/*
 *  Licensed to the Apache Software Foundation (ASF) under one
 *  or more contributor license agreements.  See the NOTICE file
 *  distributed with this work for additional information
 *  regarding copyright ownership.  The ASF licenses this file
 *  to you under the Apache License, Version 2.0 (the
 *  "License"); you may not use this file except in compliance
 *  with the License.  You may obtain a copy of the License at
 *
 *    http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing,
 *  software distributed under the License is distributed on an
 *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 *  KIND, either express or implied.  See the License for the
 *  specific language governing permissions and limitations
 *  under the License.
 *
 */

/*
 *                        AT&T - PROPRIETARY
 *          THIS FILE CONTAINS PROPRIETARY INFORMATION OF
 *        AT&T AND IS NOT TO BE DISCLOSED OR USED EXCEPT IN
 *             ACCORDANCE WITH APPLICABLE AGREEMENTS.
 *
 *          Copyright (c) 2013 AT&T Knowledge Ventures
 *              Unpublished and Not for Publication
 *                     All Rights Reserved
 */
package org.apache.openaz.xacml.pdp.std;

import java.io.InputStream;
import java.net.MalformedURLException;
import java.net.URI;
import java.net.URL;
import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.openaz.xacml.api.IdReferenceMatch;
import org.apache.openaz.xacml.api.Identifier;
import org.apache.openaz.xacml.api.Version;
import org.apache.openaz.xacml.pdp.eval.EvaluationContext;
import org.apache.openaz.xacml.pdp.eval.EvaluationException;
import org.apache.openaz.xacml.pdp.eval.MatchResult;
import org.apache.openaz.xacml.pdp.policy.Policy;
import org.apache.openaz.xacml.pdp.policy.PolicyDef;
import org.apache.openaz.xacml.pdp.policy.PolicyFinder;
import org.apache.openaz.xacml.pdp.policy.PolicyFinderResult;
import org.apache.openaz.xacml.pdp.policy.PolicySet;
import org.apache.openaz.xacml.pdp.policy.PolicySetChild;
import org.apache.openaz.xacml.pdp.policy.dom.DOMPolicyDef;
import org.apache.openaz.xacml.std.StdStatus;
import org.apache.openaz.xacml.std.StdStatusCode;

/**
 * StdPolicyFinder implements the {@link org.apache.openaz.xacml.pdp.policy.PolicyFinder} interface to look
 * up policies by their internal ID or an externally visible ID.
 */
public class StdPolicyFinder implements PolicyFinder {
    private static final PolicyFinderResult<PolicyDef> PFR_MULTIPLE = new StdPolicyFinderResult<PolicyDef>(
                                                                                                           new StdStatus(
                                                                                                                         StdStatusCode.STATUS_CODE_PROCESSING_ERROR,
                                                                                                                         "Multiple applicable root policies"));
    private static final PolicyFinderResult<PolicyDef> PFR_NOT_FOUND = new StdPolicyFinderResult<PolicyDef>(
                                                                                                            new StdStatus(
                                                                                                                          StdStatusCode.STATUS_CODE_PROCESSING_ERROR,
                                                                                                                          "No matching root policy found"));

    private static final PolicyFinderResult<Policy> PFR_POLICY_NOT_FOUND = new StdPolicyFinderResult<Policy>(
                                                                                                             new StdStatus(
                                                                                                                           StdStatusCode.STATUS_CODE_PROCESSING_ERROR,
                                                                                                                           "No matching policy found"));
    private static final PolicyFinderResult<Policy> PFR_NOT_A_POLICY = new StdPolicyFinderResult<Policy>(
                                                                                                         new StdStatus(
                                                                                                                       StdStatusCode.STATUS_CODE_PROCESSING_ERROR,
                                                                                                                       "Not a policy"));
    private static final PolicyFinderResult<PolicySet> PFR_POLICYSET_NOT_FOUND = new StdPolicyFinderResult<PolicySet>(
                                                                                                                      new StdStatus(
                                                                                                                                    StdStatusCode.STATUS_CODE_PROCESSING_ERROR,
                                                                                                                                    "No matching policy set found"));
    private static final PolicyFinderResult<PolicySet> PFR_NOT_A_POLICYSET = new StdPolicyFinderResult<PolicySet>(
                                                                                                                  new StdStatus(
                                                                                                                                StdStatusCode.STATUS_CODE_PROCESSING_ERROR,
                                                                                                                                "Not a policy set"));

    private Log logger = LogFactory.getLog(this.getClass());
    private List<PolicyDef> listRoots = new ArrayList<PolicyDef>();
    private Map<Identifier, List<PolicyDef>> mapPolicies = new HashMap<Identifier, List<PolicyDef>>();

    public static class StdPolicyFinderException extends Exception {
        private static final long serialVersionUID = -8969282995787463288L;

        public StdPolicyFinderException(String msg) {
            super(msg);
        }

        public StdPolicyFinderException(String msg, Throwable cause) {
            super(msg, cause);
        }
    }

    private void storeInPolicyMap(PolicyDef policyDef) {
        List<PolicyDef> listPolicyDefs = this.mapPolicies.get(policyDef.getIdentifier());
        if (listPolicyDefs == null) {
            listPolicyDefs = new ArrayList<PolicyDef>();
            this.mapPolicies.put(policyDef.getIdentifier(), listPolicyDefs);
        }
        listPolicyDefs.add(policyDef);
    }

    private <T extends PolicyDef> List<T> getFromPolicyMap(IdReferenceMatch idReferenceMatch,
                                                           Class<T> classPolicyDef) {
        /*
         * Get all of the PolicyDefs for the Identifier in the reference match
         */
        List<PolicyDef> listPolicyDefForId = this.mapPolicies.get(idReferenceMatch.getId());
        if (listPolicyDefForId == null) {
            return null;
        }

        /*
         * Iterate over all of the PolicyDefs that were found and select only the ones that match the version
         * request and the isPolicySet
         */
        List<T> listPolicyDefMatches = null;
        Iterator<PolicyDef> iterPolicyDefs = listPolicyDefForId.iterator();
        while (iterPolicyDefs.hasNext()) {
            PolicyDef policyDef = iterPolicyDefs.next();
            if (classPolicyDef.isInstance(policyDef) && policyDef.matches(idReferenceMatch)) {
                if (listPolicyDefMatches == null) {
                    listPolicyDefMatches = new ArrayList<T>();
                }
                listPolicyDefMatches.add(classPolicyDef.cast(policyDef));
            }
        }

        return listPolicyDefMatches;
    }

    private <T extends PolicyDef> T getBestMatchN(List<T> matches) {
        T bestMatch = null;
        Version bestVersion = null;
        Iterator<T> iterMatches = matches.iterator();

        while (iterMatches.hasNext()) {
            T match = iterMatches.next();
            if (bestMatch == null) {
                bestMatch = match;
                bestVersion = match.getVersion();
            } else {
                Version matchVersion = match.getVersion();
                if (matchVersion != null && matchVersion.compareTo(bestVersion) > 0) {
                    bestMatch = match;
                    bestVersion = matchVersion;
                }
            }
        }
        return bestMatch;
    }

    private <T extends PolicyDef> T getBestMatch(List<T> matches) {
        switch (matches.size()) {
        case 0:
            return null;
        case 1:
            return matches.get(0);
        default:
            return this.getBestMatchN(matches);
        }
    }

    private PolicyDef loadPolicyDefFromURI(URI uri) throws StdPolicyFinderException {
        this.logger.info("Loading policy from URI " + uri.toString());
        URL url = null;
        try {
            url = uri.toURL();
            this.logger.debug("Loading policy from URL " + url.toString());
        } catch (MalformedURLException ex) {
            this.logger.debug("Unknown protocol for URI " + uri.toString());
            return null;
        } 
        
        try (InputStream inputStream = url.openStream()) {
            return DOMPolicyDef.load(inputStream);
        } catch (Exception ex) {
            this.logger.error("Exception loading policy definition", ex);
            throw new StdPolicyFinderException("Exception loading policy def from \"" + uri.toString()
                                               + "\": " + ex.getMessage(), ex);
        }
    }

    /**
     * Looks up the given {@link org.apache.openaz.xacml.api.Identifier} in the map first. If not found, and
     * the <code>Identifier</code> contains a URL, then attempts to retrieve the document from the URL and
     * caches it.
     *
     * @param idReferenceMatch the <code>IdReferenceMatch</code> to look up
     * @return a <code>PolicyFinderResult</code> with the requested <code>Policy</code> or an error status
     */
    private PolicyFinderResult<Policy> lookupPolicyByIdentifier(IdReferenceMatch idReferenceMatch) {
        List<Policy> listCachedPolicies = this.getFromPolicyMap(idReferenceMatch, Policy.class);
        if (listCachedPolicies == null) {
            Identifier id = idReferenceMatch.getId();
            if (id != null) {
                URI uri = id.getUri();
                if (uri != null && uri.isAbsolute()) {
                    PolicyDef policyDef = null;
                    try {
                        policyDef = this.loadPolicyDefFromURI(uri);
                    } catch (StdPolicyFinderException ex) {
                        return new StdPolicyFinderResult<Policy>(
                                                                 new StdStatus(
                                                                               StdStatusCode.STATUS_CODE_PROCESSING_ERROR,
                                                                               ex.getMessage()));
                    }
                    if (policyDef != null) {
                        if (policyDef instanceof Policy) {
                            List<PolicyDef> listPolicyDefs = new ArrayList<PolicyDef>();
                            listPolicyDefs.add(policyDef);
                            this.mapPolicies.put(id, listPolicyDefs);
                            this.mapPolicies.put(policyDef.getIdentifier(), listPolicyDefs);
                            return new StdPolicyFinderResult<Policy>((Policy)policyDef);
                        } else {
                            return PFR_NOT_A_POLICY;
                        }
                    } else {
                        return PFR_POLICY_NOT_FOUND;
                    }
                }
            }
        }
        if (listCachedPolicies != null) {
            return new StdPolicyFinderResult<Policy>(this.getBestMatch(listCachedPolicies));
        } else {
            return PFR_POLICY_NOT_FOUND;
        }
    }

    /**
     * Looks up the given {@link org.apache.openaz.xacml.api.Identifier} in the map first. If not found, and
     * the <code>Identifier</code> contains a URL, then attempts to retrieve the document from the URL and
     * caches it.
     *
     * @param idReferenceMatch the <code>IdReferenceMatch</code> to look up
     * @return a <code>PolicyFinderResult</code> with the requested <code>PolicySet</code> or an error status
     */
    private PolicyFinderResult<PolicySet> lookupPolicySetByIdentifier(IdReferenceMatch idReferenceMatch) {
        List<PolicySet> listCachedPolicySets = this.getFromPolicyMap(idReferenceMatch, PolicySet.class);
        if (listCachedPolicySets == null) {
            Identifier id = idReferenceMatch.getId();
            if (id != null) {
                URI uri = id.getUri();
                if (uri != null && uri.isAbsolute()) {
                    PolicyDef policyDef = null;
                    try {
                        policyDef = this.loadPolicyDefFromURI(uri);
                    } catch (StdPolicyFinderException ex) {
                        return new StdPolicyFinderResult<PolicySet>(
                                                                    new StdStatus(
                                                                                  StdStatusCode.STATUS_CODE_PROCESSING_ERROR,
                                                                                  ex.getMessage()));
                    }
                    if (policyDef != null) {
                        if (policyDef instanceof PolicySet) {
                            List<PolicyDef> listPolicyDefs = new ArrayList<PolicyDef>();
                            listPolicyDefs.add(policyDef);
                            this.mapPolicies.put(id, listPolicyDefs);
                            this.mapPolicies.put(policyDef.getIdentifier(), listPolicyDefs);
                            return new StdPolicyFinderResult<PolicySet>((PolicySet)policyDef);
                        } else {
                            return PFR_NOT_A_POLICYSET;
                        }
                    } else {
                        return PFR_POLICYSET_NOT_FOUND;
                    }
                }
            }
        }
        if (listCachedPolicySets != null) {
            return new StdPolicyFinderResult<PolicySet>(this.getBestMatch(listCachedPolicySets));
        } else {
            return PFR_POLICYSET_NOT_FOUND;
        }
    }

    /**
     * Adds the given <code>PolicyDef</code> to the map of loaded <code>PolicyDef</code>s and adds its child
     * <code>PolicyDef</code>s recursively.
     *
     * @param policyDef the <code>PolicyDef</code> to add
     */
    private void updatePolicyMap(PolicyDef policyDef) {
        this.storeInPolicyMap(policyDef);
        if (policyDef instanceof PolicySet) {
            Iterator<PolicySetChild> iterChildren = ((PolicySet)policyDef).getChildren();
            if (iterChildren != null) {
                while (iterChildren.hasNext()) {
                    PolicySetChild policySetChild = iterChildren.next();
                    if (policySetChild instanceof PolicyDef) {
                        this.updatePolicyMap((PolicyDef)policySetChild);
                    }
                }
            }
        }
    }

    public StdPolicyFinder(Collection<PolicyDef> listRootPolicies, Collection<PolicyDef> referencedPolicyDefs) {
        if (listRootPolicies != null) {
            for (PolicyDef policyDef : listRootPolicies) {
                this.listRoots.add(policyDef);
                this.updatePolicyMap(policyDef);
            }
        }
        if (referencedPolicyDefs != null) {
            for (PolicyDef policyDef : referencedPolicyDefs) {
                this.storeInPolicyMap(policyDef);
            }
        }
    }

    /**
     * Creates a new <code>StdPolicyFinder</code> with the given <code>PolicyDef</code> as the root element.
     *
     * @param rootPolicyDef the <code>PolicyDef</code> acting as the root element
     */
    public StdPolicyFinder(PolicyDef rootPolicyDef, Collection<PolicyDef> referencedPolicyDefs) {
        if (rootPolicyDef != null) {
            this.listRoots.add(rootPolicyDef);
            this.updatePolicyMap(rootPolicyDef);
        }

        if (referencedPolicyDefs != null) {
            for (PolicyDef policyDef : referencedPolicyDefs) {
                this.storeInPolicyMap(policyDef);
            }
        }
    }

    @Override
    public PolicyFinderResult<PolicyDef> getRootPolicyDef(EvaluationContext evaluationContext) {
        PolicyDef policyDefFirstMatch = null;
        Iterator<PolicyDef> iterRootPolicies = this.listRoots.iterator();
        PolicyFinderResult<PolicyDef> firstIndeterminate = null;
        while (iterRootPolicies.hasNext()) {
            PolicyDef policyDef = iterRootPolicies.next();
            MatchResult matchResult = null;
            try {
                matchResult = policyDef.match(evaluationContext);
                switch (matchResult.getMatchCode()) {
                case INDETERMINATE:
                    if (firstIndeterminate == null) {
                        firstIndeterminate = new StdPolicyFinderResult<PolicyDef>(matchResult.getStatus());
                    }
                    break;
                case MATCH:
                    if (policyDefFirstMatch == null) {
                        policyDefFirstMatch = policyDef;
                    } else {
                        return PFR_MULTIPLE;
                    }
                    break;
                case NOMATCH:
                    break;
                }
            } catch (EvaluationException ex) {
                if (firstIndeterminate == null) {
                    firstIndeterminate = new StdPolicyFinderResult<PolicyDef>(
                                                                              new StdStatus(
                                                                                            StdStatusCode.STATUS_CODE_PROCESSING_ERROR,
                                                                                            ex.getMessage()));
                }
            }
        }

        if (policyDefFirstMatch == null) {
            if (firstIndeterminate != null) {
                return firstIndeterminate;
            } else {
                return PFR_NOT_FOUND;
            }
        } else {
            return new StdPolicyFinderResult<PolicyDef>(policyDefFirstMatch);
        }
    }

    @Override
    public PolicyFinderResult<Policy> getPolicy(IdReferenceMatch idReferenceMatch) {
        return this.lookupPolicyByIdentifier(idReferenceMatch);
    }

    @Override
    public PolicyFinderResult<PolicySet> getPolicySet(IdReferenceMatch idReferenceMatch) {
        return this.lookupPolicySetByIdentifier(idReferenceMatch);
    }

    public void addReferencedPolicy(PolicyDef policyDef) {
        this.updatePolicyMap(policyDef);
    }
}