package org.apache.archiva.redback.role.validator;

/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

import org.apache.archiva.components.graph.base.SimpleGraph;
import org.apache.archiva.components.graph.base.SimpleNode;
import org.apache.archiva.components.graph.util.Traversal;
import org.apache.archiva.redback.role.RoleManagerException;
import org.apache.archiva.redback.role.model.*;
import org.apache.archiva.redback.role.util.RoleModelUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Service;

import java.util.ArrayList;
import java.util.List;

/**
 * DefaultRoleModelValidator: validates completeness of the model
 *
 * @author: Jesse McConnell
 */
@Service("roleModelValidator")
public class DefaultRoleModelValidator
        implements RoleModelValidator {

    private static final Logger log = LoggerFactory.getLogger(DefaultRoleModelValidator.class);

    private List<String> validationErrors;

    public boolean validate(RedbackRoleModel model)
            throws RoleManagerException {
        validationErrors = null;

        validateRequiredStructure(model);
        validateResourceClosure(model);
        validateOperationClosure(model);
        validateChildRoleClosure(model);
        validateParentRoleClosure(model);
        validateTemplateClosure(model);
        validateNoRoleCycles(model);
        validateNoTemplateCycles(model);

        if (validationErrors == null) {
            return true;
        } else {
            return false;
        }
    }

    public List<String> getValidationErrors() {
        return validationErrors;
    }

    private void addValidationError(String error) {
        if (validationErrors == null) {
            validationErrors = new ArrayList<String>(0);
        }

        validationErrors.add(error);
    }

    /**
     * FIXME this should be taken care of by <required/> in modello, figure out why its not
     * in the meantime, implement the basics
     *
     * @param model
     */
    @SuppressWarnings("unchecked")
    private void validateRequiredStructure(RedbackRoleModel model) {
        // validate model has name

        for (ModelApplication application : model.getApplications()) {
            if (application.getId() == null) {
                addValidationError("model is missing application name");
            }

            // validate model has version
            if (application.getVersion() == null) {
                addValidationError(application.getId() + " is missing version");
            }

            // validate resource bits
            for (ModelResource resource : application.getResources()) {
                if (resource.getName() == null) {
                    addValidationError(resource.toString() + " missing name");
                }

                if (resource.getId() == null) {
                    addValidationError(resource.toString() + " missing id");
                }
            }

            // validate the operations
            for (ModelOperation operation : application.getOperations()) {
                if (operation.getName() == null) {
                    addValidationError(operation.toString() + " missing name");
                }

                if (operation.getId() == null) {
                    addValidationError(operation.toString() + " missing id");
                }
            }

            for (ModelRole role : application.getRoles()) {
                if (role.getId() == null) {
                    addValidationError(role.toString() + " missing id");
                }

                if (role.getName() == null) {
                    addValidationError(role.toString() + " missing name");
                }

                if (role.getPermissions() != null) {
                    for (ModelPermission permission : role.getPermissions()) {
                        if (permission.getName() == null) {
                            addValidationError(permission.toString() + " missing name");
                        }

                        if (permission.getId() == null) {
                            addValidationError(permission.toString() + " missing id");
                        }

                        if (permission.getOperation() == null) {
                            addValidationError(permission.toString() + " missing operations");
                        }

                        if (permission.getResource() == null) {
                            addValidationError(permission.toString() + " missing resource");
                        }
                    }
                }
            }

            for (ModelTemplate template : application.getTemplates()) {
                if (template.getId() == null) {
                    addValidationError(template.toString() + " missing id");
                }

                if (template.getNamePrefix() == null) {
                    addValidationError(template.toString() + " missing name prefix");
                }

                if (template.getPermissions() != null) {
                    for (ModelPermission permission : template.getPermissions()) {
                        if (permission.getName() == null) {
                            addValidationError(permission.toString() + " missing name");
                        }

                        if (permission.getId() == null) {
                            addValidationError(permission.toString() + " missing id");
                        }

                        if (permission.getOperation() == null) {
                            addValidationError(permission.toString() + " missing operations");
                        }

                        if (permission.getResource() == null) {
                            addValidationError(permission.toString() + " missing resource");
                        }
                    }
                }
            }
        }
    }

    /**
     * validate all operations in all declared permissions exist as declared in the operations section
     *
     * @param model
     */
    private void validateOperationClosure(RedbackRoleModel model) {
        List<String> operationIdList = RoleModelUtils.getOperationIdList(model);

        // check the operations in role permissions
        for (ModelApplication application : model.getApplications()) {
            for (ModelRole role : application.getRoles()) {
                if (role.getPermissions() != null) {
                    for (ModelPermission permission : role.getPermissions()) {
                        if (!operationIdList.contains(permission.getOperation())) {
                            addValidationError("missing operation: " + permission.getOperation() + " in permission "
                                    + permission.getId());
                        }
                    }
                }
            }

            // check the operations in template permissions
            for (ModelTemplate template : application.getTemplates()) {
                if (template.getPermissions() != null) {
                    for (ModelPermission permission : template.getPermissions()) {
                        if (!operationIdList.contains(permission.getOperation())) {
                            addValidationError("missing operation: " + permission.getOperation() + " in permission "
                                    + permission.getId());
                        }
                    }
                }
            }
        }
    }

    private void validateResourceClosure(RedbackRoleModel model) {
        List<String> resourceIdList = RoleModelUtils.getResourceIdList(model);
        for (ModelApplication application : model.getApplications()) {
            for (ModelRole role : application.getRoles()) {
                if (role.getPermissions() != null) {
                    for (ModelPermission permission : role.getPermissions()) {
                        if (!resourceIdList.contains(permission.getResource())) {
                            addValidationError("missing operation: " + permission.getResource() + " in permission "
                                    + permission.getId());
                        }
                    }
                }
            }
        }
    }

    private void validateChildRoleClosure(RedbackRoleModel model) {
        List<String> roleIdList = RoleModelUtils.getRoleIdList(model);
        for (ModelApplication application : model.getApplications()) {
            for (ModelRole role : application.getRoles()) {
                if (role.getChildRoles() != null) {
                    for (String childRoleId : role.getChildRoles()) {
                        if (!roleIdList.contains(childRoleId)) {
                            addValidationError(
                                    "missing role id: " + childRoleId + " in child roles of role " + role.getId());
                        }
                    }
                }
            }

            for (ModelTemplate template : application.getTemplates()) {
                if (template.getChildRoles() != null) {
                    for (String childRoleId : template.getChildRoles()) {
                        if (!roleIdList.contains(childRoleId)) {
                            addValidationError(
                                    "missing role id: " + childRoleId + " in child roles of template " + template.getId());
                        }
                    }
                }
            }
        }
    }

    @SuppressWarnings("unchecked")
    private void validateParentRoleClosure(RedbackRoleModel model) {
        List roleIdList = RoleModelUtils.getRoleIdList(model);

        for (ModelApplication application : model.getApplications()) {
            for (ModelRole role : application.getRoles()) {
                if (role.getParentRoles() != null) {
                    for (String parentRoleId : role.getParentRoles()) {
                        if (!roleIdList.contains(parentRoleId)) {
                            addValidationError(
                                    "missing role id: " + parentRoleId + " in parent roles of role " + role.getId());
                        }
                    }
                }
            }

            for (ModelTemplate template : application.getTemplates()) {
                if (template.getParentRoles() != null) {
                    for (String parentRoleId : template.getParentRoles()) {
                        if (!roleIdList.contains(parentRoleId)) {
                            addValidationError("missing role id: " + parentRoleId + " in parent roles of template "
                                    + template.getId());
                        }
                    }
                }
            }
        }
    }

    private void validateTemplateClosure(RedbackRoleModel model) {
        List templateIdList = RoleModelUtils.getTemplateIdList(model);

        // template name prefix must be unique
        List<String> templateNamePrefixList = new ArrayList<String>();

        for (ModelApplication application : model.getApplications()) {
            for (ModelTemplate template : application.getTemplates()) {
                if (template.getParentTemplates() != null) {
                    for (String parentTemplateId : template.getParentTemplates()) {
                        if (!templateIdList.contains(parentTemplateId)) {
                            addValidationError(
                                    "missing template id: " + parentTemplateId + " in parent templates of template "
                                            + template.getId());
                        }
                    }
                }

                if (template.getChildTemplates() != null) {
                    for (String childTemplateId : template.getChildTemplates()) {
                        if (!templateIdList.contains(childTemplateId)) {
                            addValidationError(
                                    "missing template id: " + childTemplateId + " in child templates of template "
                                            + template.getId());
                        }
                    }
                }

                if (!templateNamePrefixList.contains(template.getNamePrefix())) {
                    templateNamePrefixList.add(template.getNamePrefix());
                } else {
                    addValidationError("duplicate name prefix detected: " + template.getNamePrefix());
                }
            }
        }
    }

    /**
     * We are not allowed to have cycles between roles, this method is to detect and raise a red flag when that happens.
     *
     * @param model
     */
    private void validateNoRoleCycles(RedbackRoleModel model) {
        log.debug("Validating cycles in role model");
        SimpleGraph graph = RoleModelUtils.generateRoleGraph(model);
        SimpleNode rootNode = graph.getNode(RoleModelUtils.ROOT);
        SimpleNode n;
        if ((n = Traversal.findFirstCycleNode(rootNode))!=null) {
            log.debug("Adding template cycle validation error for node {}", n.getId());
            addValidationError("Cycle detected at "+n.getId());
        }
    }

    /**
     * We are not allowed to have cycles between template either, this method is to detect and
     * raise a red flag when that happens.  Templates are a bit more complex since they have both
     * child and parent roles, as well as runtime parent and child templates
     * <p>
     * the id should be sufficient to test cycles here even though in runtime the id's do not need to be
     * unique since it is the binding of a namePrefix and a resource that makes them unique
     *
     * @param model
     */
    private void validateNoTemplateCycles(RedbackRoleModel model) {
        log.debug("Validating cycles in role template model ");
        SimpleGraph graph = RoleModelUtils.generateTemplateGraph(model);
        SimpleNode rootNode = graph.getNode(RoleModelUtils.ROOT);
        SimpleNode n;
        if ((n = Traversal.findFirstCycleNode(rootNode)) != null) {
            log.debug("Adding template cycle validation error for node {}", n.getId());
            addValidationError("Template cycle detected at "+n.getId());
        }
    }
}