/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.apache.sling.jcr.jackrabbit.accessmanager.post;

import java.security.Principal;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Set;

import javax.jcr.Item;
import javax.jcr.RepositoryException;
import javax.jcr.Session;
import javax.jcr.Value;
import javax.jcr.ValueFactory;
import javax.servlet.Servlet;

import org.apache.jackrabbit.api.security.principal.PrincipalManager;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinition;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
import org.apache.sling.api.SlingHttpServletRequest;
import org.apache.sling.api.resource.ResourceNotFoundException;
import org.apache.sling.jcr.base.util.AccessControlUtil;
import org.apache.sling.jcr.jackrabbit.accessmanager.ModifyAce;
import org.apache.sling.servlets.post.Modification;
import org.apache.sling.servlets.post.PostResponse;
import org.apache.sling.servlets.post.PostResponseCreator;
import org.osgi.service.component.annotations.Component;
import org.osgi.service.component.annotations.Reference;
import org.osgi.service.component.annotations.ReferenceCardinality;
import org.osgi.service.component.annotations.ReferencePolicy;
import org.osgi.service.component.annotations.ReferencePolicyOption;

/**
 * <p>
 * Sling Post Servlet implementation for modifying the ACEs for a principal on a JCR
 * resource.
 * </p>
 * <h2>Rest Service Description</h2>
 * <p>
 * Modify a principal's ACEs for the node identified as a resource by the request
 * URL &gt;resource&lt;.modifyAce.html
 * </p>
 * <h3>Transport Details:</h3>
 * <h4>Methods</h4>
 * <ul>
 * <li>POST</li>
 * </ul>
 * <h4>Post Parameters</h4>
 * <dl>
 * <dt>principalId</dt>
 * <dd>The principal of the ACEs to modify in the ACL specified by the path.</dd>
 * <dt>privilege@*</dt>
 * <dd>One or more privileges, either granted or denied or none, which will be applied
 * to (or removed from) the node ACL. Any permissions that are present in an
 * existing ACE for the principal but not in the request are left untouched.</dd>
 * <dt>restriction@*</dt>
 * <dd>One or more restrictions which will be applied to the ACE</dd>
 * <dt>restriction@*@Delete</dt>
 * <dd>One or more restrictions which will be removed from the ACE</dd>
 * </dl>
 *
 * <h4>Response</h4>
 * <dl>
 * <dt>200</dt>
 * <dd>Success.</dd>
 * <dt>404</dt>
 * <dd>The resource was not found.</dd>
 * <dt>500</dt>
 * <dd>Failure. HTML explains the failure.</dd>
 * </dl>
 *
 * <h4>Notes</h4>
 * <p>
 * The principalId is assumed to refer directly to an Authorizable, that comes direct from
 * the UserManager. This can be a group or a user, but if its a group, denied permissions
 * will not be added to the group. The group will only contain granted privileges.
 * </p>
 */

@Component(service = {Servlet.class, ModifyAce.class},
property= {
        "sling.servlet.resourceTypes=sling/servlet/default",
        "sling.servlet.methods=POST",
        "sling.servlet.selectors=modifyAce",
        "sling.servlet.prefix:Integer=-1"
})
public class ModifyAceServlet extends AbstractAccessPostServlet implements ModifyAce {
    private static final long serialVersionUID = -9182485466670280437L;

    private transient RestrictionProvider restrictionProvider = null;

    // NOTE: the @Reference annotation is not inherited, so subclasses will need to override the #bindRestrictionProvider 
    // and #unbindRestrictionProvider methods to provide the @Reference annotation.     
    //
    @Reference(cardinality=ReferenceCardinality.OPTIONAL, policy = ReferencePolicy.DYNAMIC, policyOption=ReferencePolicyOption.GREEDY)
    protected void bindRestrictionProvider(RestrictionProvider rp) {
        this.restrictionProvider = rp;
    }
    protected void unbindRestrictionProvider(RestrictionProvider rp) { //NOSONAR
        this.restrictionProvider = null;
    }

    /**
     * Overridden since the @Reference annotation is not inherited from the super method
     */
    @Override
    @Reference(service = PostResponseCreator.class,
        cardinality = ReferenceCardinality.MULTIPLE,
        policy = ReferencePolicy.DYNAMIC)
    protected void bindPostResponseCreator(PostResponseCreator creator, Map<String, Object> properties) {
        super.bindPostResponseCreator(creator, properties);
    }

    /* (non-Javadoc)
     * @see org.apache.sling.jackrabbit.usermanager.impl.post.AbstractPostServlet#unbindPostResponseCreator(org.apache.sling.servlets.post.PostResponseCreator, java.util.Map)
     */
    @Override
    protected void unbindPostResponseCreator(PostResponseCreator creator, Map<String, Object> properties) { //NOSONAR
        super.unbindPostResponseCreator(creator, properties);
    }

    /* (non-Javadoc)
     * @see org.apache.sling.jackrabbit.accessmanager.post.AbstractAccessPostServlet#handleOperation(org.apache.sling.api.SlingHttpServletRequest, org.apache.sling.servlets.post.PostResponse, java.util.List)
     */
    @Override
    protected void handleOperation(SlingHttpServletRequest request,
            PostResponse response, List<Modification> changes)
            throws RepositoryException {
        Session session = request.getResourceResolver().adaptTo(Session.class);
        String resourcePath = request.getResource().getPath();
        String principalId = request.getParameter("principalId");
        Map<String, String> privileges = new HashMap<>();
        Map<String, Value> restrictions = new HashMap<>();
        Map<String, Value[]> mvRestrictions = new HashMap<>();
        Set<String> removeRestrictionNames = new HashSet<>();

        //lazy initialized map for quick lookup when processing POSTed restrictions
        Map<String, RestrictionDefinition> supportedRestrictionsMap = null;
        ValueFactory factory = session.getValueFactory();

        Enumeration<?> parameterNames = request.getParameterNames();
        while (parameterNames.hasMoreElements()) {
            Object nextElement = parameterNames.nextElement();
            if (nextElement instanceof String) {
                String paramName = (String)nextElement;
                if (paramName.startsWith("privilege@")) {
                    String privilegeName = paramName.substring(10);
                    String parameterValue = request.getParameter(paramName);
                    privileges.put(privilegeName, parameterValue);
                } else if (paramName.startsWith("restriction@")) {
                    if (restrictionProvider == null) {
                        throw new IllegalArgumentException("No restriction provider is available so unable to process POSTed restriction values");
                    }
                    if (supportedRestrictionsMap == null) {
                        supportedRestrictionsMap = new HashMap<>();

                        //populate the map for quick lookup below
                        Set<RestrictionDefinition> supportedRestrictions = restrictionProvider.getSupportedRestrictions(resourcePath);
                        for (RestrictionDefinition restrictionDefinition : supportedRestrictions) {
                            supportedRestrictionsMap.put(restrictionDefinition.getName(), restrictionDefinition);
                        }
                    }

                    if (paramName.endsWith("@Delete")) {
                        String restrictionName = paramName.substring(12, paramName.length() - 7);
                        removeRestrictionNames.add(restrictionName);
                    } else {
                        String restrictionName = paramName.substring(12);
                        String[] parameterValues = request.getParameterValues(paramName);
                        if (parameterValues != null) {
                            RestrictionDefinition rd = supportedRestrictionsMap.get(restrictionName);
                            if (rd == null) {
                                //illegal restriction name?
                                throw new IllegalArgumentException("Invalid or not supported restriction name was supplied");
                            }

                            boolean multival = rd.getRequiredType().isArray();
                            int restrictionType = rd.getRequiredType().tag();

                            if (multival) {
                                Value [] v = new Value[parameterValues.length];
                                for (int j = 0; j < parameterValues.length; j++) {
                                    String string = parameterValues[j];
                                    v[j] = factory.createValue(string, restrictionType);
                                }

                                mvRestrictions.put(restrictionName, v);
                            } else if (parameterValues.length > 0) {
                                Value v = factory.createValue(parameterValues[0], restrictionType);
                                restrictions.put(restrictionName, v);
                            }
                        }
                    }
                }
            }
        }
        String order = request.getParameter("order");
        modifyAce(session, resourcePath, principalId, privileges, order, restrictions, mvRestrictions, 
                removeRestrictionNames, false, changes);
    }

    /* (non-Javadoc)
     * @see org.apache.sling.jcr.jackrabbit.accessmanager.ModifyAce#modifyAce(javax.jcr.Session, java.lang.String, java.lang.String, java.util.Map, java.lang.String, boolean)
     */
    @Override
    public void modifyAce(Session jcrSession, String resourcePath, String principalId, Map<String, String> privileges,
            String order, boolean autoSave) throws RepositoryException {
        modifyAce(jcrSession, resourcePath, principalId, privileges, order, 
                null, null, null, autoSave);
    }

    /* (non-Javadoc)
     * @see org.apache.sling.jcr.jackrabbit.accessmanager.ModifyAce#modifyAce(javax.jcr.Session, java.lang.String, java.lang.String, java.util.Map, java.lang.String)
     */
    public void modifyAce(Session jcrSession, String resourcePath,
            String principalId, Map<String, String> privileges, String order)
            throws RepositoryException {
        modifyAce(jcrSession, resourcePath, principalId, privileges, order, true);
    }
    
    /* (non-Javadoc)
     * @see org.apache.sling.jcr.jackrabbit.accessmanager.ModifyAce#modifyAce(javax.jcr.Session, java.lang.String, java.lang.String, java.util.Map, java.lang.String, java.util.Map, java.util.Map, java.util.Set)
     */
    @Override
    public void modifyAce(Session jcrSession, String resourcePath, String principalId, Map<String, String> privileges,
            String order, Map<String, Value> restrictions, Map<String, Value[]> mvRestrictions,
            Set<String> removeRestrictionNames) throws RepositoryException {
        modifyAce(jcrSession, resourcePath, principalId, privileges, order, 
                restrictions, mvRestrictions, removeRestrictionNames, true);
    }

    /* (non-Javadoc)
     * @see org.apache.sling.jcr.jackrabbit.accessmanager.ModifyAce#modifyAce(javax.jcr.Session, java.lang.String, java.lang.String, java.util.Map, java.lang.String, java.util.Map, java.util.Map, java.util.Set, boolean)
     */
    @Override
    public void modifyAce(Session jcrSession, String resourcePath, String principalId, Map<String, String> privileges,
            String order, Map<String, Value> restrictions, Map<String, Value[]> mvRestrictions,
            Set<String> removeRestrictionNames, boolean autoSave) throws RepositoryException {
        modifyAce(jcrSession, resourcePath, principalId, privileges, order, 
                restrictions, mvRestrictions, removeRestrictionNames, autoSave, null);
    }

    protected void modifyAce( // NOSONAR
            Session jcrSession, String resourcePath, String principalId, Map<String, String> privileges,
            String order, Map<String, Value> restrictions, Map<String, Value[]> mvRestrictions,
            Set<String> removeRestrictionNames, boolean autoSave, List<Modification> changes) throws RepositoryException {
        if (jcrSession == null) {
            throw new RepositoryException("JCR Session not found");
        }

        if (principalId == null) {
            throw new RepositoryException("principalId was not submitted.");
        }

        // validate that the submitted name is valid
        PrincipalManager principalManager = AccessControlUtil.getPrincipalManager(jcrSession);
        Principal principal = principalManager.getPrincipal(principalId);
        if (principal == null) {
            throw new RepositoryException("Invalid principalId was submitted.");
        }

        if (resourcePath == null) {
            throw new ResourceNotFoundException("Resource path was not supplied.");
        }

        Item item = jcrSession.getItem(resourcePath);
        if (item != null) {
            resourcePath = item.getPath();
        } else {
            throw new ResourceNotFoundException("Resource is not a JCR Node");
        }

        // Collect the modified privileges from the request.
        Set<String> grantedPrivilegeNames = new HashSet<>();
        Set<String> deniedPrivilegeNames = new HashSet<>();
        Set<String> removedPrivilegeNames = new HashSet<>();
        if (privileges != null) {
            Set<Entry<String, String>> entrySet = privileges.entrySet();
            for (Entry<String, String> entry : entrySet) {
                String privilegeName = entry.getKey();
                if (privilegeName.startsWith("privilege@")) {
                    privilegeName = privilegeName.substring(10);
                }
                String parameterValue = entry.getValue();
                if (parameterValue != null && parameterValue.length() > 0) {
                    if ("granted".equals(parameterValue)) {
                        grantedPrivilegeNames.add(privilegeName);
                    } else if ("denied".equals(parameterValue)) {
                        deniedPrivilegeNames.add(privilegeName);
                    } else if ("none".equals(parameterValue)){
                        removedPrivilegeNames.add(privilegeName);
                    }
                }
            }
        }

        // Make the actual changes.
        try {
            AccessControlUtil.replaceAccessControlEntry(jcrSession, resourcePath, principal,
                    grantedPrivilegeNames.toArray(new String[grantedPrivilegeNames.size()]),
                    deniedPrivilegeNames.toArray(new String[deniedPrivilegeNames.size()]),
                    removedPrivilegeNames.toArray(new String[removedPrivilegeNames.size()]),
                    order,
                    restrictions,
                    mvRestrictions,
                    removeRestrictionNames);

            if (changes != null) {
                changes.add(Modification.onModified(principal.getName()));
            }

            if (autoSave && jcrSession.hasPendingChanges()) {
                jcrSession.save();
            }
        } catch (RepositoryException re) {
            throw new RepositoryException("Failed to create ace.", re);
        }
    }

}