/*
 *  Copyright 2016 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.plugins.workspaces.project.rights;

import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.Set;
import java.util.stream.Collectors;
import java.util.stream.Stream;

import org.apache.avalon.framework.component.Component;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.avalon.framework.service.Serviceable;
import org.apache.commons.lang3.StringUtils;
import org.apache.http.annotation.Obsolete;

import org.ametys.core.right.Profile;
import org.ametys.core.right.ProfileAssignmentStorageExtensionPoint;
import org.ametys.core.right.RightManager;
import org.ametys.core.right.RightManager.RightResult;
import org.ametys.core.right.RightProfilesDAO;
import org.ametys.core.ui.Callable;
import org.ametys.core.user.CurrentUserProvider;
import org.ametys.plugins.explorer.ExplorerNode;
import org.ametys.plugins.explorer.resources.Resource;
import org.ametys.plugins.repository.AmetysObject;
import org.ametys.plugins.repository.AmetysObjectResolver;
import org.ametys.plugins.repository.UnknownAmetysObjectException;
import org.ametys.plugins.workspaces.members.JCRProjectMember;
import org.ametys.plugins.workspaces.members.JCRProjectMember.MemberType;
import org.ametys.plugins.workspaces.project.ProjectManager;
import org.ametys.plugins.workspaces.project.modules.WorkspaceModule;
import org.ametys.plugins.workspaces.project.modules.WorkspaceModuleExtensionPoint;
import org.ametys.plugins.workspaces.project.objects.Project;
import org.ametys.runtime.config.Config;
import org.ametys.runtime.i18n.I18nizableText;
import org.ametys.runtime.plugin.component.AbstractLogEnabled;
import org.ametys.runtime.plugin.component.PluginAware;

/**
 * Helper related to rights management for projects.
 */
public class ProjectRightHelper extends AbstractLogEnabled implements Serviceable, Component, PluginAware
{
    /** Avalon Role */
    public static final String ROLE = ProjectRightHelper.class.getName();
    
    @Obsolete // For v1 project only
    private static final String __PROJECT_RIGHT_PROFILE = "PROJECT";
    
    /** Project Right to add a member to a project */
    private static final String __RIGHT_ADD_MEMBER = "Plugins_Workspaces_Rights_Service_Module_Members_Add";
    
    /** Project Right to remove a member from the project */
    private static final String __RIGHT_REMOVE_MEMBER = "Plugins_Workspaces_Rights_Service_Module_Members_Remove";
    
    /** Right to add a tag */
    private static final String __RIGHT_ADD_TAG = "Plugins_Workspaces_Rights_Project_Add_Tag";
    /** Right to delete a tag */
    private static final String __RIGHT_DELETE_TAG = "Plugins_Workspaces_Rights_Project_Delete_Tag";
    /** Right to add a place */
    private static final String __RIGHT_ADD_PLACE = "Plugins_Workspaces_Rights_Project_Add_Place";
    /** Right to delete a place */
    private static final String __RIGHT_DELETE_PLACE = "Plugins_Workspaces_Rights_Project_Delete_Place";
    
    /** Ametys object resolver */
    protected AmetysObjectResolver _resolver;
    
    /** Project manager */
    protected ProjectManager _projectManager;
    
    /** Right manager */
    protected RightManager _rightManager;
    
    /** Right profiles manager */
    protected RightProfilesDAO _rightProfilesDao;
    
    /** Current user provider */
    protected CurrentUserProvider _currentUserProvider;
    
    /** Module managers EP */
    protected WorkspaceModuleExtensionPoint _moduleManagerEP;

    /** The profile storage */
    private ProfileAssignmentStorageExtensionPoint _profileAssignmentStorageEP;

    private String _pluginName;

    
    @Override
    public void service(ServiceManager manager) throws ServiceException
    {
        _resolver = (AmetysObjectResolver) manager.lookup(AmetysObjectResolver.ROLE);
        _projectManager = (ProjectManager) manager.lookup(ProjectManager.ROLE);
        _rightManager = (RightManager) manager.lookup(RightManager.ROLE);
        _rightProfilesDao = (RightProfilesDAO) manager.lookup(RightProfilesDAO.ROLE);
        _currentUserProvider = (CurrentUserProvider) manager.lookup(CurrentUserProvider.ROLE);
        _moduleManagerEP = (WorkspaceModuleExtensionPoint) manager.lookup(WorkspaceModuleExtensionPoint.ROLE);
        _profileAssignmentStorageEP = (ProfileAssignmentStorageExtensionPoint) manager.lookup(ProfileAssignmentStorageExtensionPoint.ROLE);
    }
    
    public void setPluginInfo(String pluginName, String featureName, String id)
    {
        _pluginName = pluginName;
    }
    /**
     * Retrieves all project profile given the "profile list" configuration parameter
     * Profile order is guaranteed to be the same as in the configuration parameter.
     * @return the projects
     */
    public List<Profile> getProfileList()
    {
        Map<String, Profile> profileMap = _rightProfilesDao.getProfiles().stream().collect(Collectors.toMap(Profile::getId, item -> item));
        String rawProjectProfileIds = StringUtils.defaultString(Config.getInstance().getValue("workspaces.profile.list"));
        
        // Collect project profiles (unexisting entries are filtered out).
        return Arrays.stream(StringUtils.split(rawProjectProfileIds, ','))
            .map(id -> 
            {
                Profile p = profileMap.get(id);
                
                // log null entries
                if (p == null)
                {
                    getLogger().warn("Could not find profile with id '{}'.", id);
                }
                return p;
            })
            .filter(Objects::nonNull)
            .collect(Collectors.toList());
    }
    
    /**
     * Get the first allowed profile on project for a given member
     * @param project the project
     * @param member the member
     * @return the first allowed profile or null if not found
     */
    @Obsolete // For v1 project only
    public String getAllowedProfileOnProject(Project project, JCRProjectMember member)
    {
        List<String> profileIds = getProfileList()
                .stream()
                .map(p -> p.getId())
                .collect(Collectors.toList());
        
        Set<String> allowedProfilesOnProject = MemberType.GROUP.toString().equals(member.getType()) 
                ? _profileAssignmentStorageEP.getAllowedProfilesForGroup(project, member.getGroup()) 
                : _profileAssignmentStorageEP.getAllowedProfilesForUser(project, member.getUser());
        
        for (String allowedProfile : allowedProfilesOnProject)
        {
            if (profileIds.contains(allowedProfile))
            {
                // Get the first allowed profile among the project's members profiles
                return allowedProfile;
            }
        }
        
        return null;
    }
    
    /**
     * Get the first allowed profile on project's module for a given member
     * @param project the project
     * @param module The workspace module
     * @param member the member
     * @return the first allowed profile or null if not found
     */
    public String getAllowedProfileOnModule (Project project, WorkspaceModule module, JCRProjectMember member)
    {
        List<String> profileIds = getProfileList()
                .stream()
                .map(p -> p.getId())
                .collect(Collectors.toList());
        
        AmetysObject moduleObject = module.getModuleRoot(project, false);
        Set<String> allowedProfilesForUser = MemberType.GROUP.toString().equals(member.getType())
                ? _profileAssignmentStorageEP.getAllowedProfilesForGroup(moduleObject, member.getGroup())
                : _profileAssignmentStorageEP.getAllowedProfilesForUser(moduleObject, member.getUser());
        
        for (String allowedProfile : allowedProfilesForUser)
        {
            if (profileIds.contains(allowedProfile))
            {
                // Get the first allowed profile among the project's members profiles
                return allowedProfile;
            }
        }
        
        return null;
    }
    
    /**
     * Get the list of profiles and the list of modules available for rights affectation in the project.
     * @param projectName The project to check if the modules are activated. Can be null to ignore
     * @return the project rights data
     */
    @Callable
    public Map<String, Object> getProjectRightsData(String projectName)
    {
        return getProjectRightsData(projectName, false);
    }
    
    /**
     * Get the list of profiles and the list of modules available for rights affectation in the project.
     * @param projectName The project to check if the modules are activated. Can be null to ignore
     * @param includeAllModules True to include modules not manager by the WorkspaceModuleManagerExtensionPoint
     * @return the project rights data
     */
    @Callable
    @Obsolete // For v1 projects only
    public Map<String, Object> getProjectRightsData(String projectName, boolean includeAllModules)
    {
        // profiles
        List<Object> profiles = getProfileList()
            .stream()
            .map(this::_getProfileRightData)
            .collect(Collectors.toList());
        
        
        Project project = projectName != null ? _projectManager.getProject(projectName) : null;
        
        // modules
        Stream<Map<String, Object>> stream = _moduleManagerEP.getExtensionsIds().stream().map(moduleId -> _moduleManagerEP.getExtension(moduleId)).map(module -> _getModuleRightData(project, module));
        if (includeAllModules)
        {
            stream = Stream.concat(Stream.of(_getProjectRightData()), stream);
        }
        List<Object> modules = stream.filter(Objects::nonNull).collect(Collectors.toList());
        
        Map<String, Object> result = new HashMap<>();
        result.put("profiles", profiles);
        result.put("modules", modules);
        
        return result;
    }
    
    private Map<String, Object> _getProfileRightData(Profile profile)
    {
        Map<String, Object> data = new HashMap<>();
        data.put("id", profile.getId());
        data.put("label", profile.getLabel());
        return data;
    }
    
    private Map<String, Object> _getModuleRightData(Project project, WorkspaceModule module)
    {
        if (project != null && !_projectManager.isModuleActivated(project, module.getId()))
        {
            return null;
        }
        
        Map<String, Object> data = new HashMap<>();
        data.put("id", module.getId());
        data.put("label", module.getModuleTitle());
        return data;
    }    
    
    // For v1 projects only
    @Obsolete 
    private Map<String, Object> _getProjectRightData()
    {
        Map<String, Object> data = new HashMap<>();
        data.put("id", __PROJECT_RIGHT_PROFILE);
        data.put("label", new I18nizableText("plugin." + _pluginName, "PLUGINS_WORKSPACES_PROJECT_SERVICE_PROFILE_TO_PROJECT_LABEL"));
        return data;
    }
    
    /**
     * Determines if the current user can view the members of a project
     * @param project the project
     * @return true if user can view members
     */
    public boolean canViewMembers(Project project)
    {
        return _rightManager.currentUserHasReadAccess(project);
    }
    
    /**
     * Determines if the current user has right to add member on project
     * @param project the project
     * @return true if user can add member
     */
    public boolean canAddMember(Project project)
    {
        return hasRight(__RIGHT_ADD_MEMBER, project);
    }
    
    /**
     * Determines if the current user has right to edit member on project
     * @param project the project
     * @return true if user can edit member
     */
    public boolean canEditMember(Project project)
    {
        return canAddMember(project);
    }
    
    /**
     * Determines if the current user has right to add member on project
     * @param project the project
     * @return true if user can remove member
     */
    public boolean canRemoveMember(Project project)
    {
        return _hasRightOnMembers(project, __RIGHT_REMOVE_MEMBER);
    }
    
    private boolean _hasRightOnMembers(Project project, String rightId)
    {
        return hasRight(rightId, project);
    }
    
    /**
     * Determines if the current user has right to add tags on project
     * @param project the project
     * @return true if user can add tags
     */
    public boolean canAddTag(Project project)
    {
        return _hasRightOnTagsOrPlaces(project, __RIGHT_ADD_TAG);
    }
    
    /**
     * Determines if the current user has right to remove tags on project
     * @param project the project
     * @return true if user can remove tags
     */
    public boolean canRemoveTag(Project project)
    {
        return _hasRightOnTagsOrPlaces(project, __RIGHT_DELETE_TAG);
    }
    
    /**
     * Determines if the current user has right to add places on project
     * @param project the project
     * @return true if user can add places
     */
    public boolean canAddPlace(Project project)
    {
        return _hasRightOnTagsOrPlaces(project, __RIGHT_ADD_PLACE);
    }
    
    /**
     * Determines if the current user has right to remove places on project
     * @param project the project
     * @return true if user can remove places
     */
    public boolean canRemovePlace(Project project)
    {
        return _hasRightOnTagsOrPlaces(project, __RIGHT_DELETE_PLACE);
    }
    
    private boolean _hasRightOnTagsOrPlaces(Project project, String rightId)
    {
        return hasRight(rightId, project);
    }
    
    /**
     * Test if the current user has the right on the project
     * @param rightId The right id
     * @param projectId The project id
     * @return true if has right
     */
    @Callable
    public boolean hasRightOnProject(String rightId, String projectId)
    {
        try
        {
            return hasRight(rightId, _resolver.<Project>resolveById(projectId));
        }
        catch (UnknownAmetysObjectException e)
        {
            getLogger().warn("Trying to test right on an unknown project. Requested id : {}", projectId, e);
            return false;
        }
    }
    
    /**
     * Test if the current user has the right on the project
     * @param rightId The right id
     * @param project The project
     * @return true if has right
     */
    public boolean hasRight(String rightId, Project project)
    {
        return _rightManager.hasRight(_currentUserProvider.getUser(), rightId, project) == RightResult.RIGHT_ALLOW;
    }
    
    /**
     * Test if the current user has a read access on the project
     * @param projectId The project id
     * @return true if has read access
     */
    @Callable
    public boolean hasReadAccessOnProject(String projectId)
    {
        try
        {
            return hasReadAccess(_resolver.<Project>resolveById(projectId));
        }
        catch (UnknownAmetysObjectException e)
        {
            getLogger().warn("Trying to test read access on an unknown project. Requested id : {}", projectId, e);
            return false;
        }
    }
    
    /**
     * Test if the current user has a read access on the project
     * @param project The project
     * @return true if has read access
     */
    public boolean hasReadAccess(Project project)
    {
        return _rightManager.hasReadAccess(_currentUserProvider.getUser(), project);
    }
    
    /**
     * Test if the current user has the right on an explorer node
     * @param rightId The right id
     * @param explorerNodeId The explorer node id
     * @return true if has right
     */
    @Callable
    public boolean hasRightOnExplorerNode(String rightId, String explorerNodeId)
    {
        try
        {
            return hasRight(rightId, _resolver.<ExplorerNode>resolveById(explorerNodeId));
        }
        catch (UnknownAmetysObjectException e)
        {
            getLogger().warn("Trying to test right on an unknown explorer node. Requested id : {}", explorerNodeId, e);
            return false;
        }
    }
    
    /**
     * Test if the current user has the right on an explorer node
     * @param rightId The right id
     * @param explorerNode The explorer node
     * @return true if has right
     */
    public boolean hasRight(String rightId, ExplorerNode explorerNode)
    {
        return _rightManager.hasRight(_currentUserProvider.getUser(), rightId, explorerNode) == RightResult.RIGHT_ALLOW;
    }
    
    /**
     * Test if the current user has a read access on an explorer node
     * @param explorerNodeId The explorer node id
     * @return true if has read access
     */
    @Callable
    public boolean hasReadAccessOnExplorerNode(String explorerNodeId)
    {
        try
        {
            return hasReadAccess(_resolver.<ExplorerNode>resolveById(explorerNodeId));
        }
        catch (UnknownAmetysObjectException e)
        {
            getLogger().warn("Trying to test read access on an unknown explorer node. Requested id : {}", explorerNodeId, e);
            return false;
        }
    }
    
    /**
     * Test if the current user has a read access on an explorer node
     * @param explorerNode The explorer node
     * @return true if has read access
     */
    public boolean hasReadAccess(ExplorerNode explorerNode)
    {
        return _rightManager.currentUserHasReadAccess(explorerNode);
    }
    
    /**
     * Test if the current user has a read access on a resource
     * @param resource The resource
     * @return true if has read access
     */
    public boolean hasReadAccess(Resource resource)
    {
        return _rightManager.currentUserHasReadAccess(resource);
    }
}