/*
 *  Copyright 2016 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.core.right;

import java.io.InputStream;
import java.util.Collections;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Optional;
import java.util.Set;
import java.util.stream.Collectors;

import org.apache.avalon.framework.activity.Initializable;
import org.apache.avalon.framework.component.Component;
import org.apache.avalon.framework.configuration.Configurable;
import org.apache.avalon.framework.configuration.Configuration;
import org.apache.avalon.framework.configuration.ConfigurationException;
import org.apache.avalon.framework.configuration.DefaultConfigurationBuilder;
import org.apache.avalon.framework.context.Context;
import org.apache.avalon.framework.context.ContextException;
import org.apache.avalon.framework.context.Contextualizable;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.avalon.framework.service.Serviceable;
import org.apache.avalon.framework.thread.ThreadSafe;
import org.apache.cocoon.components.ContextHelper;
import org.apache.cocoon.environment.Request;
import org.apache.commons.lang3.StringUtils;
import org.apache.excalibur.source.Source;
import org.apache.excalibur.source.SourceResolver;

import org.ametys.core.cache.AbstractCacheManager;
import org.ametys.core.cache.Cache;
import org.ametys.core.group.GroupDirectoryDAO;
import org.ametys.core.group.GroupIdentity;
import org.ametys.core.group.GroupManager;
import org.ametys.core.right.AccessController.AccessResult;
import org.ametys.core.user.CurrentUserProvider;
import org.ametys.core.user.UserIdentity;
import org.ametys.core.user.UserManager;
import org.ametys.core.user.population.PopulationContextHelper;
import org.ametys.core.user.population.UserPopulationDAO;
import org.ametys.plugins.core.impl.cache.AbstractCacheKey;
import org.ametys.runtime.i18n.I18nizableText;
import org.ametys.runtime.plugin.component.AbstractLogEnabled;

/**
 * Abstraction for testing a right associated with a resource and a user from a single source.
 */
public class RightManager extends AbstractLogEnabled implements Serviceable, Configurable, ThreadSafe, Component, Contextualizable, Initializable
{
    /** For avalon service manager */
    public static final String ROLE = RightManager.class.getName();
    /** The id of the READER profile */
    public static final String READER_PROFILE_ID = "READER";
    
    /** The instance of ObjectUserIdentity for anonymous */
    protected static final UserIdentity __ANONYMOUS_USER_IDENTITY = new UserIdentity(null, null);
    /** The instance of ObjectUserIdentity for any connected user */
    protected static final UserIdentity __ANY_CONNECTED_USER_IDENTITY = new UserIdentity("", "");

    private static final String CACHE_1 = RightManager.class.getName() + "$Cache-1";
    private static final String CACHE_2 = RightManager.class.getName() + "$Cache-2";
    
    /** Avalon ServiceManager */
    protected ServiceManager _manager;
    /** Avalon SourceResolver */
    protected SourceResolver _resolver;
    /** The rights' list container */
    protected RightsExtensionPoint _rightsEP;
    /** The extension point for the Right Context Convertors */
    protected RightContextConvertorExtensionPoint _rightContextConvertorEP;
    /** The extension point for Access Controllers */
    protected AccessControllerExtensionPoint _accessControllerEP;
    /** The user manager */
    protected UserManager _userManager;
    /** The group manager */
    protected GroupManager _groupManager;
    /** The DAO for user populations */
    protected UserPopulationDAO _userPopulationDAO;
    /** The DAO for group directories */
    protected GroupDirectoryDAO _groupDirectoryDAO;
    /** The current user provider */
    protected CurrentUserProvider _currentUserProvider;
    /** The rights DAO */
    protected RightProfilesDAO _profilesDAO;
    /** Cache Manager */
    protected AbstractCacheManager _cacheManager;
    
    private Context _context;
    
    /**
     * Enumeration of all possible values returned by hasRight(user, right, context)
     */
    public enum RightResult
    {
        /**
         * Indicates that a given user has the required right.
         */
        RIGHT_ALLOW,
        
        /**
         * Indicates that a given user does NOT have the required right.
         */
        RIGHT_DENY,
        
        /**
         * Indicates that the system knows nothing about the fact that a given user has a right or not.
         */
        RIGHT_UNKNOWN;
    }
    
    @Override
    public void contextualize(Context context) throws ContextException
    {
        _context = context;
    }
    
    @Override
    public void service(ServiceManager manager) throws ServiceException
    {
        _manager = manager;
        _userManager = (UserManager) manager.lookup(UserManager.ROLE);
        _groupManager = (GroupManager) manager.lookup(GroupManager.ROLE);
        _userPopulationDAO = (UserPopulationDAO) manager.lookup(UserPopulationDAO.ROLE);
        _groupDirectoryDAO = (GroupDirectoryDAO) manager.lookup(GroupDirectoryDAO.ROLE);
        _rightsEP = (RightsExtensionPoint) manager.lookup(RightsExtensionPoint.ROLE);
        _rightContextConvertorEP = (RightContextConvertorExtensionPoint) manager.lookup(RightContextConvertorExtensionPoint.ROLE);
        _accessControllerEP = (AccessControllerExtensionPoint) manager.lookup(AccessControllerExtensionPoint.ROLE);
        _resolver = (SourceResolver) _manager.lookup(SourceResolver.ROLE);
        _currentUserProvider = (CurrentUserProvider) _manager.lookup(CurrentUserProvider.ROLE);
        _cacheManager = (AbstractCacheManager) manager.lookup(AbstractCacheManager.ROLE);
    }

    public void initialize() throws Exception
    {
        _cacheManager.createRequestCache(CACHE_1, 
                new I18nizableText("plugin.core", "PLUGINS_CORE_RIGHT_MANAGER_CACHE_1_LABEL"),
                new I18nizableText("plugin.core", "PLUGINS_CORE_RIGHT_MANAGER_CACHE_1_DESCRIPTION"),
                true);
        _cacheManager.createRequestCache(CACHE_2, 
                new I18nizableText("plugin.core", "PLUGINS_CORE_RIGHT_MANAGER_CACHE_2_LABEL"),
                new I18nizableText("plugin.core", "PLUGINS_CORE_RIGHT_MANAGER_CACHE_2_DESCRIPTION"),
                true);
    }
    
    /**
     * Returns the DAO for profiles
     * @return The DAO 
     */
    protected RightProfilesDAO _getProfileDAO ()
    {
        try
        {
            if (_profilesDAO == null)
            {
                _profilesDAO = (RightProfilesDAO) _manager.lookup(RightProfilesDAO.ROLE);
            }
            return _profilesDAO;
        }
        catch (ServiceException e)
        {
            throw new RuntimeException("Failed to retrieve the DAO for profiles", e);
        }
    }
    
    @Override
    public void configure(Configuration configuration) throws ConfigurationException
    {
        Configuration rightsConfiguration = configuration.getChild("rights");

        String externalFile = rightsConfiguration.getAttribute("config", null);
        if (externalFile != null)
        {
            Source source = null;
            try
            {
                source = _resolver.resolveURI("context://" + externalFile);

                if (source.exists())
                {
                    Configuration externalConfiguration;
                    try (InputStream is = source.getInputStream();)
                    {
                        externalConfiguration = new DefaultConfigurationBuilder().build(is);
                    }

                    configureRights(externalConfiguration);
                }
                else if (getLogger().isInfoEnabled())
                {
                    getLogger().info("The optional external rights file '" + externalFile + "' is missing.");
                }
            }
            catch (Exception e)
            {
                String message = "An error occured while retriving external file '" + externalFile + "'";
                getLogger().error(message, e);
                throw new ConfigurationException(message, configuration, e);
            }
            finally
            {
                if (source != null)
                {
                    _resolver.release(source);
                }
            }
        }
        else
        {
            configureRights(rightsConfiguration);
        }
    }
    
    private void configureRights(Configuration configuration) throws ConfigurationException
    {
        Configuration[] rights = configuration.getChildren("right");
        for (Configuration rightConf : rights)
        {
            String id = rightConf.getAttribute("id", "");

            String label = rightConf.getChild("label").getValue("");
            I18nizableText i18nLabel = new I18nizableText("application", label);

            String description = rightConf.getChild("description").getValue("");
            I18nizableText i18nDescription = new I18nizableText("application", description);

            String category = rightConf.getChild("category").getValue("");
            I18nizableText i18nCategory = new I18nizableText("application", category);

            if (id.length() == 0 || label.length() == 0 || description.length() == 0 || category.length() == 0)
            {
                String message = "Error in " + RightManager.class.getName() + " configuration: attribute 'id' and elements 'label', 'description' and 'category' are mandatory.";
                getLogger().error(message);
                throw new ConfigurationException(message, configuration);
            }

            _rightsEP.addRight(id, i18nLabel, i18nDescription, i18nCategory);
        }
    }
    
    /* --------- */
    /* HAS RIGHT */
    /* --------- */
    
    /**
     * Checks a permission for the current logged user, on a given object (or context).<br>
     * If null, it checks if there is at least one object with this permission
     * @param rightId The name of the right to check. Cannot be null.
     * @param object The object to check the right. Can be null to search on any object.
     * @return {@link RightResult#RIGHT_ALLOW}, {@link RightResult#RIGHT_DENY} or {@link RightResult#RIGHT_UNKNOWN}
     * @throws RightsException if an error occurs.
     */
    public RightResult currentUserHasRight(String rightId, Object object) throws RightsException
    {
        return hasRight(_currentUserProvider.getUser(), rightId, object);
    }
    
    /**
     * Checks a permission for a user, on a given object (or context).<br>
     * If null, it checks if there is at least one object with this permission
     * @param userIdentity The user identity. Can be null for anonymous
     * @param rightId The name of the right to check. Cannot be null.
     * @param object The object to check the right. Can be null to search on any object.
     * @return {@link RightResult#RIGHT_ALLOW}, {@link RightResult#RIGHT_DENY} or {@link RightResult#RIGHT_UNKNOWN}
     * @throws RightsException if an error occurs.
     */
    public RightResult hasRight(UserIdentity userIdentity, String rightId, Object object) throws RightsException
    {
        UserIdentity objectUserIdentity = userIdentity == null ? __ANONYMOUS_USER_IDENTITY : userIdentity;
        
        return _hasRight(objectUserIdentity, rightId, object);
    }
    
    /**
     * Gets the right result for anonymous with given right on given object context
     * @param rightId The id of the right
     * @param object The object to check
     * @return the right result for anonymous with given profile on given object context
     */
    public RightResult hasAnonymousRight(String rightId, Object object)
    {
        return _hasRight(__ANONYMOUS_USER_IDENTITY, rightId, object);
    }

    /**
     * Gets the right result for any connected user with given profile on given object context
     * @param rightId The right id to test
     * @param object The object to check
     * @return the right result for any connected user with given profile on given object context
     */
    public RightResult hasAnyConnectedUserRight(String rightId, Object object)
    {
        return _hasRight(__ANY_CONNECTED_USER_IDENTITY, rightId, object);
    }

    private RightResult _hasRight(UserIdentity userIdentity, String rightId, Object object)
    {
        getLogger().debug("Try to determine if user {} has the right '{}' on the object context {}", userIdentity, rightId, object);

        if (StringUtils.isBlank(rightId))
        {
            throw new RightsException("The rightId cannot be null");
        }

        return _hasRightOrRead(userIdentity, rightId, object);
    }
    
    private RightResult _hasRightOrRead(UserIdentity userIdentity, String rightId, Object object)
    {
        if (object == null)
        {
            return _hasRightOrRead(userIdentity, rightId);
        }
        
        // Try to retrieve in first cache (the one which manages non-null contexts)
        RightResult cacheResult = _hasRightResultInFirstCache(userIdentity, rightId, object);
        if (cacheResult != null)
        {
            return cacheResult;
        }
        
        // Retrieve groups the user belongs to
        Set<GroupIdentity> groups = _getGroups(userIdentity);
        
        // Get the objects to check
        Set<Object> objects = _getConvertedObjects(object, new HashSet<>());
        
        // Retrieve the set of AccessResult
        Set<AccessResult> accessResults = _getAccessResults(userIdentity, groups, rightId, objects);
        
        // Compute access
        AccessResult access = AccessResult.merge(accessResults);
        
        RightResult rightResult = access.toRightResult();
        _putInFirstCache(userIdentity, rightId, object, rightResult);
        
        return rightResult;
    }
    
    /**
     * Has the user/anonymous/anyconnected the non null right on any content of the current workspace?
     * @param userIdentity The user connecter or the value for anonymous or any connected user
     * @param rightId The right id to test. Can be null to test read access
     * @return The computed right result
     */
    private RightResult _hasRightOrRead(UserIdentity userIdentity, String rightId)
    {
        // Resolve contexts
        Set<Object> workspacesContexts = _getConvertedObjects("/${WorkspaceName}", new HashSet<>());
        
        // Try to retrieve in second cache (the one which manages null context)
        RightResult cacheResult = _hasRightResultInSecondCache(workspacesContexts, userIdentity, rightId);
        if (cacheResult != null)
        {
            return cacheResult;
        }
        
        // Retrieve groups the user belongs to
        Set<GroupIdentity> groups = _getGroups(userIdentity);

        RightResult rightResult = RightResult.RIGHT_UNKNOWN;
        for (String controllerId : _accessControllerEP.getExtensionsIds())
        {
            AccessController accessController = _accessControllerEP.getExtension(controllerId);
            try
            {
                if (userIdentity == __ANONYMOUS_USER_IDENTITY)
                {
                    if (rightId == null ? accessController.hasAnonymousAnyReadAccessPermissionOnWorkspace(workspacesContexts) : accessController.hasAnonymousAnyPermissionOnWorkspace(workspacesContexts, rightId))
                    {
                        rightResult = RightResult.RIGHT_ALLOW;
                        break;
                    }
                }
                else if (userIdentity == __ANY_CONNECTED_USER_IDENTITY)
                {
                    if (rightId == null ? accessController.hasAnyConnectedUserAnyReadAccessPermissionOnWorkspace(workspacesContexts) : accessController.hasAnyConnectedUserAnyPermissionOnWorkspace(workspacesContexts, rightId))
                    {
                        rightResult = RightResult.RIGHT_ALLOW;
                        break;
                    }
                }
                else
                {
                    if (rightId == null ? accessController.hasUserAnyReadAccessPermissionOnWorkspace(workspacesContexts, userIdentity, groups) : accessController.hasUserAnyPermissionOnWorkspace(workspacesContexts, userIdentity, groups, rightId))
                    {
                        rightResult = RightResult.RIGHT_ALLOW;
                        break;
                    }
                }
            }
            catch (Exception e)
            {
                getLogger().error("An error occured with controller '{}'. Thus, this controller will be ignored.", controllerId, e);
            }
        }
        
        getLogger().debug("Right result found for [{}, {}, {}] => {}", workspacesContexts, userIdentity, rightId, rightResult);
        _putInSecondCache(workspacesContexts, userIdentity, rightId, rightResult);
        return rightResult;
    }
    
    private Set<AccessResult> _getAccessResults(UserIdentity userIdentity, Set<GroupIdentity> groups, String rightId, Set<Object> objects)
    {
        Set<AccessResult> accessResults = new HashSet<>();
        for (Object obj : objects)
        {
            for (String controllerId : _accessControllerEP.getExtensionsIds())
            {
                AccessController accessController = _accessControllerEP.getExtension(controllerId);
                try
                {
                    if (accessController.isSupported(obj))
                    {
                        if (userIdentity == __ANONYMOUS_USER_IDENTITY)
                        {
                            accessResults.add(rightId == null ? accessController.getReadAccessPermissionForAnonymous(obj) : accessController.getPermissionForAnonymous(rightId, obj));
                        }
                        else if (userIdentity == __ANY_CONNECTED_USER_IDENTITY)
                        {
                            accessResults.add(rightId == null ? accessController.getReadAccessPermissionForAnyConnectedUser(obj) : accessController.getPermissionForAnyConnectedUser(rightId, obj));
                        }
                        else
                        {
                            accessResults.add(rightId == null ? accessController.getReadAccessPermission(userIdentity, groups, obj) : accessController.getPermission(userIdentity, groups, rightId, obj));
                        }
                    }
                    else
                    {
                        accessResults.add(AccessResult.UNKNOWN);
                    }
                }
                catch (Exception e)
                {
                    getLogger().error("An error occured with controller '{}' for object {}. Thus, this controller will be ignored.", controllerId, obj, e);
                }
            }
        }
        
        return accessResults;
    }
    
    /* --------------- */
    /* HAS READ ACCESS */
    /* --------------- */
    
    /**
     * Returns true if the current user has READ access on the given object
     * @param object The object to check the right. Can be null to search on any object.
     * @return true if the given user has READ access on the given object
     */
    public boolean currentUserHasReadAccess(Object object)
    {
        return hasReadAccess(_currentUserProvider.getUser(), object);
    }

    /**
     * Returns true if the given user has READ access on the given object
     * @param userIdentity The user identity. Cannot be null.
     * @param object The object to check the right. Can be null to search on any object.
     * @return true if the given user has READ access on the given object
     */
    public boolean hasReadAccess(UserIdentity userIdentity, Object object)
    {
        UserIdentity objectUserIdentity = userIdentity == null ? __ANONYMOUS_USER_IDENTITY : userIdentity;

        return _hasRightOrRead(objectUserIdentity, null, object) == RightResult.RIGHT_ALLOW;
    }
    
    /**
     * Returns true if the object is not restricted, i.e. an anonymous user has READ access (is allowed) on the object
     * @param object The object to check. Cannot be null
     * @return true if the object is restricted, i.e. an anonymous user has READ access (is allowed) on the object
     */
    public boolean hasAnonymousReadAccess(Object object)
    {
        return _hasRightOrRead(__ANONYMOUS_USER_IDENTITY, null, object) == RightResult.RIGHT_ALLOW;
    }
    
    /**
     * Returns true if any connected user has READ access allowed on the object
     * @param object The object to check. Cannot be null
     * @return true if any connected user has READ access allowed on the object
     */
    public boolean hasAnyConnectedUserReadAccess(Object object)
    {
        return _hasRightOrRead(__ANY_CONNECTED_USER_IDENTITY, null, object) == RightResult.RIGHT_ALLOW;
    }
    
    /* ------------- */
    /* ALLOWED USERS */
    /* ------------- */

    /**
     * Get the list of users that have a particular right in a particular context.
     * @param rightId The name of the right to check. Cannot be null.
     * @param object The object to check the right. Cannot be null.
     * @return The list of users allowed with that right as a Set of String (user identities).
     * @throws RightsException if an error occurs.
     */
    public AllowedUsers getAllowedUsers(String rightId, Object object)
    {
        if (StringUtils.isBlank(rightId))
        {
            throw new RightsException("The rightId cannot be null");
        }

        return _getAllowedUsers(rightId, object);
    }
    
    /**
     * Get the users with a READ access on given object
     * @param object The object
     * @return The representation of allowed users 
     */
    public AllowedUsers getReadAccessAllowedUsers(Object object)
    {
        return _getAllowedUsers(null, object);
    }
    
    private AllowedUsers _getAllowedUsers(String rightId, Object object)
    {
        Optional.ofNullable(object).orElseThrow(() -> 
        {
            return new RightsException("The object cannot be null");
        });
        
        // Get the objects to check
        Set<Object> objects = _getConvertedObjects(object, new HashSet<>());
        
        // For each object, retrieve the allowed and denied users/groups
        Boolean isAnyConnectedAllowed = null; // unknown
        Set<UserIdentity> allAllowedUsers = new HashSet<>();
        Set<UserIdentity> allDeniedUsers = new HashSet<>();
        Set<GroupIdentity> allAllowedGroups = new HashSet<>();
        Set<GroupIdentity> allDeniedGroups = new HashSet<>();
        
        for (Object obj : objects)
        {
            for (String controllerId : _accessControllerEP.getExtensionsIds())
            {
                AccessController accessController = _accessControllerEP.getExtension(controllerId);
                try
                {
                    if (accessController.isSupported(obj))
                    {
                        if ((rightId == null ? accessController.getReadAccessPermissionForAnonymous(obj) : accessController.getPermissionForAnonymous(rightId, obj)) == AccessResult.ANONYMOUS_ALLOWED)
                        {
                            // Any anonymous user is allowed
                            return new AllowedUsers(true, false, null, null, null, null, _userManager, _groupManager, null);
                        }
                        
                        AccessResult permissionForAnyConnectedUser = rightId == null ? accessController.getReadAccessPermissionForAnyConnectedUser(obj) : accessController.getPermissionForAnyConnectedUser(rightId, obj);
                        if (permissionForAnyConnectedUser == AccessResult.ANY_CONNECTED_DENIED)
                        {
                            // For having any connected user allowed, you need to not have the denied access for one object
                            isAnyConnectedAllowed = Boolean.FALSE;
                        }
                        else if (isAnyConnectedAllowed == null && permissionForAnyConnectedUser == AccessResult.ANY_CONNECTED_ALLOWED)
                        {
                            isAnyConnectedAllowed = Boolean.TRUE;
                        }
                        
                        Map<UserIdentity, AccessResult> permissionsByUser = rightId == null ? accessController.getReadAccessPermissionByUser(obj) : accessController.getPermissionByUser(rightId, obj);
                        
                        Set<UserIdentity> allowedUsersOnObj = permissionsByUser.entrySet().stream()
                                .filter(entry -> AccessResult.USER_ALLOWED.equals(entry.getValue()))
                                .map(Entry::getKey)
                                .collect(Collectors.toSet());
                        allAllowedUsers.addAll(allowedUsersOnObj);
                        
                        Set<UserIdentity> deniedUsersOnObj = permissionsByUser.entrySet().stream()
                                .filter(entry -> AccessResult.USER_DENIED.equals(entry.getValue()))
                                .map(Entry::getKey)
                                .collect(Collectors.toSet());
                        allDeniedUsers.addAll(deniedUsersOnObj);
                        
                        
                        Map<GroupIdentity, AccessResult> permissionsByGroup = rightId == null ? accessController.getReadAccessPermissionByGroup(obj) : accessController.getPermissionByGroup(rightId, obj);
                        
                        Set<GroupIdentity> allowedGroupsOnObj = permissionsByGroup.entrySet().stream()
                                .filter(entry -> AccessResult.GROUP_ALLOWED.equals(entry.getValue()))
                                .map(Entry::getKey)
                                .collect(Collectors.toSet());
                        allAllowedGroups.addAll(allowedGroupsOnObj);
                        
                        Set<GroupIdentity> deniedGroupsOnObj = permissionsByGroup.entrySet().stream()
                                .filter(entry -> AccessResult.GROUP_DENIED.equals(entry.getValue()))
                                .map(Entry::getKey)
                                .collect(Collectors.toSet());
                        allDeniedGroups.addAll(deniedGroupsOnObj);
                    }
                }
                catch (Exception e)
                {
                    getLogger().error("An error occured with controller '{}' for object {}. Thus, this controller will be ignored.", controllerId, obj, e);
                }
            }
        }
        
        Request request = ContextHelper.getRequest(_context);
        @SuppressWarnings("unchecked")
        List<String> populationContexts = (List<String>) request.getAttribute(PopulationContextHelper.POPULATION_CONTEXTS_REQUEST_ATTR);
        
        // Then, return the AllowedUsers object
        return new AllowedUsers(false, isAnyConnectedAllowed != null && isAnyConnectedAllowed.booleanValue(), allAllowedUsers, allDeniedUsers, allAllowedGroups, allDeniedGroups, _userManager, _groupManager, populationContexts != null ? new HashSet<>(populationContexts) : new HashSet<>());
    }
    
    /* --------------- */
    /* GET USER RIGHTS */
    /* --------------- */
    
    /**
     * Get the list of rights a user is allowed, on a particular object.
     * @param userIdentity the user identity. Cannot be null.
     * @param object The object to check the right. Cannot be null.
     * @return The list of rights as a Set of String (id).
     * @throws RightsException if an error occurs.
     */
    public Set<String> getUserRights(UserIdentity userIdentity, Object object) throws RightsException
    {
        if (userIdentity == null)
        {
            throw new RightsException("The userIdentity cannot be null");
        }
        else if (object == null)
        {
            throw new RightsException("The object cannot be null");
        }
        
        // Get the objects to check
        Set<Object> objects = _getConvertedObjects(object, new HashSet<>());
        
        // Retrieve groups the user belongs to
        Set<GroupIdentity> groups = _groupManager.getUserGroups(userIdentity);
        
        // Gets the access by rights
        Map<String, AccessResult> accessResultsByRight = _getAccessResultByRight(userIdentity, groups, objects);
        
        // Keep only positive rights
        Set<String> allowedRights = accessResultsByRight.entrySet().stream().filter(entry -> entry.getValue().toRightResult() == RightResult.RIGHT_ALLOW).map(entry -> entry.getKey()).collect(Collectors.toSet());
        return allowedRights;
    }
    
    /**
     * clear all caches related to RightManager and AccesControllers
     */
    public void clearCaches()
    {
        Request request = ContextHelper.getRequest(_context);

        Enumeration<String> attrNames = request.getAttributeNames();
        while (attrNames.hasMoreElements())
        {
            String attrName = attrNames.nextElement();
            if (attrName != null && attrName.startsWith(AbstractCacheManager.ROLE + "$" + RightManager.ROLE + "$"))
            {
                Cache cache = (Cache) request.getAttribute(attrName);
                if (cache != null)
                {
                    cache.invalidateAll();
                }
            }
        }
    }
    
    private Map<String, AccessResult> _getAccessResultByRight(UserIdentity userIdentity, Set<GroupIdentity> groups, Set<Object> objects)
    {
        Map<String, AccessResult> result = new HashMap<>();
        
        for (Object obj : objects)
        {
            for (String controllerId : _accessControllerEP.getExtensionsIds())
            {
                AccessController accessController = _accessControllerEP.getExtension(controllerId);
                try
                {
                    if (accessController.isSupported(obj))
                    {
                        // Update the result map
                        Map<String, AccessResult> permissionsByRight = accessController.getPermissionByRight(userIdentity, groups, obj);
                        for (String rightId : permissionsByRight.keySet())
                        {
                            result.put(rightId, AccessResult.merge(result.get(rightId), permissionsByRight.get(rightId)));
                        }
                    }
                }
                catch (Exception e)
                {
                    getLogger().error("An error occured with controller '{}' for object {}. Thus, this controller will be ignored.", controllerId, obj, e);
                }
            }
        }
        
        return result;
    }

    /* ------- */
    /* PRIVATE */
    /* ------- */
    
    private Set<Object> _getConvertedObjects(Object object, Set<Object> alreadyHandledObjects)
    {
        Set<Object> finalObjects = new HashSet<>();
        
        if (!alreadyHandledObjects.contains(object))
        {
            alreadyHandledObjects.add(object);
            
            Set<Object> objects = _rightContextConvertorEP.getExtensionsIds().stream()
                    .map(_rightContextConvertorEP::getExtension)
                    .flatMap(convertor -> convertor.convert(object).stream())
                    .collect(Collectors.toSet());
            
            finalObjects.addAll(objects);
            finalObjects.add(object);
    
            for (Object convertedObject : objects)
            {
                finalObjects.addAll(_getConvertedObjects(convertedObject, alreadyHandledObjects));
            }
        }
        
        return finalObjects;
    }
    
    private Set<GroupIdentity> _getGroups(UserIdentity userIdentity)
    {
        if (userIdentity == __ANONYMOUS_USER_IDENTITY || userIdentity == __ANY_CONNECTED_USER_IDENTITY)
        {
            return Collections.EMPTY_SET;
        }
        else
        {
            Set<GroupIdentity> userGroups = _groupManager.getUserGroups(userIdentity);
            return userGroups;
        }
    }

    
    
    private RightResult _hasRightResultInFirstCache(UserIdentity userIdentity, String rightId, Object object)
    {

        Cache<Cache1Key, RightResult> mapCache = _cacheManager.get(CACHE_1);
        Cache1Key key = Cache1Key.of(userIdentity, rightId, object);
        if (mapCache.hasKey(key))
        {
            RightResult cacheResult = mapCache.get(key);
            getLogger().debug("Find entry in cache for [{}, {}, {}] => {}", userIdentity, rightId, object, cacheResult);
            return cacheResult;
        }
        getLogger().debug("Did not find entry in cache for [{}, {}, {}]", userIdentity, rightId, object);
        return null;
    }
    
    private void _putInFirstCache(UserIdentity userIdentity, String rightId, Object object, RightResult rightResult)
    {
        Cache<Cache1Key, RightResult> mapCache = _cacheManager.get(CACHE_1);
        if (mapCache != null)
        {
            mapCache.put(Cache1Key.of(userIdentity, rightId, object), rightResult);
        }
    }
    
    private RightResult _hasRightResultInSecondCache(Set<Object> workspacesContexts, UserIdentity userIdentity, String rightId)
    {
        Cache<Cache2Key, RightResult> mapCache = _cacheManager.get(CACHE_2);
        Cache2Key key = Cache2Key.of(userIdentity, rightId, workspacesContexts);
        if (mapCache != null)
        {
            if (mapCache.hasKey(key))
            {
                RightResult cacheResult = mapCache.get(key);
                getLogger().debug("Find entry in cache2 for [{}, {}, {}] => {}", workspacesContexts, userIdentity, rightId, cacheResult);
                return cacheResult;
            }
        }
        
        getLogger().debug("Did not find entry in cache2 for [{}, {}, {}]", workspacesContexts, userIdentity, rightId);
        return null;
    }
    
    private void _putInSecondCache(Set<Object> workspacesContexts, UserIdentity userIdentity, String rightId, RightResult rightResult)
    {
        Cache<Cache2Key, RightResult> mapCache = _cacheManager.get(CACHE_2);

        if (mapCache != null)
        {
            mapCache.put(Cache2Key.of(userIdentity, rightId, workspacesContexts), rightResult);
        }
        
    }

    static class Cache1Key extends AbstractCacheKey
    {
        Cache1Key(UserIdentity userIdentity, String rightId, Object object)
        {
            super(userIdentity, rightId, object);
        }

        static Cache1Key of(UserIdentity userIdentity, String rightId, Object object)
        {
            return new Cache1Key(userIdentity, StringUtils.defaultString(rightId), object);
        } 
        
    }
    static class Cache2Key extends AbstractCacheKey
    {
        Cache2Key(UserIdentity userIdentity, String rightId, Set<Object> workspacesContexts)
        {
            super(userIdentity, rightId, workspacesContexts);
        }

        static Cache2Key of(UserIdentity userIdentity, String rightId, Set<Object> workspacesContexts)
        {
            return new Cache2Key(userIdentity, StringUtils.defaultString(rightId), workspacesContexts);
        } 
        
    }
}