/*
 *  Copyright 2026 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.cms.rights;

import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Set;

import org.apache.avalon.framework.activity.Initializable;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.avalon.framework.service.Serviceable;

import org.ametys.cms.content.RootContentHelper;
import org.ametys.cms.repository.Content;
import org.ametys.core.group.GroupIdentity;
import org.ametys.core.right.AccessController;
import org.ametys.core.right.AccessController.Permission.PermissionType;
import org.ametys.core.right.AccessExplanation;
import org.ametys.core.right.RightManager;
import org.ametys.core.right.RightsException;
import org.ametys.core.user.UserIdentity;
import org.ametys.plugins.repository.AmetysObjectResolver;
import org.ametys.runtime.config.Config;
import org.ametys.runtime.i18n.I18nizableText;
import org.ametys.runtime.plugin.component.PluginAware;

/**
 * Access controller for content reactions and report.
 * The access to content reactions is managed by two rights: "CMS_Rights_Content_Report" and "CMS_Rights_Content_React". 
 * If the content interaction access is based on read access, any user (including anonymous) with read access will be able to react or report a content.
 */
public class ContentInteractionAccessController implements AccessController, Initializable, Serviceable, PluginAware
{
    private static final List<String> __REACTION_RIGHTS = List.of("CMS_Rights_Content_Report", "CMS_Rights_Content_React");
    
    /** The helper for root content */
    protected RootContentHelper _rootContentHelper;
    /** The Ametys object resolver */
    protected AmetysObjectResolver _resolver;
    
    private boolean _readAccessBased;

    private String _id;

    private RightManager _rightManager;
    
    @Override
    public void initialize() throws Exception
    {
        _readAccessBased = Config.getInstance().getValue("cms.contents.interaction.read.access.based", true, true);
    }
    
    public void service(ServiceManager manager) throws ServiceException
    {
        _resolver = (AmetysObjectResolver) manager.lookup(AmetysObjectResolver.ROLE);
        _rootContentHelper = (RootContentHelper) manager.lookup(RootContentHelper.ROLE);
        _rightManager = (RightManager) manager.lookup(RightManager.ROLE);
    }
    
    public void setPluginInfo(String pluginName, String featureName, String id)
    {
        _id = id;
    }
    
    public boolean supports(Object object)
    {
        return object instanceof Content;
    }
    
    public String getId()
    {
        return _id;
    }
    
    /**
     * Returns true if the content interaction access is based on read access, false if it is based on specific rights only.
     * @param object The content object
     * @return The reaction access type
     */
    protected boolean isReadAccessBased(Object object)
    {
        return _readAccessBased;
    }
    
    @Override
    public AccessResult getPermissionForAnonymous(String rightId, Object object)
    {
        if (__REACTION_RIGHTS.contains(rightId) && isReadAccessBased(object))
        {
            if (_rightManager.hasAnonymousReadAccess(object))
            {
                return AccessResult.ANONYMOUS_ALLOWED;
            }
        }
        
        return AccessResult.UNKNOWN;
    }
    
    @Override
    public AccessResult getPermissionForAnyConnectedUser(String rightId, Object object)
    {
        if (__REACTION_RIGHTS.contains(rightId) && isReadAccessBased(object))
        {
            if (_rightManager.hasAnonymousReadAccess(object))
            {
                return AccessResult.ANONYMOUS_ALLOWED;
            }
            
            if (_rightManager.hasAnyConnectedUserReadAccess(object))
            {
                return AccessResult.ANY_CONNECTED_ALLOWED;
            }
        }
        
        return AccessResult.UNKNOWN;
    }
    
    @Override
    public AccessResult getPermission(UserIdentity user, Set<GroupIdentity> userGroups, String rightId, Object object)
    {
        if (__REACTION_RIGHTS.contains(rightId) && isReadAccessBased(object))
        {
            if (_rightManager.hasAnonymousReadAccess(object))
            {
                return AccessResult.ANONYMOUS_ALLOWED;
            }
            
            if (_rightManager.hasAnyConnectedUserReadAccess(object))
            {
                return AccessResult.ANY_CONNECTED_ALLOWED;
            }
            
            if (_rightManager.hasReadAccess(user, object))
            {
                return AccessResult.USER_ALLOWED;
            }
        }
        
        return AccessResult.UNKNOWN;
    }
    
    @Override
    public Map<UserIdentity, AccessResult> getPermissionByUser(String rightId, Object object)
    {
        Map<UserIdentity, AccessResult> permissionsByUser = new HashMap<>();
        
        if (__REACTION_RIGHTS.contains(rightId) && isReadAccessBased(object))
        {
            _rightManager.getReadAccessAllowedUsers(object).getAllowedUsers().forEach(user -> {
                permissionsByUser.put(user, AccessResult.USER_ALLOWED);
            });
        }
        
        return permissionsByUser;
    }
    
    @Override
    public Map<GroupIdentity, AccessResult> getPermissionByGroup(String rightId, Object object)
    {
        Map<GroupIdentity, AccessResult> permissionsByGroup = new HashMap<>();
        
        if (__REACTION_RIGHTS.contains(rightId) && isReadAccessBased(object))
        {
            _rightManager.getReadAccessAllowedUsers(object).getAllowedGroups().forEach(group -> {
                permissionsByGroup.put(group, AccessResult.GROUP_ALLOWED);
            });
        }
        
        return permissionsByGroup;
    }
    
    public Map<String, AccessResult> getPermissionByRight(UserIdentity user, Set<GroupIdentity> userGroups, Object object)
    {
        Map<String, AccessResult> permissionByRight = new HashMap<>();
        
        if (isReadAccessBased(object))
        {
            // Access result is the same for all reaction rights, as they are all based on read access, so we can compute it once and apply it to all rights.
            AccessResult accessResult = AccessResult.UNKNOWN;
            if (_rightManager.hasAnonymousReadAccess(object))
            {
                accessResult = AccessResult.ANONYMOUS_ALLOWED;
            }
            else if (_rightManager.hasAnyConnectedUserReadAccess(object))
            {
                accessResult = AccessResult.ANY_CONNECTED_ALLOWED;
            }
            else if (_rightManager.hasReadAccess(user, object))
            {
                accessResult = AccessResult.USER_ALLOWED;
            }
            
            if (accessResult != AccessResult.UNKNOWN)
            {
                for (String rightId : __REACTION_RIGHTS)
                {
                    permissionByRight.put(rightId, accessResult);
                }
            }
        }
        
        return permissionByRight;
    }
    
    // ----------------------------------------------------------------------------------------
    // Right's explanation methods 
    
    @Override
    public I18nizableText getObjectCategory(Object object)
    {
        return ContentAccessController.CONTENT_CONTEXT_CATEGORY;
    }

    @Override
    public I18nizableText getObjectLabel(Object object) throws RightsException
    {
        if (object instanceof Content content)
        {
            return new I18nizableText(content.getTitle());
        }
        throw new RightsException("unsupported context: " + object.toString());
    }

    public AccessExplanation explainReadAccessPermissionForAnonymous(Object object)
    {
        return _getAccessExplanation(getReadAccessPermissionForAnonymous(object), object);
    }
    
    @Override
    public AccessExplanation explainReadAccessPermission(UserIdentity user, Set<GroupIdentity> groups, Object object)
    {
        return _getAccessExplanation(getReadAccessPermission(user, groups, object), object);
    }

    @Override
    public AccessExplanation explainPermissionForAnonymous(String rightId, Object object)
    {
        return _getAccessExplanation(getPermissionForAnonymous(rightId, object), object);
    }
    
    public AccessExplanation explainPermission(UserIdentity user, Set<GroupIdentity> groups, String rightId, Object object)
    {
        return _getAccessExplanation(getPermission(user, groups, rightId, object), object);
    }
    
    @Override
    public Map<ExplanationObject, Map<Permission, AccessExplanation>> explainAllPermissions(UserIdentity identity, Set<GroupIdentity> groups, Set<Object> workspacesContexts)
    {
        if (isReadAccessBased(null))
        {
            Map<ExplanationObject, Map<Permission, AccessExplanation>> result = new HashMap<>();
            
            // Simplify the explanation by providing a single (fake) context describing every content with read access instead of listing all of them
            ExplanationObject allContentsCtx = new ExplanationObject(
                    "all-contents-in-readaccess",
                    new I18nizableText("plugin.cms", "PLUGINS_CMS_CONTENT_INTERACTION_ACCESS_CONTROLLER_ALL_CONTENTS_IN_READ_ACCESS_CONTEXT_LABEL"),
                    getObjectCategory(null),
                    10
                    );
            
            Map<Permission, AccessExplanation> permissions = new HashMap<>();
            
            // Explanation is the same for all reaction rights, as they are all based on read access, so we can compute it once and apply it to all rights.
            // Use the ANONYMOUS_ALLOWED access result, as it is the most permissive access result and the explanation label is the same for all access results based on read access.
            AccessExplanation explanation = _getAccessExplanation(AccessResult.ANONYMOUS_ALLOWED, null);
            for (String rightId : __REACTION_RIGHTS)
            {
                permissions.put(new Permission(PermissionType.RIGHT, rightId), explanation);
            }
            result.put(allContentsCtx, permissions);
            
            return result;
        }
        return Map.of();
    }
    
    public Map<Permission, AccessExplanation> explainAllPermissionsForAnonymous(Object object)
    {
        Map<Permission, AccessExplanation> results = new HashMap<>();
        
        for (String rightId : __REACTION_RIGHTS)
        {
            AccessResult accessResult = getPermissionForAnonymous(rightId, object);
            if (accessResult != AccessResult.UNKNOWN)
            {
                results.put(new Permission(PermissionType.RIGHT, rightId), _getAccessExplanation(accessResult, object));
            }
        }
        
        return results;
    }
    
    public Map<Permission, AccessExplanation> explainAllPermissionsForAnyConnected(Object object)
    {
        Map<Permission, AccessExplanation> results = new HashMap<>();
        
        for (String rightId : __REACTION_RIGHTS)
        {
            AccessResult accessResult = getPermissionForAnyConnectedUser(rightId, object);
            if (accessResult != AccessResult.UNKNOWN)
            {
                results.put(new Permission(PermissionType.RIGHT, rightId), _getAccessExplanation(accessResult, object));
            }
        }
        
        return results;
    }
    
    public Map<UserIdentity, Map<Permission, AccessExplanation>> explainAllPermissionsByUser(Object object)
    {
        Map<UserIdentity, Map<Permission, AccessExplanation>> permissionsByUser = new HashMap<>();
        
        if (isReadAccessBased(object))
        {
            for (String rightId : __REACTION_RIGHTS)
            {
                getPermissionByUser(rightId, object).forEach((user, accessResult) -> {
                    permissionsByUser.computeIfAbsent(user, k -> new HashMap<>()).put(new Permission(PermissionType.RIGHT, rightId), _getAccessExplanation(accessResult, object));
                });
                
            }
        }
        
        return permissionsByUser;
    }

    public Map<GroupIdentity, Map<Permission, AccessExplanation>> explainAllPermissionsByGroup(Object object)
    {
        Map<GroupIdentity, Map<Permission, AccessExplanation>> permissionsByGroup = new HashMap<>();
        
        if (isReadAccessBased(object))
        {
            for (String rightId : __REACTION_RIGHTS)
            {
                getPermissionByGroup(rightId, object).forEach((group, accessResult) -> {
                    permissionsByGroup.computeIfAbsent(group, k -> new HashMap<>()).put(new Permission(PermissionType.RIGHT, rightId), _getAccessExplanation(accessResult, object));
                });
                
            }
        }
        
        return permissionsByGroup;
    }
    
    /**
     * Get the access explanation for given access result
     * @param result the access result
     * @param object the object. Can be null
     * @return The access explanation
     */
    protected AccessExplanation _getAccessExplanation(AccessResult result, Object object)
    {
        switch (result)
        {
            case ANONYMOUS_ALLOWED:
            case ANY_CONNECTED_ALLOWED:
            case USER_ALLOWED:
            case UNKNOWN:
                return new AccessExplanation(
                        getId(),
                        result,
                        new I18nizableText(
                                "plugin.cms",
                                "PLUGINS_CMS_CONTENT_INTERACTION_ACCESS_CONTROLLER_" + result.name() + "_EXPLANATION",
                                object != null ? Map.of("title", getObjectLabel(object)) : Map.of()
                            )
                        );
            default:
                return AccessController.getDefaultAccessExplanation(getId(), result);
        }
    }
       
    // ------------------------------------------------------------------------------
    // Read access is not managed by this controller, so return UNKNOWN for all cases

    @Override
    public AccessResult getReadAccessPermission(UserIdentity user, Set<GroupIdentity> userGroups, Object object)
    {
        return AccessResult.UNKNOWN;
    }
    
    @Override
    public Map<UserIdentity, AccessResult> getReadAccessPermissionByUser(Object object)
    {
        return Map.of();
    }
    
    @Override
    public Map<GroupIdentity, AccessResult> getReadAccessPermissionByGroup(Object object)
    {
        return Map.of();
    }
    
    @Override
    public AccessResult getReadAccessPermissionForAnonymous(Object object)
    {
        return AccessResult.UNKNOWN;
    }
    
    @Override
    public AccessResult getReadAccessPermissionForAnyConnectedUser(Object object)
    {
        return AccessResult.UNKNOWN;
    }
    
    // ------------------------------------------------------------------------------
    // No workspace permission
    
    public boolean hasAnonymousAnyPermissionOnWorkspace(Set<Object> workspacesContexts, String rightId)
    {
        return false;
    }
    
    public boolean hasAnyConnectedUserAnyPermissionOnWorkspace(Set<Object> workspacesContexts, String rightId)
    {
        return false;
    }
    
    public boolean hasUserAnyPermissionOnWorkspace(Set<Object> workspacesContexts, UserIdentity user, Set<GroupIdentity> userGroups, String rightId)
    {
        return false;
    }
    
    public boolean hasAnonymousAnyReadAccessPermissionOnWorkspace(Set<Object> workspacesContexts)
    {
        return false;
    }
    
    public boolean hasAnyConnectedUserAnyReadAccessPermissionOnWorkspace(Set<Object> workspacesContexts)
    {
        return false;
    }
    
    public boolean hasUserAnyReadAccessPermissionOnWorkspace(Set<Object> workspacesContexts, UserIdentity user, Set<GroupIdentity> userGroups)
    {
        return false;
    }
}