/*
 *  Copyright 2016 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.core.ui.right;

import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.Optional;
import java.util.Set;
import java.util.stream.Collectors;

import org.apache.avalon.framework.configuration.Configuration;
import org.apache.avalon.framework.configuration.ConfigurationException;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;

import org.ametys.core.ObservationConstants;
import org.ametys.core.group.GroupDirectoryDAO;
import org.ametys.core.group.GroupIdentity;
import org.ametys.core.group.GroupManager;
import org.ametys.core.observation.Event;
import org.ametys.core.observation.ObservationManager;
import org.ametys.core.right.Profile;
import org.ametys.core.right.ProfileAssignmentStorage.AnonymousOrAnyConnectedKeys;
import org.ametys.core.right.ProfileAssignmentStorage.UserOrGroup;
import org.ametys.core.right.ProfileAssignmentStorageExtensionPoint;
import org.ametys.core.right.RightAssignmentContext;
import org.ametys.core.right.RightAssignmentContextExtensionPoint;
import org.ametys.core.right.RightManager;
import org.ametys.core.right.RightManager.RightResult;
import org.ametys.core.right.RightProfilesDAO;
import org.ametys.core.right.RightsException;
import org.ametys.core.ui.Callable;
import org.ametys.core.ui.ClientSideElement;
import org.ametys.core.ui.ClientSideElementHelper;
import org.ametys.core.ui.StaticClientSideElement;
import org.ametys.core.user.UserIdentity;
import org.ametys.plugins.core.user.UserHelper;

/**
 * {@link ClientSideElement} for the tool displaying the profile assignments
 */
public class ProfileAssignmentsToolClientSideElement extends StaticClientSideElement
{
    /** The profile assignment storage component */
    protected ProfileAssignmentStorageExtensionPoint _profileAssignmentStorageEP;
    /** The extension point for right assignment contexts */
    protected RightAssignmentContextExtensionPoint _rightAssignmentContextEP;
    /** The DAO for group directories */
    protected GroupDirectoryDAO _groupDirectoryDAO;
    /** The group manager */
    protected GroupManager _groupManager;
    /** The observation manager */
    protected ObservationManager _observationManager;
    /** The user helper */
    protected UserHelper _userHelper;
    /** The profile DAO */
    protected RightProfilesDAO _profileDAO;
    
    /** The list of right contexts id handle by the tool */
    private Set<String> _rightContexts;
    private boolean _readerProfileOnly;
    
    /**
     * Enumeration of all possible access types
     */
    public enum AccessType
    {
        /**
         * Indicates that the access is allowed
         */
        ALLOW 
        {
            @Override
            public String toString()
            {
                return "allow";
            }
        },
        /**
         * Indicates that the access is denied
         */
        DENY 
        {
            @Override
            public String toString()
            {
                return "deny";
            }
        },
        /**
         * Indicates that the access is allowed by inheritance
         */
        INHERITED_ALLOW 
        {
            @Override
            public String toString()
            {
                return "inherited_allow";
            }
        },
        /**
         * Indicates that the access is denied by inheritance
         */
        INHERITED_DENY 
        {
            @Override
            public String toString()
            {
                return "inherited_deny";
            }
        },
        /**
         * Indicates that the access can not be determined
         */
        UNKNOWN 
        {
            @Override
            public String toString()
            {
                return "unknown";
            }
        }
    }
    
    /**
     * Enumeration of all possible target types
     */
    public enum TargetType 
    {
        /**
         * Indicates that the target is the anonymous user
         */
        ANONYMOUS 
        {
            @Override
            public String toString()
            {
                return "anonymous";
            }
        },
        /**
         * Indicates that the target is the anonymous user
         */
        ANYCONNECTED_USER 
        {
            @Override
            public String toString()
            {
                return "anyconnected_user";
            }
        },
        /**
         * Indicates that the target is a user
         */
        USER 
        {
            @Override
            public String toString()
            {
                return "user";
            }
        },
        /**
         * Indicates that the target is a group
         */
        GROUP 
        {
            @Override
            public String toString()
            {
                return "group";
            }
        }
    }

    @Override
    public void service(ServiceManager smanager) throws ServiceException
    {
        super.service(smanager);
        _profileAssignmentStorageEP = (ProfileAssignmentStorageExtensionPoint) smanager.lookup(ProfileAssignmentStorageExtensionPoint.ROLE);
        _rightAssignmentContextEP = (RightAssignmentContextExtensionPoint) smanager.lookup(RightAssignmentContextExtensionPoint.ROLE);
        _groupDirectoryDAO = (GroupDirectoryDAO) smanager.lookup(GroupDirectoryDAO.ROLE);
        _groupManager = (GroupManager) smanager.lookup(GroupManager.ROLE);
        _observationManager = (ObservationManager) smanager.lookup(ObservationManager.ROLE);
        _userHelper = (UserHelper) smanager.lookup(UserHelper.ROLE);
        _profileDAO = (RightProfilesDAO) smanager.lookup(RightProfilesDAO.ROLE);
    }
    
    @Override
    public void configure(Configuration configuration) throws ConfigurationException
    {
        super.configure(configuration);
        
        _configureRightContextIds(configuration);
        
        _readerProfileOnly = configuration.getChild("class").getChild("reader-profile-only").getValueAsBoolean(false);
    }
    
    /**
     * Configure the restricted right context ids
     * @param configuration the global configuration
     * @throws ConfigurationException The configuration is incorrect
     */
    protected void _configureRightContextIds(Configuration configuration) throws ConfigurationException
    {
        _rightContexts = new HashSet<>();
        
        Configuration[] rightCtxConfig = configuration.getChild("class").getChild("right-contexts").getChildren("right-context");
        
        for (Configuration conf : rightCtxConfig)
        {
            _rightContexts.add(conf.getValue());
        }
    }
    
    /**
     * Get the right assignments contexts handled by this tool
     * @return the right assignments contexts
     */
    protected Set<RightAssignmentContext> getRightAssignmentContexts()
    {
        if (!_rightContexts.isEmpty())
        {
            return _rightContexts
                    .stream()
                    .map(id -> _rightAssignmentContextEP.getExtension(id))
                    .filter(Objects::nonNull)
                    .collect(Collectors.toSet());
        }
        else
        {
            // No restriction on handle contexts, get all contexts except private contexts
            return _rightAssignmentContextEP.getExtensionsIds()
                    .stream()
                    .map(id -> _rightAssignmentContextEP.getExtension(id))
                    .filter(ctx -> !ctx.isPrivate())
                    .collect(Collectors.toSet());
        }
    }
    
    @Override
    public List<Script> getScripts(boolean ignoreRights, Map<String, Object> contextParameters)
    {
        List<Script> scripts = super.getScripts(ignoreRights, contextParameters);
        
        if (scripts.size() > 0)
        {
            Script script = ClientSideElementHelper.cloneScript(scripts.get(0));
            
            Map<String, Object> jsClasses = new HashMap<>();
            script.getParameters().put("classes", jsClasses);
            
            Set<RightAssignmentContext> rightAssignmentContexts = getRightAssignmentContexts();
            for (RightAssignmentContext rightAssignmentContext : rightAssignmentContexts)
            {
                List<Script> rightAssignmentContextScripts = rightAssignmentContext.getScripts(ignoreRights, contextParameters);
                int index = 0;
                for (Script rightAssignmentContextScript: rightAssignmentContextScripts)
                {
                    Map<String, Object> classInfo = new HashMap<>();
                    classInfo.put("className", rightAssignmentContextScript.getScriptClassname());
                    classInfo.put("serverId", rightAssignmentContext.getId());
                    classInfo.put("parameters", rightAssignmentContextScript.getParameters());
                    jsClasses.put(rightAssignmentContext.getId() + "-" + index++, classInfo);
                    
                    script.getScriptFiles().addAll(rightAssignmentContextScript.getScriptFiles());
                    script.getCSSFiles().addAll(rightAssignmentContextScript.getCSSFiles());
                }
            }
            
            scripts = new ArrayList<>();
            scripts.add(script);
        }
        
        return scripts;
    }
    
    /**
     * Gets the groups of a user as JSON
     * @param login The login of the user
     * @param populationId The population of the user
     * @return the groups of a user as JSON
     */
    @Callable
    public List<Map<String, Object>> getUserGroups(String login, String populationId)
    {
        return _groupManager.getUserGroups(new UserIdentity(login, populationId)).stream()
            .map(this::_groupToJson)
            .collect(Collectors.toList());
    }
    
    private Map<String, Object> _groupToJson(GroupIdentity groupIdentity)
    {
        Map<String, Object> result = new HashMap<>();
        result.put("groupId", groupIdentity.getId());
        result.put("groupDirectory", groupIdentity.getDirectoryId());
        return result;
    }
    
    /**
     * Save some changes made client-side.
     * @param rightAssignmentCtxId The id of the right assignment context
     * @param jsContext The JS object context
     * @param assignmentsInfo The list of all the changes to make. Each map in the list must contain the following keys:
     * <ol>
     * <li><b>profileId</b> for the id of the profile (as a string)</li>
     * <li><b>assignment</b> for the kind of assignment (can be ACCESS_TYPE_ALLOW, ACCESS_TYPE_DENY...)</li>
     * <li><b>assignmentType</b> expects one of these four strings: "user", "group", "anonymous", "anyConnectedUser"</li>
     * <li><b>identity</b> Can be null if assignmentType is "anonymous" or "anyConnectedUser". If "user", must be a map with the keys "login" and "populationId". If "group", must be a map with the keys "groupId" and "groupDirectory"</li>
     * </ol>
     * @return a map containing 3 objects :
     * success : boolean, everything is saved
     * successInfos : elements from assignmentsInfo that are saved
     * errorInfos : elements from assignmentsInfo that are not saved
     */
    @SuppressWarnings("unchecked")
    @Callable
    public Map<String, Object> saveChanges(String rightAssignmentCtxId, Object jsContext, List<Map<String, Object>> assignmentsInfo)
    {
        Map<String, Object> result = new HashMap<>();
        List<Map<String, Object>> successInfos = new ArrayList<>();
        List<Map<String, Object>> errorInfos = new ArrayList<>();
        
        UserIdentity user = _currentUserProvider.getUser();
        Set<GroupIdentity> groups = _groupManager.getUserGroups(user);
        
        if (!_checkRightAssignmentContext(rightAssignmentCtxId))
        {
            throw new RightsException("The user '" + user + "' try to assign profile on unauthorized context '" + rightAssignmentCtxId + "'");
        }
        
        Map<String, String> rights = getRights(Map.of());
        // Remove delegation rights because it is a specific right, not sufficient to allow right assignment
        rights.remove("CMS_Rights_Delegate_Rights");
        
        RightAssignmentContext rightAssignmentContext = _rightAssignmentContextEP.getExtension(rightAssignmentCtxId);
        Object context = rightAssignmentContext.convertJSContext(jsContext);
        
        boolean hasHandleRight = hasRight(rights, context);
        
        Set<String> updatedProfiles = new HashSet<>();
        
        String contextIdentifier = rightAssignmentContext.getContextIdentifier(context);
        for (Map<String, Object> assignmentInfo : assignmentsInfo)
        {
            String profileId = (String) assignmentInfo.get("profileId");
            
            if (_readerProfileOnly && !RightManager.READER_PROFILE_ID.equals(profileId))
            {
                throw new RightsException("The user '" + user + "' try to the assign profile '" + profileId + "' on the object context '" + jsContext + "' but only the reader profile is allowed for the right assignment context '" + rightAssignmentCtxId + "'");
            }
            
            String assignment = (String) assignmentInfo.get("assignment");
            String targetType = (String) assignmentInfo.get("targetType");

            Profile profile = _profileDAO.getProfile(profileId);
            assignmentInfo.put("profileLabel", profile.getLabel());
            
            if (hasHandleRight || canDelegateRights(user, groups, profileId, assignment, context))
            {
                updatedProfiles.add(profileId);
                Map<String, String> identity = (Map<String, String>) assignmentInfo.get("identity");
                _saveChange(context, profileId, assignment, targetType, identity);
                successInfos.add(assignmentInfo);
            }
            else
            {
                errorInfos.add(assignmentInfo);
            }
        }
        _notifyObservers(context, contextIdentifier, updatedProfiles);

        result.put("successInfos", successInfos);
        result.put("errorInfos", errorInfos);
        result.put("success", errorInfos.isEmpty());
        
        return result;
    }
    
    /**
     * Determine following the right parameter if the user has right to access this feature
     * 
     * @param rights The rights (name, context) to check. Can be empty.
     * @param context The object context
     * @return true if the user has the right or if there is not right and false otherwise
     */
    protected boolean hasRight(Map<String, String> rights, Object context)
    {
        return hasRight(rights);
    }
    
    /**
     * Returns true if right assignment context is part of handled right assignment contexts
     * @param rightAssignmentCtxId the id of right assignment context
     * @return true if it right assignment context is allowed
     */
    protected boolean _checkRightAssignmentContext(String rightAssignmentCtxId)
    {
        Set<String> rightAssignmentCtxIds = getRightAssignmentContexts().stream().map(RightAssignmentContext::getId).collect(Collectors.toSet());
        return rightAssignmentCtxIds.contains(rightAssignmentCtxId);
    }
    
    /**
     * Apply assignments and inheritance status on given contexts. The existing assignments will be reset for all targets
     * @param rightAssignmentCtxId The id of the right assignment context
     * @param targetContexts The JS object contexts with their inheritance enable status
     * @param assignmentsInfo The list of all the new assignments. Each map in the list must contain the following keys:
     * <ol>
     * <li><b>profileId</b> for the id of the profile (as a string)</li>
     * <li><b>assignment</b> for the kind of assignment (can be ACCESS_TYPE_ALLOW, ACCESS_TYPE_DENY...)</li>
     * <li><b>assignmentType</b> expects one of these four strings: "user", "group", "anonymous", "anyConnectedUser"</li>
     * <li><b>identity</b> Can be null if assignmentType is "anonymous" or "anyConnectedUser". If "user", must be a map with the keys "login" and "populationId". If "group", must be a map with the keys "groupId" and "groupDirectory"</li>
     * </ol>
     * @param disallowInheritance true to disallow the inheritance, false to allow.
     * @return true if assignments were correctly applied
     */
    @SuppressWarnings("unchecked")
    @Callable
    public boolean applyAssignments(String rightAssignmentCtxId, List<Map<String, Object>> targetContexts, List<Map<String, Object>> assignmentsInfo, boolean disallowInheritance)
    {
        UserIdentity user = _currentUserProvider.getUser();
        if (!hasRight(getRights(Map.of())))
        {
            getLogger().error("The user '" + user + "' try to apply assignments without sufficient rights");
            return false;
        }
        
        if (!_checkRightAssignmentContext(rightAssignmentCtxId))
        {
            throw new RightsException("The user '" + user + "' tries to apply assignments on an unauthorized context '" + rightAssignmentCtxId + "'");
        }
        
        Set<String> allProfileIds = _profileDAO.getProfiles().stream()
                .map(Profile::getId)
                .collect(Collectors.toSet());
        
        // Compute the targets targeted by the new assignments
        Set<AssignmentTarget> assignmentTargets = _getAssignmentTargets(assignmentsInfo);
        
        RightAssignmentContext rightAssignmentContext = _rightAssignmentContextEP.getExtension(rightAssignmentCtxId);
        
        for (Map<String, Object> targetContext : targetContexts)
        {
            String jsContext = (String) targetContext.get("context");
            
            Object context = rightAssignmentContext.convertJSContext(jsContext);
            
            // First reset existings assignments for each targets
            for (AssignmentTarget assignmentTarget : assignmentTargets)
            {
                _resetAssignments(allProfileIds, context, assignmentTarget.targetType(), assignmentTarget.identity());
            }
            
            // Then apply new assignments
            for (Map<String, Object> assignmentInfo : assignmentsInfo)
            {
                String profileId = (String) assignmentInfo.get("profileId");
                if (_readerProfileOnly && !RightManager.READER_PROFILE_ID.equals(profileId))
                {
                    throw new RightsException("The user '" + user + "' try to apply the profile '" + profileId + "' on the object context '" + jsContext + "' but only the reader profile is allowed for the right assignment context '" + rightAssignmentCtxId + "'");
                }
                String targetType = (String) assignmentInfo.get("targetType");
                Map<String, String> identity = (Map<String, String>) assignmentInfo.get("identity");
                
                // Apply new assignments
                String assignment = (String) assignmentInfo.get("assignment");
                _saveChange(context, profileId, assignment, targetType, identity);
            }
            
            // Apply inheritance (if available)
            boolean inheritanceAvailable = (boolean) targetContext.get("inheritanceAvailable");
            if (inheritanceAvailable)
            {
                _profileAssignmentStorageEP.disallowInheritance(context, disallowInheritance);
            }
            
            // Notify observers with all profiles
            String contextIdentifier = rightAssignmentContext.getContextIdentifier(context);
            _notifyObservers(context, contextIdentifier, allProfileIds);
        }
        
        return true;
    }
    
    @SuppressWarnings("unchecked")
    private Set<AssignmentTarget> _getAssignmentTargets(List<Map<String, Object>> assignmentsInfo)
    {
        Set<AssignmentTarget> targets = new HashSet<>();
        for (Map<String, Object> assignmentInfo : assignmentsInfo)
        {
            String targetType = (String) assignmentInfo.get("targetType");
            switch (TargetType.valueOf(targetType.toUpperCase()))
            {
                case ANONYMOUS:
                case ANYCONNECTED_USER:
                    targets.add(new AssignmentTarget(targetType, null));
                    break;
                case USER:
                case GROUP:
                    Map<String, String> identity = (Map<String, String>) assignmentInfo.get("identity");
                    targets.add(new AssignmentTarget(targetType, identity));
                    break;
                default:
                    break;
            }
        }
        
        return targets;
    }
        
    record AssignmentTarget(String targetType, Map<String, String> identity) { /* empty */ }
    
    /**
     * Only allow user with right CMS_Rights_Delegate_Rights to add a profil that this user already have on this context
     * @param user user that want to de an assignment
     * @param groups groups of the user
     * @param profileId profil impacted
     * @param assignment assignment see {@link AccessType}
     * @param context context of the assignment
     * @return <code>true</code> if user can de this assignment
     */
    protected boolean canDelegateRights(UserIdentity user, Set<GroupIdentity> groups, String profileId, String assignment , Object context)
    {
        AccessType accessType = assignment != null ? AccessType.valueOf(assignment.toUpperCase()) : AccessType.UNKNOWN;
        return accessType == AccessType.ALLOW
                && _rightManager.hasRight(user, "CMS_Rights_Delegate_Rights", "/${WorkspaceName}") == RightResult.RIGHT_ALLOW
                && _profileAssignmentStorageEP.getPermissions(user, groups, Set.of(profileId), context).get(profileId).toRightResult() == RightResult.RIGHT_ALLOW;
    }
    
    /**
     * Notify observers after modifying profile assignments.
     * @param context The context
     * @param contextIdentifier The context identifier
     * @param profileIds The profiles
     */
    protected void _notifyObservers(Object context, String contextIdentifier, Set<String> profileIds)
    {
        _observationManager.notify(new Event(ObservationConstants.EVENT_ACL_UPDATED, _currentUserProvider.getUser(), _getEventParams(context, contextIdentifier, profileIds)));
    }
    
    /**
     * Get the event params for notification.
     * @param context The context
     * @param contextIdentifier The context identifier
     * @param profileIds The profiles
     * @return the event params
     */
    protected Map<String, Object> _getEventParams(Object context, String contextIdentifier, Set<String> profileIds)
    {
        Map<String, Object> eventParams = new HashMap<>();
        eventParams.put(ObservationConstants.ARGS_ACL_CONTEXT, context);
        eventParams.put(ObservationConstants.ARGS_ACL_CONTEXT_IDENTIFIER, contextIdentifier);
        eventParams.put(ObservationConstants.ARGS_ACL_PROFILES, profileIds);
        return eventParams;
    }
    
    /**
     * Determines if the inheritance of assignments is disallowed on the given context
     * @param rightAssignmentCtxId The id of the right assignment context
     * @param jsContext The JS object context
     * @return <code>true</code> if the inheritance is disallowed.
     */
    @Callable
    public boolean isInheritanceDisallowed(String rightAssignmentCtxId, Object jsContext)
    {
        RightAssignmentContext rightCtx = _rightAssignmentContextEP.getExtension(rightAssignmentCtxId);
        Object context = rightCtx.convertJSContext(jsContext);
        
        return _profileAssignmentStorageEP.isInheritanceDisallowed(context);
    }
    
    /**
     * Allow or disallow the inheritance of assignments on the given context
     * @param rightAssignmentCtxId The id of the right assignment context
     * @param jsContext The JS object context
     * @param disallow true to disallow the inheritance, false to allow.
     */
    @Callable
    public void disallowInheritance(String rightAssignmentCtxId, Object jsContext, boolean disallow)
    {
        RightAssignmentContext rightCtx = _rightAssignmentContextEP.getExtension(rightAssignmentCtxId);
        Object context = rightCtx.convertJSContext(jsContext);
        String contextIdentifier = rightCtx.getContextIdentifier(context);
        
        _profileAssignmentStorageEP.disallowInheritance(context, disallow);
        
        // notify observers for all profiles
        Set<String> profileIds = _profileDAO.getProfiles().stream()
                .map(Profile::getId)
                .collect(Collectors.toSet());
        
        _notifyObservers(context, contextIdentifier, profileIds);
    }

    /**
     * Get the first permission given by inheritance for a object context and profiles
     * @param rightAssignmentCtxId The id of the right assignment context
     * @param jsContext The JS object context
     * @param profileIds The list of profiles
     * @param targetType The type of target : anonymous, any connected users, a user or a group
     * @param identity The identity of the target. Can be null if the target is anonymous or any connected users
     * @return The first access type given by inheritance for each profile
     */
    @Callable
    public Map<String, String> getInheritedAssignments (String rightAssignmentCtxId, Object jsContext, List<String> profileIds, String targetType, Map<String, String> identity)
    {
        RightAssignmentContext rightCtx = _rightAssignmentContextEP.getExtension(rightAssignmentCtxId);
        Object context = rightCtx.convertJSContext(jsContext);
        
        if (_profileAssignmentStorageEP.isInheritanceDisallowed(context))
        {
            return profileIds.stream()
                .collect(Collectors.toMap(profileId -> profileId, profileId -> AccessType.UNKNOWN.toString()));
        }
        else
        {
            return profileIds.stream()
                    .collect(Collectors.toMap(profileId -> profileId, profileId -> getInheritedAssignment(rightAssignmentCtxId, jsContext, profileId, targetType, identity)));
        }
    }
    
    /**
     * Get the first permission given by inheritance for a object context and a specific profile
     * @param rightAssignmentCtxId The id of the right assignment context
     * @param jsContext The JS object context
     * @param profileId The id of profile 
     * @param targetType The type of target : anonymous, any connected users, a user or a group
     * @param identity The identity of the target. Can be null if the target is anonymous or any connected users
     * @return The first access type given by inheritance
     */
    @Callable
    public String getInheritedAssignment (String rightAssignmentCtxId, Object jsContext, String profileId, String targetType, Map<String, String> identity)
    {
        RightAssignmentContext rightCtx = _rightAssignmentContextEP.getExtension(rightAssignmentCtxId);
        Object context = rightCtx.convertJSContext(jsContext);
        
        if (_profileAssignmentStorageEP.isInheritanceDisallowed(context))
        {
            return AccessType.UNKNOWN.toString();
        }
        else
        {
            switch (TargetType.valueOf(targetType.toUpperCase()))
            {
                case ANONYMOUS:
                    return _getInheritedAssignmentForAnonymous(rightCtx, context, profileId);
                case ANYCONNECTED_USER:
                    return _getInheritedAssignmentForAnyconnected(rightCtx, context, profileId);
                case USER:
                    UserIdentity user = _userHelper.json2userIdentity(identity);
                    return _getInheritedAssignmentForUser(rightCtx, context, profileId, user);
                case GROUP:
                    GroupIdentity group = new GroupIdentity(identity.get("groupId"), identity.get("groupDirectory"));
                    return _getInheritedAssignmentForGroup(rightCtx, context, profileId, group);
                default:
                    return AccessType.UNKNOWN.toString();
            }
        }
    }
    
    private String _getInheritedAssignmentForAnonymous (RightAssignmentContext extension, Object context, String profileId)
    {
        String value = AccessType.UNKNOWN.toString();
        
        Set<Object> parentContexts = extension.getParentContexts(context);
        if (parentContexts != null)
        {
            for (Object parentContext : parentContexts)
            {
                Map<AnonymousOrAnyConnectedKeys, Set<String>> profilesForAnonymousAndAnyConnectedUser = _profileAssignmentStorageEP.getProfilesForAnonymousAndAnyConnectedUser(parentContexts);
                
                Set<String> deniedProfiles = Optional.ofNullable(profilesForAnonymousAndAnyConnectedUser.get(AnonymousOrAnyConnectedKeys.ANONYMOUS_DENIED)).orElse(Set.of());
                if (deniedProfiles.contains(profileId))
                {
                    return AccessType.INHERITED_DENY.toString();
                }
                
                Set<String> allowedProfiles = Optional.ofNullable(profilesForAnonymousAndAnyConnectedUser.get(AnonymousOrAnyConnectedKeys.ANONYMOUS_ALLOWED)).orElse(Set.of());
                if (allowedProfiles.contains(profileId))
                {
                    value = AccessType.INHERITED_ALLOW.toString();
                }
    
                String parentsValue = _getInheritedAssignmentForAnonymous(extension, parentContext, profileId);
                if (!AccessType.UNKNOWN.toString().equals(parentsValue))
                {
                    value = parentsValue;
                }
            }
        }
        
        return value;
    }
    
    private String _getInheritedAssignmentForAnyconnected(RightAssignmentContext extension, Object context, String profileId)
    {
        String value = AccessType.UNKNOWN.toString();
        
        Set<Object> parentContexts = extension.getParentContexts(context);
        if (parentContexts != null)
        {
            for (Object parentContext : parentContexts)
            {
                Map<AnonymousOrAnyConnectedKeys, Set<String>> profilesForAnonymousAndAnyConnectedUser = _profileAssignmentStorageEP.getProfilesForAnonymousAndAnyConnectedUser(parentContexts);
                
                Set<String> deniedProfiles = Optional.ofNullable(profilesForAnonymousAndAnyConnectedUser.get(AnonymousOrAnyConnectedKeys.ANYCONNECTEDUSER_DENIED)).orElse(Set.of());
                if (deniedProfiles.contains(profileId))
                {
                    return AccessType.INHERITED_DENY.toString();
                }
                
                Set<String> allowedProfiles = Optional.ofNullable(profilesForAnonymousAndAnyConnectedUser.get(AnonymousOrAnyConnectedKeys.ANYCONNECTEDUSER_ALLOWED)).orElse(Set.of());
                if (allowedProfiles.contains(profileId))
                {
                    value = AccessType.INHERITED_ALLOW.toString();
                }
    
                String parentsValue = _getInheritedAssignmentForAnyconnected(extension, parentContext, profileId);
                if (!AccessType.UNKNOWN.toString().equals(parentsValue))
                {
                    value = parentsValue;
                }
            }
        }
        
        return value;
    }

    private String _getInheritedAssignmentForUser(RightAssignmentContext extension, Object context, String profileId, UserIdentity user)
    {
        String value = AccessType.UNKNOWN.toString();

        Set<Object> parentContexts = extension.getParentContexts(context);
        if (parentContexts != null)
        {
            for (Object parentContext : parentContexts)
            {
                Map<UserIdentity, Map<UserOrGroup, Set<String>>> profilesForUsers = _profileAssignmentStorageEP.getProfilesForUsers(parentContext, user);
                
                Set<String> deniedProfiles = Optional.ofNullable(profilesForUsers.get(user)).map(a -> a.get(UserOrGroup.DENIED)).orElse(Set.of());
                if (deniedProfiles.contains(profileId))
                {
                    return AccessType.INHERITED_DENY.toString();
                }
                
                Set<String> allowedProfiles = Optional.ofNullable(profilesForUsers.get(user)).map(a -> a.get(UserOrGroup.ALLOWED)).orElse(Set.of());
                if (allowedProfiles.contains(profileId))
                {
                    value = AccessType.INHERITED_ALLOW.toString();
                }
                
                String parentsValue = _getInheritedAssignmentForUser(extension, parentContext, profileId, user);
                if (!AccessType.UNKNOWN.toString().equals(parentsValue))
                {
                    value = parentsValue;
                }
            }
        }
        
        return value;
    }
    
    private String _getInheritedAssignmentForGroup(RightAssignmentContext extension, Object context, String profileId, GroupIdentity group)
    {
        String value = AccessType.UNKNOWN.toString();

        Set<Object> parentContexts = extension.getParentContexts(context);
        if (parentContexts != null)
        {        
            for (Object parentContext : parentContexts)
            {
                Map<GroupIdentity, Map<UserOrGroup, Set<String>>> profilesForGroups = _profileAssignmentStorageEP.getProfilesForGroups(parentContext, Set.of(group));
                
                Set<String> deniedProfiles = Optional.ofNullable(profilesForGroups.get(group)).map(a -> a.get(UserOrGroup.DENIED)).orElse(Set.of());
                if (deniedProfiles.contains(profileId))
                {
                    return AccessType.INHERITED_DENY.toString();
                }
                
                Set<String> allowedProfiles = Optional.ofNullable(profilesForGroups.get(group)).map(a -> a.get(UserOrGroup.ALLOWED)).orElse(Set.of());
                if (allowedProfiles.contains(profileId))
                {
                    value = AccessType.INHERITED_ALLOW.toString();
                }
                
                String parentsValue = _getInheritedAssignmentForGroup(extension, parentContext, profileId, group);
                if (!AccessType.UNKNOWN.toString().equals(parentsValue))
                {
                    value = parentsValue;
                }
            }
        }
        
        return value;
    }
    
    private void _resetAssignments(Set<String> profileIds, Object context, String targetType, Map<String, String> identity)
    {
        TargetType type = TargetType.valueOf(targetType.toUpperCase());
        for (String profileId : profileIds)
        {
            switch (type)
            {
                case ANONYMOUS:
                    _profileAssignmentStorageEP.removeAllowedProfileFromAnonymous(profileId, context);
                    _profileAssignmentStorageEP.removeDeniedProfileFromAnonymous(profileId, context);
                    break;
                case ANYCONNECTED_USER:
                    _profileAssignmentStorageEP.removeAllowedProfileFromAnyConnectedUser(profileId, context);
                    _profileAssignmentStorageEP.removeDeniedProfileFromAnyConnectedUser(profileId, context);
                    break;
                case USER:
                    UserIdentity user = _userHelper.json2userIdentity(identity);
                    _profileAssignmentStorageEP.removeAllowedProfileFromUser(user, profileId, context);
                    _profileAssignmentStorageEP.removeDeniedProfileFromUser(user, profileId, context);
                    break;
                case GROUP:
                    GroupIdentity group = new GroupIdentity(identity.get("groupId"), identity.get("groupDirectory"));
                    _profileAssignmentStorageEP.removeAllowedProfileFromGroup(group, profileId, context);
                    _profileAssignmentStorageEP.removeDeniedProfileFromGroup(group, profileId, context);
                    break;
                default:
                    break;
            }
        }
    }
    
    private void _saveChange(Object context, String profileId, String assignment, String targetType, Map<String, String> identity)
    {
        AccessType accessType = assignment != null ? AccessType.valueOf(assignment.toUpperCase()) : AccessType.UNKNOWN;
        switch (TargetType.valueOf(targetType.toUpperCase()))
        {
            case ANONYMOUS:
                switch (accessType)
                {
                    case ALLOW:
                        _profileAssignmentStorageEP.removeDeniedProfileFromAnonymous(profileId, context);
                        _profileAssignmentStorageEP.allowProfileToAnonymous(profileId, context);
                        break;
                    case DENY:
                        _profileAssignmentStorageEP.removeAllowedProfileFromAnonymous(profileId, context);
                        _profileAssignmentStorageEP.denyProfileToAnonymous(profileId, context);
                        break;
                    default:
                        _profileAssignmentStorageEP.removeAllowedProfileFromAnonymous(profileId, context);
                        _profileAssignmentStorageEP.removeDeniedProfileFromAnonymous(profileId, context);
                        break;
                }
                break;
                
            case ANYCONNECTED_USER:
                switch (accessType)
                {
                    case ALLOW:
                        _profileAssignmentStorageEP.removeDeniedProfileFromAnyConnectedUser(profileId, context);
                        _profileAssignmentStorageEP.allowProfileToAnyConnectedUser(profileId, context);
                        break;
                    case DENY:
                        _profileAssignmentStorageEP.removeAllowedProfileFromAnyConnectedUser(profileId, context);
                        _profileAssignmentStorageEP.denyProfileToAnyConnectedUser(profileId, context);
                        break;
                    default:
                        _profileAssignmentStorageEP.removeAllowedProfileFromAnyConnectedUser(profileId, context);
                        _profileAssignmentStorageEP.removeDeniedProfileFromAnyConnectedUser(profileId, context);
                        break;
                }
                break;
                
            case USER:
                UserIdentity user = _userHelper.json2userIdentity(identity);
                switch (accessType)
                {
                    case ALLOW:
                        _profileAssignmentStorageEP.removeDeniedProfileFromUser(user, profileId, context);
                        _profileAssignmentStorageEP.allowProfileToUser(user, profileId, context);
                        break;
                    case DENY:    
                        _profileAssignmentStorageEP.removeAllowedProfileFromUser(user, profileId, context);
                        _profileAssignmentStorageEP.denyProfileToUser(user, profileId, context);
                        break;
                    default:
                        _profileAssignmentStorageEP.removeAllowedProfileFromUser(user, profileId, context);
                        _profileAssignmentStorageEP.removeDeniedProfileFromUser(user, profileId, context);
                        break;
                }
                break;
                
            case GROUP:
                GroupIdentity group = new GroupIdentity(identity.get("groupId"), identity.get("groupDirectory"));
                switch (accessType)
                {
                    case ALLOW:
                        _profileAssignmentStorageEP.removeDeniedProfileFromGroup(group, profileId, context);
                        _profileAssignmentStorageEP.allowProfileToGroup(group, profileId, context);
                        break;
                    case DENY:  
                        _profileAssignmentStorageEP.removeAllowedProfileFromGroup(group, profileId, context);
                        _profileAssignmentStorageEP.denyProfileToGroup(group, profileId, context);
                        break;
                    default:
                        _profileAssignmentStorageEP.removeAllowedProfileFromGroup(group, profileId, context);
                        _profileAssignmentStorageEP.removeDeniedProfileFromGroup(group, profileId, context);
                        break;
                }
                break;
            default:
                break;
        }
    }
    
    
}