/*
 *  Copyright 2020 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.core.right;

import java.util.Map;
import java.util.Set;

import org.ametys.core.group.GroupIdentity;
import org.ametys.core.user.UserIdentity;

/**
 * This interface is for read-only profile assignments storage
 */
public interface ProfileAssignmentStorage
{
    /** Minimum priority. */
    public static final int MIN_PRIORITY = Integer.MAX_VALUE;
    /** Maximum priority. */
    public static final int MAX_PRIORITY = 0;
    
    /**
     * Keys for method that can return profiles of anonymous or any connected user 
     */
    public enum AnonymousOrAnyConnectedKeys 
    {
        /** Allowed profiles for anonymous */
        ANONYMOUS_ALLOWED,
        /** Denied profiles for anonymous */
        ANONYMOUS_DENIED,
        /** Allowed profiles for any connected users */
        ANYCONNECTEDUSER_ALLOWED,
        /** Denied profiles for any connected users */
        ANYCONNECTEDUSER_DENIED
    }
    /**
     * Keys for method that can return profiles of user or groups 
     */
    public enum UserOrGroup 
    {
        /** Allowed profiles */
        ALLOWED,
        /** Denied profiles */
        DENIED,
    }
    
    /* -------------- */
    /* HAS PERMISSION */
    /* -------------- */
    
    /**
     * Returns some profiles that are matching if anonymous user has the allowed profile for any given root context (or any sub context), given some profiles.<br>Only supported objects are transmitted
     * @param rootContexts The root contexts to search rights for
     * @param profileIds The ids of the profiles
     * @return If the Set is empty, it means anonymous has no matching profile.<br>
     *         If the Set is non empty, it contains at least one of the given profile BUT it may not contains all the matching profiles for anonymous AND it can contains some other profiles that were not in the given profiles
     */
    public Set<String> hasAnonymousAnyAllowedProfile(Set< ? extends Object> rootContexts, Set<String> profileIds);
    
    /**
     * Returns some profiles that are matching if any connected user has the allowed profile for any given root context (or any sub context), given some profiles.<br>Only supported objects are transmitted
     * @param rootContexts The root contexts to search rights for
     * @param profileIds The ids of the profiles
     * @return If the Set is empty, it means the user has no matching profile.<br>
     *         If the Set is non empty, it contains at least one of the given profile BUT it may not contains all the matching profiles for the user AND it can contains some other profiles that were not in the given profiles
     */
    public Set<String> hasAnyConnectedAnyAllowedProfile(Set< ? extends Object> rootContexts, Set<String> profileIds);
    
    /**
     * Returns some profiles that are matching if user has the allowed profile for any given root context (or any sub context), given some profiles.<br>Only supported objects are transmitted
     * @param rootContexts The root contexts to search rights for
     * @param user The user to test
     * @param profileIds The ids of the profiles
     * @return If the Set is empty, it means any connected user has no matching profile.<br>
     *         If the Set is non empty, it contains at least one of the given profile BUT it may not contains all the matching profiles for anyconnected user AND it can contains some other profiles that were not in the given profiles
     */   
    public Set<String> hasUserAnyAllowedProfile(Set< ? extends Object> rootContexts, UserIdentity user, Set<String> profileIds);

    /**
     * Returns some profiles that are matching if group has the allowed profile for any given root context (or any sub context), given some profiles.<br>Only supported objects are transmitted
     * @param rootContexts The root contexts to search rights for
     * @param groups The groups to test (a single group needs to match)
     * @param profileIds The ids of the profiles
     * @return If the Set is empty, it means the group has no matching profile.<br>
     *         If the Set is non empty, it contains at least one of the given profile BUT it may not contains all the matching profiles for the group AND it can contains some other profiles that were not in the given profiles
     */
    public Set<String>  hasGroupAnyAllowedProfile(Set< ? extends Object> rootContexts, Set<GroupIdentity> groups, Set<String> profileIds);

    /* -------------- */
    /* GET PERMISSION */
    /* -------------- */
    
    /**
     * Gets the allowed profiles any connected user has on the given object
     * @param object The object
     * @return a map containing allowed/denied profiles that anonymous and any connected user has on the given object
     */
    public Map<AnonymousOrAnyConnectedKeys, Set<String>> getProfilesForAnonymousAndAnyConnectedUser(Object object);
    
    /**
     * Gets the users that have allowed profiles assigned on the given object
     * @param object The object to test 
     * @param user The user to get profiles for. Can be null to get profiles for all users that have rights
     * @return The map of allowed users with their assigned allowed/denied profiles
     */
    public Map<UserIdentity, Map<UserOrGroup, Set<String>>> getProfilesForUsers(Object object, UserIdentity user);
    
    /**
     * Gets the groups that have allowed profiles assigned on the given object
     * @param object The object to test 
     * @param groups The group to get profiles for. Can be null to get profiles for all groups that have rights
     * @return The map of allowed/denied groups with their assigned profiles
     */
    public Map<GroupIdentity, Map<UserOrGroup, Set<String>>> getProfilesForGroups(Object object, Set<GroupIdentity> groups);
    
    /* ------------------------------ */
    /* SUPPORT OF OBJECT AND PRIORITY */
    /* ------------------------------ */
    
    /**
     * Returns true if this profile storage supports the given object, 
     * i.e. if it is able to retrieve the allowed users/groups on that object
     * @param object The object to test
     * @return true if this profile storage supports the given object
     */
    public boolean isSupported(Object object);
    
    /**
     * Returns true if this profile storage supports the given object as a root context 
     * i.e. it can seek any permission under this object
     * @param rootContext The object to start searching
     * @return true if this profile storage support this a as root context to search in
     */
    public boolean isRootContextSupported(Object rootContext);
    
    /**
     * Returns the priority of this profile storage
     * The {@link ProfileAssignmentStorageExtensionPoint} will take the profile storage
     * which supports the object with the highest priority to return the allowed/denied users/groups
     * @return the priority of this profile storage
     */
    public int getPriority();
    
    /* ----------- */
    /* INHERITANCE */
    /* ----------- */
    /**
     * Returns true if the inheritance of permissions is disallowed on the given object
     * @param object The object to test
     * @return true if the inheritance of permissions is disallowed on the given object
     */
    public boolean isInheritanceDisallowed(Object object);
}