/*
 *  Copyright 2016 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.plugins.core.impl.right;

import java.util.HashMap;
import java.util.Map;
import java.util.Set;

import org.ametys.core.group.GroupIdentity;
import org.ametys.core.right.AccessController;
import org.ametys.core.user.UserIdentity;

/**
 * Abstract {@link AccessController} for a hierarchical type of object. 
 * @param <T> The class of a supported object, from which you can retrieve its parent with {@link #_getParents(Object)}
 */
public abstract class AbstractHierarchicalAccessController<T> extends AbstractProfileStorageBasedAccessController
{
    /**
     * Gets the parents of the object. Must return null when the object is the "root" (where "root" means here the root of the hierarchy of the access controller)
     * @param object The object
     * @return the parents of the object, or null if the object is the "root" of the hierarchy
     */
    protected abstract Set<T> _getParents(T object);
    
    /**
     * Determines if the inheritance of permissions is disallowed on the given object
     * @param object The object
     * @return true if the inheritance of permissions is disallowed on the given object
     */
    protected boolean isInheritanceDisallowed(T object)
    {
        return _profileAssignmentStorageEP.isInheritanceDisallowed(object);
    }
    
    @Override
    public Map<String, AccessResult> getPermissionByRight(UserIdentity user, Set<GroupIdentity> userGroups, Object object)
    {
        Map<String, AccessResult> permissions = super.getPermissionByRight(user, userGroups, object);
        
        @SuppressWarnings("unchecked")
        boolean inheritanceDisallowed = isInheritanceDisallowed((T) object);
        if (!inheritanceDisallowed)
        {
            @SuppressWarnings("unchecked")
            Set<T> parents = _getParents((T) object);
            if (parents != null && !_profileAssignmentStorageEP.isInheritanceDisallowed(object))
            {
                // Determine parents permissions
                Map<String, AccessResult> parentsPermissions = new HashMap<>();
                for (T parent : parents)
                {
                    Map<String, AccessResult> parentPermissions = getPermissionByRight(user, userGroups, parent);
                    for (String rightId : parentPermissions.keySet())
                    {
                        parentsPermissions.put(rightId, AccessResult.merge(parentPermissions.get(rightId), parentsPermissions.get(rightId)));
                    }
                }
                
                // Apply it to local permission
                for (String rightId : parentsPermissions.keySet())
                {
                    if (!permissions.containsKey(rightId) || permissions.get(rightId) == AccessResult.UNKNOWN)
                    {
                        permissions.put(rightId, parentsPermissions.get(rightId));
                    }
                }
            }
        }
        
        return permissions;
    }

    @SuppressWarnings("unchecked")
    @Override
    protected AccessResult _getPermission(UserIdentity user, Set<GroupIdentity> userGroups, Set<String> profilesIds, Object object, Object convertedObject)
    {
        // Let's manage the cache by ourselves, to avoid useless call to #_getParents
        // Try to retrieve in second cache (do not delegate the cache reading to the superclass because we known the unknown result is final
        Map<UserIdentity, AccessResult> cacheResult = (Map<UserIdentity, AccessResult>) _hasRightResultInSecondCache(convertedObject, profilesIds, CacheKind.USER);
        if (cacheResult != null && cacheResult.containsKey(user))
        {
            return cacheResult.get(user);
        }

        AccessResult permission = super._getPermission(user, userGroups, profilesIds, object, convertedObject);
        
        boolean inheritanceDisallowed = isInheritanceDisallowed((T) object);
        
        if (permission == AccessResult.UNKNOWN && !inheritanceDisallowed)
        {
            Set<T> parents = _getParents((T) object);
            if (parents != null)
            {
                for (T parent : parents)
                {
                    Object convertedParentObject = _convertContext(parent);
                    AccessResult parentResult = _getPermission(user, userGroups, profilesIds, parent, convertedParentObject);
                    permission = AccessResult.merge(permission, parentResult);
                }
                
                if (permission != AccessResult.UNKNOWN)
                {
                    if (cacheResult == null)
                    {
                        cacheResult = (Map<UserIdentity, AccessResult>) _hasRightResultInSecondCache(convertedObject, profilesIds, CacheKind.USER);
                        cacheResult = cacheResult == null ? new HashMap<>() : cacheResult;
                    }
                    cacheResult.put(user, permission);
                    _putInSecondCache(profilesIds, convertedObject, cacheResult, CacheKind.USER);
                }
            }
        }
        
        return permission;
    }
    
    @Override
    protected AccessResult _getPermissionForAnonymous(Set<String> profilesIds, Object object, Object convertedObject)
    {
        // Let's manage the cache by ourselves, to avoid useless call to #_getParents
        // Try to retrieve in second cache (do not delegate the cache reading to the superclass because we known the unknown result is final
        AccessResult cacheResult = (AccessResult) _hasRightResultInSecondCache(convertedObject, profilesIds, CacheKind.ANONYMOUS);
        if (cacheResult != null)
        {
            return cacheResult;
        }

        AccessResult permission = super._getPermissionForAnonymous(profilesIds, object, convertedObject);
        
        @SuppressWarnings("unchecked")
        boolean inheritanceDisallowed = isInheritanceDisallowed((T) object);
        
        if (permission == AccessResult.UNKNOWN && !inheritanceDisallowed)
        {
            @SuppressWarnings("unchecked")
            Set<T> parents = _getParents((T) object);
            if (parents != null)
            {
                for (T parent : parents)
                {
                    Object convertedParentObject = _convertContext(parent);
                    AccessResult parentResult = _getPermissionForAnonymous(profilesIds, parent, convertedParentObject);
                    permission = AccessResult.merge(permission, parentResult);
                }
                
                if (permission != AccessResult.UNKNOWN)
                {
                    // LET'S ADD THE ANSWER TO THE CACHE... because #_getParents can be long to execute
                    _putInSecondCache(profilesIds, convertedObject, permission, CacheKind.ANONYMOUS);
                }
            }
        }

        return permission;
    }
    
    @Override
    protected AccessResult _getPermissionForAnyConnectedUser(Set<String> profilesIds, Object object, Object convertedObject)
    {
        // Let's manage the cache by ourselves, to avoid useless call to #_getParents
        // Try to retrieve in second cache (do not delegate the cache reading to the superclass because we known the unknown result is final
        AccessResult cacheResult = (AccessResult) _hasRightResultInSecondCache(convertedObject, profilesIds, CacheKind.ANY_CONNECTED_USER);
        if (cacheResult != null)
        {
            return cacheResult;
        }
        
        AccessResult permission = super._getPermissionForAnyConnectedUser(profilesIds, object, convertedObject);
        
        @SuppressWarnings("unchecked")
        boolean inheritanceDisallowed = isInheritanceDisallowed((T) object);
        
        if (permission == AccessResult.UNKNOWN && !inheritanceDisallowed)
        {
            @SuppressWarnings("unchecked")
            Set<T> parents = _getParents((T) object);
            if (parents != null)
            {
                for (T parent : parents)
                {
                    Object convertedParentObject = _convertContext(parent);
                    AccessResult parentResult = _getPermissionForAnyConnectedUser(profilesIds, parent, convertedParentObject);
                    permission = AccessResult.merge(permission, parentResult);
                }
                
                if (permission != AccessResult.UNKNOWN)
                {
                    // LET'S ADD THE ANSWER TO THE CACHE... because #_getParents can be long to execute
                    _putInSecondCache(profilesIds, convertedObject, permission, CacheKind.ANY_CONNECTED_USER);
                }
            }
        }

        return permission;
    }

    @Override
    protected Map<UserIdentity, AccessResult> _getPermissionByUser(Set<String> profilesIds, Object object, Object convertedObject)
    {
        // Let's manage the cache by ourselves, to avoid useless call to #_getParents
        // Try to retrieve in second cache (do not delegate the cache reading to the superclass because we known the unknown result is final
        @SuppressWarnings("unchecked")
        Map<UserIdentity, AccessResult> cacheResult = (Map<UserIdentity, AccessResult>) _hasRightResultInSecondCache(convertedObject, profilesIds, CacheKind.USERS);
        if (cacheResult != null)
        {
            return cacheResult;
        }

        Map<UserIdentity, AccessResult> permissions = super._getPermissionByUser(profilesIds, object, convertedObject);
        
        @SuppressWarnings("unchecked")
        boolean inheritanceDisallowed = isInheritanceDisallowed((T) object);
        if (!inheritanceDisallowed)
        {
            @SuppressWarnings("unchecked")
            Set<T> parents = _getParents((T) object);
            if (parents != null)
            {
                // Determine parents permissions
                Map<UserIdentity, AccessResult> parentsPermissions = new HashMap<>();
                for (T parent : parents)
                {
                    Object convertedParentObject = _convertContext(parent);
                    Map<UserIdentity, AccessResult> parentPermissions = _getPermissionByUser(profilesIds, parent, convertedParentObject);
                    for (UserIdentity user : parentPermissions.keySet())
                    {
                        parentsPermissions.put(user, AccessResult.merge(parentPermissions.get(user), parentsPermissions.get(user)));
                    }
                }
                
                // Apply it to local permission
                for (UserIdentity user : parentsPermissions.keySet())
                {
                    if (!permissions.containsKey(user) || permissions.get(user) == AccessResult.UNKNOWN)
                    {
                        permissions.put(user, parentsPermissions.get(user));
                    }
                }
            }
        }
        
        _putInSecondCache(profilesIds, convertedObject, permissions, CacheKind.USERS);

        return permissions;
    }

    @Override
    protected Map<GroupIdentity, AccessResult> _getPermissionByGroup(Set<String> profilesIds, Object object, Object convertedObject)
    {
        // Let's manage the cache by ourselves, to avoid useless call to #_getParents
        // Try to retrieve in second cache (do not delegate the cache reading to the superclass because we known the unknown result is final
        @SuppressWarnings("unchecked")
        Map<GroupIdentity, AccessResult> cacheResult = (Map<GroupIdentity, AccessResult>) _hasRightResultInSecondCache(convertedObject, profilesIds, CacheKind.GROUPS);
        if (cacheResult != null)
        {
            return cacheResult;
        }

        Map<GroupIdentity, AccessResult> permissions = super._getPermissionByGroup(profilesIds, object, convertedObject);
        
        @SuppressWarnings("unchecked")
        boolean inheritanceDisallowed = isInheritanceDisallowed((T) object);
        if (!inheritanceDisallowed)
        {
            @SuppressWarnings("unchecked")
            Set<T> parents = _getParents((T) object);
            if (parents != null)
            {
                // Determine parents permissions
                Map<GroupIdentity, AccessResult> parentsPermissions = new HashMap<>();
                for (T parent : parents)
                {
                    Object convertedParentObject = _convertContext(parent);
                    Map<GroupIdentity, AccessResult> parentPermissions = _getPermissionByGroup(profilesIds, parent, convertedParentObject);
                    for (GroupIdentity group : parentPermissions.keySet())
                    {
                        parentsPermissions.put(group, AccessResult.merge(parentPermissions.get(group), parentsPermissions.get(group)));
                    }
                }
                
                // Apply it to local permission
                for (GroupIdentity group : parentsPermissions.keySet())
                {
                    if (!permissions.containsKey(group) || permissions.get(group) == AccessResult.UNKNOWN)
                    {
                        permissions.put(group, parentsPermissions.get(group));
                    }
                }
            }
        }
        
        _putInSecondCache(profilesIds, convertedObject, permissions, CacheKind.GROUPS);

        return permissions;
    }
}