
        try
        {
            Node usersNode = _getOrCreateUsersNode(node);
            String population = userIdentity.getPopulationId();
            String login = userIdentity.getLogin();
            
            if (usersNode.hasNode(population))
            {
                Node populationNode = usersNode.getNode(population);
                if (populationNode.hasNode(login))
                {
                    return populationNode.getNode(login);
                }
                else
                {
                    return populationNode.addNode(login, __NODETYPE_ACL_USER);
                }
            }
            else
            {
                return usersNode.addNode(population, __NODETYPE_UNSTRUCTURED).addNode(login, __NODETYPE_ACL_USER);
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException(String.format("Error while getting 'user' ACL node for %s.", userIdentity.toString()), e);
        }
    }
    
    private static Node _getOrCreateGroupNode(Node node, GroupIdentity groupIdentity)
    {
        try
        {
            Node groupsNode = _getOrCreateGroupsNode(node);
            String directoryId = groupIdentity.getDirectoryId();
            String id = Text.escapeIllegalJcrChars(groupIdentity.getId());
            
            if (groupsNode.hasNode(directoryId))
            {
                Node populationNode = groupsNode.getNode(directoryId);
                if (populationNode.hasNode(id))
                {
                    return populationNode.getNode(id);
                }
                else
                {
                    return populationNode.addNode(id, __NODETYPE_ACL_GROUP);
                }
            }
            else
            {
                return groupsNode.addNode(directoryId, __NODETYPE_UNSTRUCTURED).addNode(Text.escapeIllegalJcrChars(id), __NODETYPE_ACL_GROUP);
            }
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException(String.format("Error while getting 'group' ACL node for %s.", groupIdentity.toString()), e);
        }
    }
    
    private static Set<String> _getProperty(Node node, String propertyName)
    {
        try
        {
            Value[] values = node.getProperty(propertyName).getValues();
            Set<String> result = new HashSet<>();
            for (Value value : values)
            {
                result.add(value.getString());
            }
            return result;
        }
        catch (PathNotFoundException e)
        {
            return new HashSet<>();
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Unable to get " + propertyName + " property", e);
        }
    }
    
    private static void _setProperty(Node node, String propertyName, Set<String> profiles)
    {
        try
        {
            node.setProperty(propertyName, profiles.toArray(new String[profiles.size()]));
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Unable to set " + propertyName + " property", e);
        }
    }
    
    private static void _addProperty(Node node, String propertyName, String profileToAdd)
    {
        Set<String> profiles = _getProperty(node, propertyName);
        if (!profiles.contains(profileToAdd))
        {
            profiles.add(profileToAdd);
            _setProperty(node, propertyName, profiles);
        }
    }
    
    private static void _removeProperty(Node node, String propertyName, String profileToRemove)
    {
        Set<String> profiles = _getProperty(node, propertyName);
        if (profiles.contains(profileToRemove))
        {
            profiles.remove(profileToRemove);
            _setProperty(node, propertyName, profiles);
        }
    }
    
    private static void _save(Node node)
    {
        try
        {
            node.getSession().save();
        }
        catch (RepositoryException e)
        {
            throw new AmetysRepositoryException("Unable to save changes", e);
        }
    }
    
    /* ---------------------------------------*/
    /*      JCR EXPRESSIONS FOR PROFILES      */
    /* ---------------------------------------*/
    
    static class AllowedProfileExpression extends ACLProfileExpression
    {
        public AllowedProfileExpression (String ... profileIds)
        {
            super(__PROPERTY_NAME_ALLOWED_PROFILES, profileIds);
        }
    }
    
    static class DeniedProfileExpression extends ACLProfileExpression
    {
        public DeniedProfileExpression (String ... profileIds)
        {
            super(__PROPERTY_NAME_DENIED_PROFILES, profileIds);
        }
    }
    
    static class AnyConnectedDeniedProfileExpression extends ACLProfileExpression
    {
        public AnyConnectedDeniedProfileExpression (String ... profileIds)
        {
            super(__PROPERTY_NAME_DENIED_ANY_CONNECTED_PROFILES, profileIds);
        }
    }
    
    static class AnyConnectedAllowedProfileExpression extends ACLProfileExpression
    {
        public AnyConnectedAllowedProfileExpression (String ... profileIds)
        {
            super(__PROPERTY_NAME_ALLOWED_ANY_CONNECTED_PROFILES, profileIds);
        }
    }
    
    static class AnonymousDeniedProfileExpression extends ACLProfileExpression
    {
        public AnonymousDeniedProfileExpression (String ... profileIds)
        {
            super(__PROPERTY_NAME_DENIED_ANONYMOUS_PROFILES, profileIds);
        }
    }
    
    static class AnonymousAllowedProfileExpression extends ACLProfileExpression
    {
        public AnonymousAllowedProfileExpression (String ... profileIds)
        {
            super(__PROPERTY_NAME_ALLOWED_ANONYMOUS_PROFILES, profileIds);
        }
    }
    
    static class ACLProfileExpression implements Expression
    {
        private String[] _profileIds;
        private String _propertyName;
        
        public ACLProfileExpression (String propertyName, String ... profileIds)
        {
            _propertyName = propertyName;
            _profileIds = profileIds;
        }
        
        @Override
        public String build()
        {
            boolean isFirst = true;
            StringBuilder sb = new StringBuilder("(");
            
            for (String profileId : _profileIds)
            {
                if (isFirst)
                {
                    isFirst = false;
                }
                else
                {
                    sb.append(" or ");
                }
                
                sb.append("@")
                    .append(_propertyName)
                    .append(Operator.EQ)
                    .append("'").append(profileId).append("'");
            }
            
            if (isFirst)
            {
                return "";
            }
            else
            {
                return sb.append(")").toString();
            }
        }
    }
}