/*
 *  Copyright 2012 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.web.usermanagement;

import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Optional;

import org.apache.avalon.framework.parameters.Parameters;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.cocoon.acting.ServiceableAction;
import org.apache.cocoon.environment.ObjectModelHelper;
import org.apache.cocoon.environment.Redirector;
import org.apache.cocoon.environment.Request;
import org.apache.cocoon.environment.SourceResolver;
import org.apache.commons.lang3.StringUtils;

import org.ametys.core.user.CurrentUserProvider;
import org.ametys.core.user.UserIdentity;
import org.ametys.runtime.authentication.AuthorizationRequiredException;
import org.ametys.runtime.i18n.I18nizableText;
import org.ametys.web.renderingcontext.RenderingContext;
import org.ametys.web.renderingcontext.RenderingContextHandler;
import org.ametys.web.usermanagement.UserManagementException.StatusError;

import com.google.common.collect.ArrayListMultimap;
import com.google.common.collect.Multimap;

/**
 * Handle the lost password and change password actions.
 */
public class UserPasswordAction extends ServiceableAction
{
    /** The user signup manager. */
    protected UserSignupManager _userSignupManager;
    
    /** The rendering context handler. */
    protected RenderingContextHandler _renderingContextHandler;
    
    /** The current user provider */
    protected CurrentUserProvider _currentUserProvider;
    
    @Override
    public void service(ServiceManager serviceManager) throws ServiceException
    {
        super.service(serviceManager);
        _userSignupManager = (UserSignupManager) serviceManager.lookup(UserSignupManager.ROLE);
        _renderingContextHandler = (RenderingContextHandler) serviceManager.lookup(RenderingContextHandler.ROLE);
        _currentUserProvider = (CurrentUserProvider) manager.lookup(CurrentUserProvider.ROLE);
    }
    
    @Override
    public Map act(Redirector redirector, SourceResolver resolver, Map objectModel, String source, Parameters parameters) throws Exception
    {
        Request request = ObjectModelHelper.getRequest(objectModel);
        String siteName = (String) request.getAttribute("site");
        String language = (String) request.getAttribute("sitemapLanguage");
        RenderingContext renderingContext = _renderingContextHandler.getRenderingContext();
        
        Map<String, Object> results = new HashMap<>();
        
        UserIdentity foUser = _currentUserProvider.getUser();
        
        boolean lostPassword = "true".equals(request.getParameter("lost-password")); // (1) when unconnected user ask for a new password
        boolean changePassword = "true".equals(request.getParameter("change-password")); // (2) when connected user ask for change password
        boolean submitPassword = "true".equals(request.getParameter("pwd-submit")); // (3) when connected or unconnected user submit a new password
        

        String mode = request.getParameter("mode");
        String login = request.getParameter("login");
        String population = request.getParameter("population");
        String token = request.getParameter("token");
        
        boolean reinitPassword = StringUtils.isNotEmpty(token) && StringUtils.isNotEmpty(login) && StringUtils.isNotEmpty(population);
        
        Multimap<String, I18nizableText> errors = ArrayListMultimap.create();
                
        try
        {
            if ("lostpassword".equals(mode))
            {
                _lostPasswordMode(results);
            }
            else if (lostPassword)
            {
                _newPasswordRequest(results, request, siteName, language, errors);
            }
            else if (changePassword)
            {
                _changePasswordRequest(results, request, siteName, language, errors);
            }
            else if (submitPassword)
            {
                _submitNewPassword(results, request, siteName, token, errors);
            }
            else if (reinitPassword)
            {
                _reinitPassword(results, request, siteName, login, token, population, errors);
            }
            else if (foUser != null)
            {
                // Default behavior: if user is connected, display the form to request a new token with the connected user.
                results.put("step", "change-password");
            }
            else if (renderingContext == RenderingContext.FRONT)
            {
                // Send a 401 to force the user to authenticate.
                throw new AuthorizationRequiredException();
            }
        }
        catch (UserManagementException e)
        {
            errors.put("global", new I18nizableText("general-error"));
            results.put("step", "no-form");
            
            getLogger().error("An error occurred resetting a user password.", e);
        }
        
        request.setAttribute("errors", errors);
        
        return results;
    }
    
    private void _lostPasswordMode(Map<String, Object> results)
    {
        // Unconnected user clicked on "lost password" => display the form to request a new token.
        results.put("step", "lost-password");
    }
    
    private void _newPasswordRequest(Map<String, Object> results, Request request, String siteName, String language, Multimap<String, I18nizableText> errors) throws UserManagementException
    {
        // Unconnected user entered his email/login and population to request a new token by email
        results.put("step", "lost-password-change");
        resetPassword(request, siteName, language, errors);
        if (errors.isEmpty())
        {
            results.put("status", "success");
        }
    }
    
    private void _changePasswordRequest(Map<String, Object> results, Request request, String siteName, String language, Multimap<String, I18nizableText> errors) throws UserManagementException
    {
        // Connected user asks for a new token by email
        results.put("step", "change-password-change");
        resetConnectedUserPassword(request, siteName, language, errors);
        if (errors.isEmpty())
        {
            results.put("status", "success");
        }
    }
    
    private void _submitNewPassword(Map<String, Object> results, Request request, String siteName, String token, Multimap<String, I18nizableText> errors) throws UserManagementException
    {
        // Connected or unconnected user submitted a new password
        results.put("step", "user-update");
        changeUserPassword(request, siteName, token, errors);
        if (errors.isEmpty())
        {
            results.put("status", "success");
        }
    }
    
    private void _reinitPassword(Map<String, Object> results, Request request, String siteName, String login, String token, String population, Multimap<String, I18nizableText> errors) throws UserManagementException
    {
        // User clicked on email link to display the password form. 
        // If a token is provided, check it.
        results.put("step", "password");
        
        boolean weakPassword = "true".equals(request.getParameter("weak-password")); // (4) when unconnected user with a weak password has to define to new password
        if (weakPassword)
        {
            // User with a weak password is forced to change its password. A token has been automatically generated.
            results.put("weak-password", "true");
        }
        checkPasswordToken(request, siteName, login, token, population, errors);
        if (errors.isEmpty())
        {
            results.put("status", "success");
        }
    }
    /**
     * Reset a user's sign-up request.
     * @param request the user request.
     * @param siteName the site name.
     * @param language the language.
     * @param errors the Map to fill with errors to display to the user.
     * @throws UserManagementException if an error occurs.
     */
    protected void resetPassword(Request request, String siteName, String language, Multimap<String, I18nizableText> errors) throws UserManagementException
    {
        String email = request.getParameter("email");
        String populationId = request.getParameter("population");
        
        try
        {
            _userSignupManager.resetPassword(siteName, language, email, populationId);
        }
        catch (UserManagementException e)
        {
            StatusError statusError = e.getStatusError();
            switch (statusError)
            {
                case POPULATION_UNKNOWN:
                case USER_UNKNOWN:
                case UNMODIFIABLE_USER_DIRECTORY:
                case NOT_UNIQUE_USER:
                case EMPTY_EMAIL:
                    setGlobalError(statusError, errors, email, populationId);
                    break;
                default:
                    throw e;
            }
        }
    }
    
    /**
     * Reset a connected user password.
     * @param request the user request.
     * @param siteName the site name.
     * @param language the language.
     * @param errors the Map to fill with errors to display to the user.
     * @throws UserManagementException if an error occurs.
     */
    protected void resetConnectedUserPassword(Request request, String siteName, String language, Multimap<String, I18nizableText> errors) throws UserManagementException
    {
        UserIdentity foUser = _currentUserProvider.getUser();
        
        if (foUser == null)
        {
            setGlobalError(StatusError.NOT_CONNECTED, errors, null, null);
        }
        else
        {
            String login = foUser.getLogin();
            String populationId = foUser.getPopulationId();
            
            try
            {
                _userSignupManager.resetPassword(siteName, language, login, populationId);
            }
            catch (UserManagementException e)
            {
                StatusError statusError = e.getStatusError();
                switch (statusError)
                {
                    case POPULATION_UNKNOWN:
                    case USER_UNKNOWN:
                    case UNMODIFIABLE_USER_DIRECTORY:
                    case NOT_UNIQUE_USER:
                    case EMPTY_EMAIL:
                        setGlobalError(statusError, errors, login, populationId);
                        break;
                    default:
                        throw e;
                }
            }
        }
    }
    
    /**
     * Check that a token is valid.
     * @param request the user request.
     * @param siteName the site name.
     * @param login the user login.
     * @param token the sign-up token that was sent to the user. 
     * @param populationId The id of the population
     * @param errors the Map to fill with errors to display to the user.
     * @throws UserManagementException if an error occurs.
     */
    protected void checkPasswordToken(Request request, String siteName, String login, String token, String populationId, Multimap<String, I18nizableText> errors) throws UserManagementException
    {
        try
        {
            _userSignupManager.checkPasswordToken(siteName, login, token, populationId);
        }
        catch (UserManagementException e)
        {
            StatusError statusError = e.getStatusError();
            switch (statusError)           
            {
                case TOKEN_UNKNOWN:
                case TOKEN_EXPIRED:
                    setGlobalError(statusError, errors, login, populationId);
                    break;
                default:
                    throw e;
            }
        }
        
        
    }
    
    /**
     * Sign-up the user: create a real user from his temporary information.
     * @param request the user request.
     * @param siteName the site name.
     * @param token the sign-up token that was sent to the user. 
     * @param errors the Map to fill with errors to display to the user.
     * @throws UserManagementException if an error occurs.
     */
    protected void changeUserPassword(Request request, String siteName, String token, Multimap<String, I18nizableText> errors) throws UserManagementException
    {
        // Get the login either from the request or from the connected user.
        String login = request.getParameter("login");
        String population = request.getParameter("population");
        UserIdentity foUser;
        if (StringUtils.isEmpty(login) || StringUtils.isEmpty(population))
        {
            foUser = _currentUserProvider.getUser();
        }
        else
        {
            foUser = new UserIdentity(login, population);
        }
        
        if (foUser == null)
        {
            setGlobalError(StatusError.NOT_CONNECTED, errors, null, null);
            return;
        }
        
        String password = request.getParameter("password");
        String passwordConfirmation = request.getParameter("password-confirmation");
        
        // First validation.
        if (StringUtils.isBlank(password))
        {
            errors.put("password", new I18nizableText("plugin.web", "PLUGINS_WEB_USER_SIGNUP_ERROR_PASSWORD_EMPTY"));
        }
        else if (!password.equals(passwordConfirmation))
        {
            errors.put("password", new I18nizableText("plugin.web", "PLUGINS_WEB_USER_SIGNUP_ERROR_PASSWORD_CONFIRMATION_DOESNT_MATCH"));
        }
        
        // Full validation.
        List<I18nizableText> inputErrors = _userSignupManager.validatePassword(siteName, password, foUser.getLogin(), foUser.getPopulationId());
        errors.putAll("password", inputErrors);
        
        if (errors.isEmpty())
        {
            try
            {
                // Validation passed: effectively change the password.
                _userSignupManager.changeUserPassword(siteName, foUser.getLogin(), token, password, foUser.getPopulationId());
            }
            catch (UserManagementException e)
            {
                StatusError statusError = e.getStatusError();
                switch (statusError)
                {
                    case TOKEN_UNKNOWN:
                    case TOKEN_EXPIRED:
                        setGlobalError(statusError, errors, foUser.getLogin(), foUser.getPopulationId());
                        break;
                    default:
                        throw e;
                }
            }
        }
    }
    
    /**
     * Set the global error if there is one.
     * @param error The error to add (can be null)
     * @param errors The errors map
     * @param login The login of the user (can be null)
     * @param populationId The population of the user (can be null)
     */
    protected void setGlobalError(StatusError error, Multimap<String, I18nizableText> errors, String login, String populationId)
    {
        if (error != null)
        {
            errors.put("global", new I18nizableText(error.name()));
            if (getLogger().isWarnEnabled())
            {
                String message = String.format(
                        "Error during resetting the password of the connected user '%s' of population '%s': %s",
                        Optional.ofNullable(login).orElse(StringUtils.EMPTY),
                        Optional.ofNullable(populationId).orElse(StringUtils.EMPTY),
                        error.name());
                getLogger().warn(message);
            }
        }
    }
}