/*
 *  Copyright 2016 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.core.right;

import java.io.InputStream;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Optional;
import java.util.Set;
import java.util.stream.Collectors;

import org.apache.avalon.framework.activity.Initializable;
import org.apache.avalon.framework.component.Component;
import org.apache.avalon.framework.configuration.Configurable;
import org.apache.avalon.framework.configuration.Configuration;
import org.apache.avalon.framework.configuration.ConfigurationException;
import org.apache.avalon.framework.configuration.DefaultConfigurationBuilder;
import org.apache.avalon.framework.context.Context;
import org.apache.avalon.framework.context.ContextException;
import org.apache.avalon.framework.context.Contextualizable;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.avalon.framework.service.Serviceable;
import org.apache.avalon.framework.thread.ThreadSafe;
import org.apache.cocoon.components.ContextHelper;
import org.apache.cocoon.environment.Request;
import org.apache.commons.lang3.StringUtils;
import org.apache.excalibur.source.Source;
import org.apache.excalibur.source.SourceResolver;

import org.ametys.core.cache.AbstractCacheManager;
import org.ametys.core.cache.Cache;
import org.ametys.core.group.GroupDirectoryDAO;
import org.ametys.core.group.GroupIdentity;
import org.ametys.core.group.GroupManager;
import org.ametys.core.right.AccessController.AccessResult;
import org.ametys.core.right.AccessController.Permission;
import org.ametys.core.right.AccessController.ExplanationObject;
import org.ametys.core.user.CurrentUserProvider;
import org.ametys.core.user.UserIdentity;
import org.ametys.core.user.UserManager;
import org.ametys.core.user.population.PopulationContextHelper;
import org.ametys.core.user.population.UserPopulationDAO;
import org.ametys.plugins.core.impl.cache.AbstractCacheKey;
import org.ametys.runtime.i18n.I18nizableText;
import org.ametys.runtime.plugin.component.AbstractLogEnabled;

/**
 * Abstraction for testing a right associated with a resource and a user from a single source.
 */
public class RightManager extends AbstractLogEnabled implements Serviceable, Configurable, ThreadSafe, Component, Contextualizable, Initializable
{
    /** For avalon service manager */
    public static final String ROLE = RightManager.class.getName();
    /** The id of the READER profile */
    public static final String READER_PROFILE_ID = "READER";
    
    /** The instance of ObjectUserIdentity for anonymous */
    protected static final UserIdentity __ANONYMOUS_USER_IDENTITY = new UserIdentity(null, null);
    /** The instance of ObjectUserIdentity for any connected user */
    protected static final UserIdentity __ANY_CONNECTED_USER_IDENTITY = new UserIdentity("", "");

    private static final String CACHE_1 = RightManager.class.getName() + "$Cache-1";
    private static final String CACHE_2 = RightManager.class.getName() + "$Cache-2";
    
    /** Avalon ServiceManager */
    protected ServiceManager _manager;
    /** Avalon SourceResolver */
    protected SourceResolver _resolver;
    /** The rights' list container */
    protected RightsExtensionPoint _rightsEP;
    /** The extension point for the Right Context Convertors */
    protected RightContextConvertorExtensionPoint _rightContextConvertorEP;
    /** The extension point for Access Controllers */
    protected AccessControllerExtensionPoint _accessControllerEP;
    /** The user manager */
    protected UserManager _userManager;
    /** The group manager */
    protected GroupManager _groupManager;
    /** The DAO for user populations */
    protected UserPopulationDAO _userPopulationDAO;
    /** The DAO for group directories */
    protected GroupDirectoryDAO _groupDirectoryDAO;
    /** The current user provider */
    protected CurrentUserProvider _currentUserProvider;
    /** The rights DAO */
    protected RightProfilesDAO _profilesDAO;
    /** Cache Manager */
    protected AbstractCacheManager _cacheManager;
    
    private Context _context;
    private List<String> _webinfRights = new ArrayList<>();
    
    /**
     * Enumeration of all possible values returned by hasRight(user, right, context)
     */
    public enum RightResult
    {
        /**
         * Indicates that a given user has the required right.
         */
        RIGHT_ALLOW,
        
        /**
         * Indicates that a given user does NOT have the required right.
         */
        RIGHT_DENY,
        
        /**
         * Indicates that the system knows nothing about the fact that a given user has a right or not.
         */
        RIGHT_UNKNOWN;
    }
    
    @Override
    public void contextualize(Context context) throws ContextException
    {
        _context = context;
    }
    
    @Override
    public void service(ServiceManager manager) throws ServiceException
    {
        _manager = manager;
        _userManager = (UserManager) manager.lookup(UserManager.ROLE);
        _groupManager = (GroupManager) manager.lookup(GroupManager.ROLE);
        _userPopulationDAO = (UserPopulationDAO) manager.lookup(UserPopulationDAO.ROLE);
        _groupDirectoryDAO = (GroupDirectoryDAO) manager.lookup(GroupDirectoryDAO.ROLE);
        _rightsEP = (RightsExtensionPoint) manager.lookup(RightsExtensionPoint.ROLE);
        _rightContextConvertorEP = (RightContextConvertorExtensionPoint) manager.lookup(RightContextConvertorExtensionPoint.ROLE);
        _accessControllerEP = (AccessControllerExtensionPoint) manager.lookup(AccessControllerExtensionPoint.ROLE);
        _resolver = (SourceResolver) _manager.lookup(SourceResolver.ROLE);
        _currentUserProvider = (CurrentUserProvider) _manager.lookup(CurrentUserProvider.ROLE);
        _cacheManager = (AbstractCacheManager) manager.lookup(AbstractCacheManager.ROLE);
    }

    public void initialize() throws Exception
    {
        _cacheManager.createRequestCache(CACHE_1,
                new I18nizableText("plugin.core", "PLUGINS_CORE_RIGHT_MANAGER_CACHE_1_LABEL"),
                new I18nizableText("plugin.core", "PLUGINS_CORE_RIGHT_MANAGER_CACHE_1_DESCRIPTION"),
                true);
        _cacheManager.createRequestCache(CACHE_2,
                new I18nizableText("plugin.core", "PLUGINS_CORE_RIGHT_MANAGER_CACHE_2_LABEL"),
                new I18nizableText("plugin.core", "PLUGINS_CORE_RIGHT_MANAGER_CACHE_2_DESCRIPTION"),
                true);
    }
    
    /**
     * Returns the DAO for profiles
     * @return The DAO
     */
    protected RightProfilesDAO _getProfileDAO ()
    {
        try
        {
            if (_profilesDAO == null)
            {
                _profilesDAO = (RightProfilesDAO) _manager.lookup(RightProfilesDAO.ROLE);
            }
            return _profilesDAO;
        }
        catch (ServiceException e)
        {
            throw new RuntimeException("Failed to retrieve the DAO for profiles", e);
        }
    }
    
    @Override
    public void configure(Configuration configuration) throws ConfigurationException
    {
        Configuration rightsConfiguration = configuration.getChild("rights");

        String externalFile = rightsConfiguration.getAttribute("config", null);
        if (externalFile != null)
        {
            Source source = null;
            try
            {
                source = _resolver.resolveURI("context://" + externalFile);

                if (source.exists())
                {
                    Configuration externalConfiguration;
                    try (InputStream is = source.getInputStream();)
                    {
                        externalConfiguration = new DefaultConfigurationBuilder().build(is);
                    }

                    configureRights(externalConfiguration);
                }
                else if (getLogger().isInfoEnabled())
                {
                    getLogger().info("The optional external rights file '" + externalFile + "' is missing.");
                }
            }
            catch (Exception e)
            {
                String message = "An error occured while retriving external file '" + externalFile + "'";
                getLogger().error(message, e);
                throw new ConfigurationException(message, configuration, e);
            }
            finally
            {
                if (source != null)
                {
                    _resolver.release(source);
                }
            }
        }
        else
        {
            configureRights(rightsConfiguration);
        }
    }
    
    private void configureRights(Configuration configuration) throws ConfigurationException
    {
        Configuration[] rights = configuration.getChildren("right");
        for (Configuration rightConf : rights)
        {
            String id = rightConf.getAttribute("id", "");

            Configuration labelConf = rightConf.getChild("label");
            String label = labelConf.getValue("");
            I18nizableText i18nLabel = _getI18nTextFromConf(labelConf, label);

            Configuration descConf = rightConf.getChild("description");
            String description = descConf.getValue("");
            I18nizableText i18nDescription = _getI18nTextFromConf(descConf, description);

            String category = rightConf.getChild("category").getValue("");
            I18nizableText i18nCategory = new I18nizableText("application", category);

            if (id.length() == 0 || label.length() == 0 || description.length() == 0 || category.length() == 0)
            {
                String message = "Error in " + RightManager.class.getName() + " configuration: attribute 'id' and elements 'label', 'description' and 'category' are mandatory.";
                getLogger().error(message);
                throw new ConfigurationException(message, configuration);
            }
            _rightsEP.addRight(id, i18nLabel, i18nDescription, i18nCategory);
            _webinfRights.add(id);
        }
    }
    
    /**
     * Getter for external rights ids
     * @return a list of all the rights' ids from rights.xml file
     */
    public List<String> getExternalRightIds()
    {
        return _webinfRights;
    }
    
    private I18nizableText _getI18nTextFromConf(Configuration config, String label)
    {
        return I18nizableText.isI18n(config)
                ? new I18nizableText("application", label)
                : new I18nizableText(label);
    }
    
    /**
     * Add a right to the right EP
     * @param id the id for the new right
     * @param label the label for the new right
     * @param description the description for the new right
     * @param category the category for the new right
     */
    public void  addExternalRight(String id, String label, String description, String category)
    {
        _rightsEP.addRight(id, new I18nizableText(label), new I18nizableText(description), new I18nizableText("application", category));
        _webinfRights.add(id);
    }
    
    /**
     * Remove the right from the rightEP
     * @param id the right to delete's id
     */
    public void removeExternalRight(String id)
    {
        _rightsEP.removeRight(id);
        _webinfRights.remove(id);
    }
    
    /* --------- */
    /* HAS RIGHT */
    /* --------- */
    
    /**
     * Checks a permission for the current logged user, on a given object (or context).<br>
     * If null, it checks if there is at least one object with this permission
     * @param rightId The name of the right to check. Cannot be null.
     * @param object The object to check the right. Can be null to search on any object.
     * @return {@link RightResult#RIGHT_ALLOW}, {@link RightResult#RIGHT_DENY} or {@link RightResult#RIGHT_UNKNOWN}
     * @throws RightsException if an error occurs.
     */
    public RightResult currentUserHasRight(String rightId, Object object) throws RightsException
    {
        return hasRight(_currentUserProvider.getUser(), rightId, object);
    }
    
    /**
     * Checks a permission for a user, on a given object (or context).<br>
     * If null, it checks if there is at least one object with this permission
     * @param userIdentity The user identity. Can be null for anonymous
     * @param rightId The name of the right to check. Cannot be null.
     * @param object The object to check the right. Can be null to search on any object.
     * @return {@link RightResult#RIGHT_ALLOW}, {@link RightResult#RIGHT_DENY} or {@link RightResult#RIGHT_UNKNOWN}
     * @throws RightsException if an error occurs.
     */
    public RightResult hasRight(UserIdentity userIdentity, String rightId, Object object) throws RightsException
    {
        UserIdentity objectUserIdentity = userIdentity == null ? __ANONYMOUS_USER_IDENTITY : userIdentity;
        
        return _hasRight(objectUserIdentity, rightId, object);
    }
    
    /**
     * Gets the right result for anonymous with given right on given object context
     * @param rightId The id of the right
     * @param object The object to check
     * @return the right result for anonymous with given profile on given object context
     */
    public RightResult hasAnonymousRight(String rightId, Object object)
    {
        return _hasRight(__ANONYMOUS_USER_IDENTITY, rightId, object);
    }

    /**
     * Gets the right result for any connected user with given profile on given object context
     * @param rightId The right id to test
     * @param object The object to check
     * @return the right result for any connected user with given profile on given object context
     */
    public RightResult hasAnyConnectedUserRight(String rightId, Object object)
    {
        return _hasRight(__ANY_CONNECTED_USER_IDENTITY, rightId, object);
    }

    private RightResult _hasRight(UserIdentity userIdentity, String rightId, Object object)
    {
        getLogger().debug("Try to determine if user {} has the right '{}' on the object context {}", userIdentity, rightId, object);

        if (StringUtils.isBlank(rightId))
        {
            throw new RightsException("The rightId cannot be null");
        }

        return _hasRightOrRead(userIdentity, rightId, object);
    }
    
    private RightResult _hasRightOrRead(UserIdentity userIdentity, String rightId, Object object)
    {
        if (object == null)
        {
            return _hasRightOrRead(userIdentity, rightId);
        }
        
        // Try to retrieve in first cache (the one which manages non-null contexts)
        RightResult cacheResult = _hasRightResultInFirstCache(userIdentity, rightId, object);
        if (cacheResult != null)
        {
            return cacheResult;
        }
        
        // Retrieve groups the user belongs to
        Set<GroupIdentity> groups = _getGroups(userIdentity);
        
        // Get the objects to check
        Set<Object> objects = _getConvertedObjects(object, new HashSet<>());
        
        // Retrieve the set of AccessResult
        Set<AccessResult> accessResults = _getAccessResults(userIdentity, groups, rightId, objects);
        
        // Compute access
        AccessResult access = AccessResult.merge(accessResults);
        
        RightResult rightResult = access.toRightResult();
        _putInFirstCache(userIdentity, rightId, object, rightResult);
        
        return rightResult;
    }
    
    /**
     * Has the user/anonymous/anyconnected the non null right on any content of the current workspace?
     * @param userIdentity The user connecter or the value for anonymous or any connected user
     * @param rightId The right id to test. Can be null to test read access
     * @return The computed right result
     */
    private RightResult _hasRightOrRead(UserIdentity userIdentity, String rightId)
    {
        // Resolve contexts
        Set<Object> workspacesContexts = _getConvertedObjects("/${WorkspaceName}", new HashSet<>());
        
        // Try to retrieve in second cache (the one which manages null context)
        RightResult cacheResult = _hasRightResultInSecondCache(workspacesContexts, userIdentity, rightId);
        if (cacheResult != null)
        {
            return cacheResult;
        }
        
        // Retrieve groups the user belongs to
        Set<GroupIdentity> groups = _getGroups(userIdentity);

        RightResult rightResult = RightResult.RIGHT_UNKNOWN;
        for (String controllerId : _accessControllerEP.getExtensionsIds())
        {
            AccessController accessController = _accessControllerEP.getExtension(controllerId);
            try
            {
                if (userIdentity == __ANONYMOUS_USER_IDENTITY)
                {
                    if (rightId == null ? accessController.hasAnonymousAnyReadAccessPermissionOnWorkspace(workspacesContexts) : accessController.hasAnonymousAnyPermissionOnWorkspace(workspacesContexts, rightId))
                    {
                        rightResult = RightResult.RIGHT_ALLOW;
                        break;
                    }
                }
                else if (userIdentity == __ANY_CONNECTED_USER_IDENTITY)
                {
                    if (rightId == null ? accessController.hasAnyConnectedUserAnyReadAccessPermissionOnWorkspace(workspacesContexts) : accessController.hasAnyConnectedUserAnyPermissionOnWorkspace(workspacesContexts, rightId))
                    {
                        rightResult = RightResult.RIGHT_ALLOW;
                        break;
                    }
                }
                else
                {
                    if (rightId == null ? accessController.hasUserAnyReadAccessPermissionOnWorkspace(workspacesContexts, userIdentity, groups) : accessController.hasUserAnyPermissionOnWorkspace(workspacesContexts, userIdentity, groups, rightId))
                    {
                        rightResult = RightResult.RIGHT_ALLOW;
                        break;
                    }
                }
            }
            catch (Exception e)
            {
                getLogger().error("An error occured with controller '{}'. Thus, this controller will be ignored.", controllerId, e);
            }
        }
        
        getLogger().debug("Right result found for [{}, {}, {}] => {}", workspacesContexts, userIdentity, rightId, rightResult);
        _putInSecondCache(workspacesContexts, userIdentity, rightId, rightResult);
        return rightResult;
    }
    
    private Set<AccessResult> _getAccessResults(UserIdentity userIdentity, Set<GroupIdentity> groups, String rightId, Set<Object> objects)
    {
        Set<AccessResult> accessResults = new HashSet<>();
        for (Object obj : objects)
        {
            for (String controllerId : _accessControllerEP.getExtensionsIds())
            {
                AccessController accessController = _accessControllerEP.getExtension(controllerId);
                try
                {
                    if (accessController.isSupported(obj))
                    {
                        if (userIdentity == __ANONYMOUS_USER_IDENTITY)
                        {
                            accessResults.add(rightId == null ? accessController.getReadAccessPermissionForAnonymous(obj) : accessController.getPermissionForAnonymous(rightId, obj));
                        }
                        else if (userIdentity == __ANY_CONNECTED_USER_IDENTITY)
                        {
                            accessResults.add(rightId == null ? accessController.getReadAccessPermissionForAnyConnectedUser(obj) : accessController.getPermissionForAnyConnectedUser(rightId, obj));
                        }
                        else
                        {
                            accessResults.add(rightId == null ? accessController.getReadAccessPermission(userIdentity, groups, obj) : accessController.getPermission(userIdentity, groups, rightId, obj));
                        }
                    }
                    else
                    {
                        accessResults.add(AccessResult.UNKNOWN);
                    }
                }
                catch (Exception e)
                {
                    getLogger().error("An error occured with controller '{}' for object {}. Thus, this controller will be ignored.", controllerId, obj, e);
                }
            }
        }
        
        return accessResults;
    }
    
    /* --------------- */
    /* HAS READ ACCESS */
    /* --------------- */
    
    /**
     * Returns true if the current user has READ access on the given object
     * @param object The object to check the right. Can be null to search on any object.
     * @return true if the given user has READ access on the given object
     */
    public boolean currentUserHasReadAccess(Object object)
    {
        return hasReadAccess(_currentUserProvider.getUser(), object);
    }

    /**
     * Returns true if the given user has READ access on the given object
     * @param userIdentity The user identity. Cannot be null.
     * @param object The object to check the right. Can be null to search on any object.
     * @return true if the given user has READ access on the given object
     */
    public boolean hasReadAccess(UserIdentity userIdentity, Object object)
    {
        UserIdentity objectUserIdentity = userIdentity == null ? __ANONYMOUS_USER_IDENTITY : userIdentity;

        return _hasRightOrRead(objectUserIdentity, null, object) == RightResult.RIGHT_ALLOW;
    }
    
    /**
     * Returns true if the object is not restricted, i.e. an anonymous user has READ access (is allowed) on the object
     * @param object The object to check. Cannot be null
     * @return true if the object is restricted, i.e. an anonymous user has READ access (is allowed) on the object
     */
    public boolean hasAnonymousReadAccess(Object object)
    {
        return _hasRightOrRead(__ANONYMOUS_USER_IDENTITY, null, object) == RightResult.RIGHT_ALLOW;
    }
    
    /**
     * Returns true if any connected user has READ access allowed on the object
     * @param object The object to check. Cannot be null
     * @return true if any connected user has READ access allowed on the object
     */
    public boolean hasAnyConnectedUserReadAccess(Object object)
    {
        return _hasRightOrRead(__ANY_CONNECTED_USER_IDENTITY, null, object) == RightResult.RIGHT_ALLOW;
    }
    
    /* ------------- */
    /* ALLOWED USERS */
    /* ------------- */

    /**
     * Get the list of users that have a particular right in a particular context.
     * @param rightId The name of the right to check. Cannot be null.
     * @param object The object to check the right. Cannot be null.
     * @return The list of users allowed with that right as a Set of String (user identities).
     * @throws RightsException if an error occurs.
     */
    public AllowedUsers getAllowedUsers(String rightId, Object object)
    {
        if (StringUtils.isBlank(rightId))
        {
            throw new RightsException("The rightId cannot be null");
        }

        return _getAllowedUsers(rightId, object);
    }
    
    /**
     * Get the users with a READ access on given object
     * @param object The object
     * @return The representation of allowed users
     */
    public AllowedUsers getReadAccessAllowedUsers(Object object)
    {
        return _getAllowedUsers(null, object);
    }
    
    private AllowedUsers _getAllowedUsers(String rightId, Object object)
    {
        Optional.ofNullable(object).orElseThrow(() ->
        {
            return new RightsException("The object cannot be null");
        });
        
        // Get the objects to check
        Set<Object> objects = _getConvertedObjects(object, new HashSet<>());
        
        // For each object, retrieve the allowed and denied users/groups
        Boolean isAnyConnectedAllowed = null; // unknown
        Set<UserIdentity> allAllowedUsers = new HashSet<>();
        Set<UserIdentity> allDeniedUsers = new HashSet<>();
        Set<GroupIdentity> allAllowedGroups = new HashSet<>();
        Set<GroupIdentity> allDeniedGroups = new HashSet<>();
        
        for (Object obj : objects)
        {
            for (String controllerId : _accessControllerEP.getExtensionsIds())
            {
                AccessController accessController = _accessControllerEP.getExtension(controllerId);
                try
                {
                    if (accessController.isSupported(obj))
                    {
                        if ((rightId == null ? accessController.getReadAccessPermissionForAnonymous(obj) : accessController.getPermissionForAnonymous(rightId, obj)) == AccessResult.ANONYMOUS_ALLOWED)
                        {
                            // Any anonymous user is allowed
                            return new AllowedUsers(true, false, null, null, null, null, _userManager, _groupManager, null);
                        }
                        
                        AccessResult permissionForAnyConnectedUser = rightId == null ? accessController.getReadAccessPermissionForAnyConnectedUser(obj) : accessController.getPermissionForAnyConnectedUser(rightId, obj);
                        if (permissionForAnyConnectedUser == AccessResult.ANY_CONNECTED_DENIED)
                        {
                            // For having any connected user allowed, you need to not have the denied access for one object
                            isAnyConnectedAllowed = Boolean.FALSE;
                        }
                        else if (isAnyConnectedAllowed == null && permissionForAnyConnectedUser == AccessResult.ANY_CONNECTED_ALLOWED)
                        {
                            isAnyConnectedAllowed = Boolean.TRUE;
                        }
                        
                        Map<UserIdentity, AccessResult> permissionsByUser = rightId == null ? accessController.getReadAccessPermissionByUser(obj) : accessController.getPermissionByUser(rightId, obj);
                        
                        Set<UserIdentity> allowedUsersOnObj = permissionsByUser.entrySet().stream()
                                .filter(entry -> AccessResult.USER_ALLOWED.equals(entry.getValue()))
                                .map(Entry::getKey)
                                .collect(Collectors.toSet());
                        allAllowedUsers.addAll(allowedUsersOnObj);
                        
                        Set<UserIdentity> deniedUsersOnObj = permissionsByUser.entrySet().stream()
                                .filter(entry -> AccessResult.USER_DENIED.equals(entry.getValue()))
                                .map(Entry::getKey)
                                .collect(Collectors.toSet());
                        allDeniedUsers.addAll(deniedUsersOnObj);
                        
                        
                        Map<GroupIdentity, AccessResult> permissionsByGroup = rightId == null ? accessController.getReadAccessPermissionByGroup(obj) : accessController.getPermissionByGroup(rightId, obj);
                        
                        Set<GroupIdentity> allowedGroupsOnObj = permissionsByGroup.entrySet().stream()
                                .filter(entry -> AccessResult.GROUP_ALLOWED.equals(entry.getValue()))
                                .map(Entry::getKey)
                                .collect(Collectors.toSet());
                        allAllowedGroups.addAll(allowedGroupsOnObj);
                        
                        Set<GroupIdentity> deniedGroupsOnObj = permissionsByGroup.entrySet().stream()
                                .filter(entry -> AccessResult.GROUP_DENIED.equals(entry.getValue()))
                                .map(Entry::getKey)
                                .collect(Collectors.toSet());
                        allDeniedGroups.addAll(deniedGroupsOnObj);
                    }
                }
                catch (Exception e)
                {
                    getLogger().error("An error occured with controller '{}' for object {}. Thus, this controller will be ignored.", controllerId, obj, e);
                }
            }
        }
        
        Request request = ContextHelper.getRequest(_context);
        @SuppressWarnings("unchecked")
        List<String> populationContexts = (List<String>) request.getAttribute(PopulationContextHelper.POPULATION_CONTEXTS_REQUEST_ATTR);
        
        // Then, return the AllowedUsers object
        return new AllowedUsers(false, isAnyConnectedAllowed != null && isAnyConnectedAllowed.booleanValue(), allAllowedUsers, allDeniedUsers, allAllowedGroups, allDeniedGroups, _userManager, _groupManager, populationContexts != null ? new HashSet<>(populationContexts) : new HashSet<>());
    }
    
    /* --------------- */
    /* GET USER RIGHTS */
    /* --------------- */
    
    /**
     * Get the list of rights a user is allowed, on a particular object.
     * @param userIdentity the user identity. Cannot be null.
     * @param object The object to check the right. Cannot be null.
     * @return The list of rights as a Set of String (id).
     * @throws RightsException if an error occurs.
     */
    public Set<String> getUserRights(UserIdentity userIdentity, Object object) throws RightsException
    {
        if (userIdentity == null)
        {
            throw new RightsException("The userIdentity cannot be null");
        }
        else if (object == null)
        {
            throw new RightsException("The object cannot be null");
        }
        
        // Get the objects to check
        Set<Object> objects = _getConvertedObjects(object, new HashSet<>());
        
        // Retrieve groups the user belongs to
        Set<GroupIdentity> groups = _groupManager.getUserGroups(userIdentity);
        
        // Gets the access by rights
        Map<String, AccessResult> accessResultsByRight = _getAccessResultByRight(userIdentity, groups, objects);
        
        // Keep only positive rights
        Set<String> allowedRights = accessResultsByRight.entrySet().stream().filter(entry -> entry.getValue().toRightResult() == RightResult.RIGHT_ALLOW).map(entry -> entry.getKey()).collect(Collectors.toSet());
        return allowedRights;
    }
    
    /**
     * clear all caches related to RightManager and AccesControllers
     */
    public void clearCaches()
    {
        Request request = ContextHelper.getRequest(_context);

        Enumeration<String> attrNames = request.getAttributeNames();
        while (attrNames.hasMoreElements())
        {
            String attrName = attrNames.nextElement();
            if (attrName != null && attrName.startsWith(AbstractCacheManager.ROLE + "$" + RightManager.ROLE + "$"))
            {
                Cache cache = (Cache) request.getAttribute(attrName);
                if (cache != null)
                {
                    cache.invalidateAll();
                }
            }
        }
    }
    
    private Map<String, AccessResult> _getAccessResultByRight(UserIdentity userIdentity, Set<GroupIdentity> groups, Set<Object> objects)
    {
        Map<String, AccessResult> result = new HashMap<>();
        
        for (Object obj : objects)
        {
            for (String controllerId : _accessControllerEP.getExtensionsIds())
            {
                AccessController accessController = _accessControllerEP.getExtension(controllerId);
                try
                {
                    if (accessController.isSupported(obj))
                    {
                        // Update the result map
                        Map<String, AccessResult> permissionsByRight = accessController.getPermissionByRight(userIdentity, groups, obj);
                        for (String rightId : permissionsByRight.keySet())
                        {
                            result.put(rightId, AccessResult.merge(result.get(rightId), permissionsByRight.get(rightId)));
                        }
                    }
                }
                catch (Exception e)
                {
                    getLogger().error("An error occured with controller '{}' for object {}. Thus, this controller will be ignored.", controllerId, obj, e);
                }
            }
        }
        
        return result;
    }

    /* ------- */
    /* PRIVATE */
    /* ------- */
    
    private Set<Object> _getConvertedObjects(Object object, Set<Object> alreadyHandledObjects)
    {
        Set<Object> finalObjects = new HashSet<>();
        
        if (!alreadyHandledObjects.contains(object))
        {
            alreadyHandledObjects.add(object);
            
            Set<Object> objects = _rightContextConvertorEP.getExtensionsIds().stream()
                    .map(_rightContextConvertorEP::getExtension)
                    .flatMap(convertor -> convertor.convert(object).stream())
                    .collect(Collectors.toSet());
            
            finalObjects.addAll(objects);
            finalObjects.add(object);
    
            for (Object convertedObject : objects)
            {
                finalObjects.addAll(_getConvertedObjects(convertedObject, alreadyHandledObjects));
            }
        }
        
        return finalObjects;
    }
    
    private Set<GroupIdentity> _getGroups(UserIdentity userIdentity)
    {
        if (userIdentity == __ANONYMOUS_USER_IDENTITY || userIdentity == __ANY_CONNECTED_USER_IDENTITY)
        {
            return Collections.EMPTY_SET;
        }
        else
        {
            Set<GroupIdentity> userGroups = _groupManager.getUserGroups(userIdentity);
            return userGroups;
        }
    }

    
    
    private RightResult _hasRightResultInFirstCache(UserIdentity userIdentity, String rightId, Object object)
    {

        Cache<Cache1Key, RightResult> mapCache = _cacheManager.get(CACHE_1);
        Cache1Key key = Cache1Key.of(userIdentity, rightId, object);
        if (mapCache.hasKey(key))
        {
            RightResult cacheResult = mapCache.get(key);
            getLogger().debug("Find entry in cache for [{}, {}, {}] => {}", userIdentity, rightId, object, cacheResult);
            return cacheResult;
        }
        getLogger().debug("Did not find entry in cache for [{}, {}, {}]", userIdentity, rightId, object);
        return null;
    }
    
    private void _putInFirstCache(UserIdentity userIdentity, String rightId, Object object, RightResult rightResult)
    {
        Cache<Cache1Key, RightResult> mapCache = _cacheManager.get(CACHE_1);
        if (mapCache != null)
        {
            mapCache.put(Cache1Key.of(userIdentity, rightId, object), rightResult);
        }
    }
    
    private RightResult _hasRightResultInSecondCache(Set<Object> workspacesContexts, UserIdentity userIdentity, String rightId)
    {
        Cache<Cache2Key, RightResult> mapCache = _cacheManager.get(CACHE_2);
        Cache2Key key = Cache2Key.of(userIdentity, rightId, workspacesContexts);
        if (mapCache != null)
        {
            if (mapCache.hasKey(key))
            {
                RightResult cacheResult = mapCache.get(key);
                getLogger().debug("Find entry in cache2 for [{}, {}, {}] => {}", workspacesContexts, userIdentity, rightId, cacheResult);
                return cacheResult;
            }
        }
        
        getLogger().debug("Did not find entry in cache2 for [{}, {}, {}]", workspacesContexts, userIdentity, rightId);
        return null;
    }
    
    private void _putInSecondCache(Set<Object> workspacesContexts, UserIdentity userIdentity, String rightId, RightResult rightResult)
    {
        Cache<Cache2Key, RightResult> mapCache = _cacheManager.get(CACHE_2);

        if (mapCache != null)
        {
            mapCache.put(Cache2Key.of(userIdentity, rightId, workspacesContexts), rightResult);
        }
    }
    
    /**
     * Explain why a given user has a right on a context.
     * 
     * This method will return the explanations provided by every supporting access controller.
     * Merging the access result of every explanation will return the same result as the
     * {@link #_hasRight(UserIdentity, String, Object)} method.
     * 
     * @implNote this method implementation should mirror the {@link #hasRight(UserIdentity, String, Object)} method
     * without using cache.
     * 
     * @param userIdentity the user identity or null for anonymous
     * @param rightId the right to explain or null for read right.
     * @param object the object to check right on. Can't be null.
     * @return the list of explanation.
     */
    public List<AccessExplanation> explain(UserIdentity userIdentity, String rightId, Object object)
    {
        UserIdentity objectUserIdentity = userIdentity == null ? __ANONYMOUS_USER_IDENTITY : userIdentity;
        
        if (object == null)
        {
            throw new RightsException("The object cannot be null");
        }
        
        // Retrieve groups the user belongs to
        Set<GroupIdentity> groups = _getGroups(objectUserIdentity);
        
        // Get the objects to check
        Set<Object> objects = _getConvertedObjects(object, new HashSet<>());
        
        return _explainAccessResults(objectUserIdentity, groups, rightId, objects);
    }
    
    /**
     * Iterate on the objects and access controller to retrieve the explanations of all the supported controllers
     * @return the explanations
     */
    private List<AccessExplanation> _explainAccessResults(UserIdentity userIdentity, Set<GroupIdentity> groups, String rightId, Set<Object> objects)
    {
        List<AccessExplanation> accessExplanations = new ArrayList<>();
        
        for (Object object : objects)
        {
            for (String controllerId : _accessControllerEP.getExtensionsIds())
            {
                AccessController accessController = _accessControllerEP.getExtension(controllerId);
                if (accessController.isSupported(object))
                {
                    AccessExplanation explanation = _getAccessControllerExplanation(accessController, userIdentity, groups, rightId, object);
                    
                    accessExplanations.add(explanation);
                }
            }
        }
        
        return accessExplanations;
    }
    
    /**
     * Get all the permissions that concern a given user.
     * 
     * The permissions are organized by object context and are paired with a list of explanation
     * returned by the {@link AccessController} that granted the permission.
     * 
     * @param userIdentity the user identity
     * @return all the permissions of a user.
     */
    public Map<ExplanationObject, Map<Permission, List<AccessExplanation>>> getAllPermissions(UserIdentity userIdentity)
    {
        // Retrieve groups the user belongs to
        Set<GroupIdentity> groups = _groupManager.getUserGroups(userIdentity);
        
        Map<ExplanationObject, Map<Permission, List<AccessExplanation>>> permissionsForUser = new HashMap<>();
        
        for (String controllerId : _accessControllerEP.getExtensionsIds())
        {
            AccessController accessController = _accessControllerEP.getExtension(controllerId);
            
            Map<ExplanationObject, Map<Permission, AccessExplanation>> controllerPermissionsForUser = accessController.explainAllPermissions(userIdentity, groups);
            for (ExplanationObject context : controllerPermissionsForUser.keySet())
            {
                Map<Permission, List<AccessExplanation>> contextExplanations = permissionsForUser.computeIfAbsent(context, o -> new HashMap<Permission, List<AccessExplanation>>());
                Map<Permission, AccessExplanation> contextPermissions = controllerPermissionsForUser.get(context);
                for (Permission permission : contextPermissions.keySet())
                {
                    List<AccessExplanation> rightExplanation = contextExplanations.computeIfAbsent(permission, str -> new ArrayList<>());
                    rightExplanation.add(contextPermissions.get(permission));
                }
            }
        }
        
        return permissionsForUser;
    }

    private AccessExplanation _getAccessControllerExplanation(AccessController accessController, UserIdentity userIdentity, Set<GroupIdentity> groups, String rightId, Object object)
    {
        AccessExplanation explanation;
        try
        {
            if (userIdentity == __ANONYMOUS_USER_IDENTITY)
            {
                explanation = rightId == null ? accessController.explainReadAccessPermissionForAnonymous(object) : accessController.explainPermissionForAnonymous(rightId, object);
            }
            else if (userIdentity == __ANY_CONNECTED_USER_IDENTITY)
            {
                explanation = rightId == null ? accessController.explainReadAccessPermissionForAnyConnectedUser(object) : accessController.explainPermissionForAnyConnectedUser(rightId, object);
            }
            else
            {
                explanation = rightId == null ? accessController.explainReadAccessPermission(userIdentity, groups, object) : accessController.explainPermission(userIdentity, groups, rightId, object);
            }
        }
        catch (Exception e)
        {
            // Try to fallback to the get permission method in case of failure
            // An explanation without all the supported access controller
            // may be false. By including a less detailed explanation, we make sure the
            // general explanation stay correct
            AccessResult result;
            if (userIdentity == __ANONYMOUS_USER_IDENTITY)
            {
                result = rightId == null ? accessController.getReadAccessPermissionForAnonymous(object) : accessController.getPermissionForAnonymous(rightId, object);
            }
            else if (userIdentity == __ANY_CONNECTED_USER_IDENTITY)
            {
                result = rightId == null ? accessController.getReadAccessPermissionForAnyConnectedUser(object) : accessController.getPermissionForAnyConnectedUser(rightId, object);
            }
            else
            {
                result = rightId == null ? accessController.getReadAccessPermission(userIdentity, groups, object) : accessController.getPermission(userIdentity, groups, rightId, object);
            }
            
            explanation = AccessController.getDefaultAccessExplanation(accessController.getId(), result);
            getLogger().warn("An error occured while explaining access with controller '{}' for object {}. A generic explanation was returned.", accessController.getId(), object, e);
        }
        return explanation;
    }
    
    static class Cache1Key extends AbstractCacheKey
    {
        Cache1Key(UserIdentity userIdentity, String rightId, Object object)
        {
            super(userIdentity, rightId, object);
        }

        static Cache1Key of(UserIdentity userIdentity, String rightId, Object object)
        {
            return new Cache1Key(userIdentity, StringUtils.defaultString(rightId), object);
        }
        
    }
    static class Cache2Key extends AbstractCacheKey
    {
        Cache2Key(UserIdentity userIdentity, String rightId, Set<Object> workspacesContexts)
        {
            super(userIdentity, rightId, workspacesContexts);
        }

        static Cache2Key of(UserIdentity userIdentity, String rightId, Set<Object> workspacesContexts)
        {
            return new Cache2Key(userIdentity, StringUtils.defaultString(rightId), workspacesContexts);
        }
        
    }
}