package io.oasp.module.security.common.base.accesscontrol;
   
   import io.oasp.module.security.common.api.accesscontrol.AccessControl;
   import io.oasp.module.security.common.api.accesscontrol.AccessControlGroup;
   import io.oasp.module.security.common.api.accesscontrol.AccessControlPermission;
   import io.oasp.module.security.common.api.accesscontrol.AccessControlProvider;
   import io.oasp.module.security.common.api.accesscontrol.AccessControlSchema;
   
   import java.util.HashMap;
  import java.util.HashSet;
  import java.util.List;
  import java.util.Map;
  import java.util.Set;
  
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  /**
   * This is the abstract base implementation of {@link AccessControlProvider}.<br/>
   * ATTENTION:<br/>
   * You need to call {@link #initialize(AccessControlSchema)} from the derived implementation.
   *
   * @author hohwille
   */
  public abstract class AbstractAccessControlProvider implements AccessControlProvider {
  
    /** Logger instance. */
    private static final Logger LOG = LoggerFactory.getLogger(AbstractAccessControlProvider.class);
  
    /** @see #getAccessControl(String) */
    private final Map<String, AccessControl> id2nodeMap;
  
    /**
     * The constructor.
     */
    public AbstractAccessControlProvider() {
  
      super();
      this.id2nodeMap = new HashMap<>();
    }
  
    /**
     * Performs the required initialization of this class.
     *
     * @param config is the {@link AccessControlSchema}.
     */
    protected void initialize(AccessControlSchema config) {
  
      LOG.debug("Initializing.");
      List<AccessControlGroup> groups = config.getGroups();
      if (groups.size() == 0) {
        throw new IllegalStateException("AccessControlSchema is empty - please configure at least one group!");
      }
      Set<AccessControlGroup> toplevelGroups = new HashSet<>(groups);
      for (AccessControlGroup group : groups) {
        collectAccessControls(group, toplevelGroups);
        checkForCyclicDependencies(group, new HashSet<AccessControlGroup>());
      }
    }
  
    /**
     * Checks that the given {@link AccessControlGroup} has no cyclic {@link AccessControlGroup#getInherits() inheritance
     * graph}.
     *
     * @param group is the {@link AccessControlGroup} to check.
     * @param visitedGroups is where the {@link AccessControlGroup} are collected to detect cycles.
     */
    protected void checkForCyclicDependencies(AccessControlGroup group, Set<AccessControlGroup> visitedGroups) {
  
      boolean added = visitedGroups.add(group);
      if (!added) {
        // mmm NodeCycleException would be very helpful here...
        throw new IllegalStateException("Cyclic inheritance of access control groups detected for " + group);
      }
      for (AccessControlGroup inheritedGroup : group.getInherits()) {
        checkForCyclicDependencies(inheritedGroup, visitedGroups);
      }
    }
  
    /**
     * Called from {@link #initialize(AccessControlSchema)} to collect all {@link AccessControl}s recursively.
     *
     * @param group the {@link AccessControlGroup} to traverse.
     * @param toplevelGroups is the {@link Set} of all {@link AccessControlGroup}s from
     *        {@link AccessControlSchema#getGroups()}.
     */
    protected void collectAccessControls(AccessControlGroup group, Set<AccessControlGroup> toplevelGroups) {
  
      // TODO hohwille Java HashMap buggy???
      // if (!toplevelGroups.contains(group)) {
      // throw new IllegalStateException("Invalid group not declared as top-level group in schema: " + group);
      // }
      AccessControl old = this.id2nodeMap.put(group.getId(), group);
      if (old != null) {
        LOG.debug("Already visited access control group {}", group);
        if (old != group) {
          throw new IllegalStateException("Invalid security configuration: duplicate groups with id " + group.getId()
              + "!");
        }
       // group has already been visited, stop recursion...
       return;
     } else {
       LOG.debug("Registered access control group {}", group);
     }
     for (AccessControlPermission permission : group.getPermissions()) {
       old = this.id2nodeMap.put(permission.getId(), permission);
       if (old != null) {
         // throw new IllegalStateException("Invalid security configuration: duplicate permission with id "
         // + permission.getId() + "!");
         LOG.warn("Security configuration contains duplicate permission with id {}.", permission.getId());
       } else {
         LOG.debug("Registered access control permission {}", permission);
       }
     }
     for (AccessControlGroup inheritedGroup : group.getInherits()) {
       collectAccessControls(inheritedGroup, toplevelGroups);
     }
   }
 
   @Override
   public AccessControl getAccessControl(String nodeId) {
 
     return this.id2nodeMap.get(nodeId);
   }
 
   @Override
   public boolean collectAccessControlIds(String groupId, Set<String> permissions) {
 
     AccessControl node = getAccessControl(groupId);
     if (node instanceof AccessControlGroup) {
       collectPermissionIds((AccessControlGroup) node, permissions);
     } else {
       // node does not exist or is a flat AccessControlPermission
       permissions.add(groupId);
     }
     return (node != null);
   }
 
   /**
    * Recursive implementation of {@link #collectAccessControlIds(String, Set)} for {@link AccessControlGroup}s.
    *
    * @param group is the {@link AccessControlGroup} to traverse.
    * @param permissions is the {@link Set} used to collect.
    */
   public void collectPermissionIds(AccessControlGroup group, Set<String> permissions) {
 
     boolean added = permissions.add(group.getId());
     if (!added) {
       // we have already visited this node, stop recursion...
       return;
     }
     for (AccessControlPermission permission : group.getPermissions()) {
       permissions.add(permission.getId());
     }
     for (AccessControlGroup inheritedGroup : group.getInherits()) {
       collectPermissionIds(inheritedGroup, permissions);
     }
   }
 
   @Override
   public boolean collectAccessControls(String groupId, Set<AccessControl> permissions) {
 
     AccessControl node = getAccessControl(groupId);
     if (node == null) {
       return false;
     }
     if (node instanceof AccessControlGroup) {
       collectPermissionNodes((AccessControlGroup) node, permissions);
     } else {
       // node is a flat AccessControlPermission
       permissions.add(node);
     }
     return true;
   }
 
   /**
    * Recursive implementation of {@link #collectAccessControls(String, Set)} for {@link AccessControlGroup}s.
    *
    * @param group is the {@link AccessControlGroup} to traverse.
    * @param permissions is the {@link Set} used to collect.
    */
   public void collectPermissionNodes(AccessControlGroup group, Set<AccessControl> permissions) {
 
     boolean added = permissions.add(group);
     if (!added) {
       // we have already visited this node, stop recursion...
       return;
     }
     for (AccessControlPermission permission : group.getPermissions()) {
       permissions.add(permission);
     }
     for (AccessControlGroup inheritedGroup : group.getInherits()) {
       collectPermissionNodes(inheritedGroup, permissions);
     }
   }
 
 }