/*
    * Licensed to The Apereo Foundation under one or more contributor license
    * agreements. See the NOTICE file distributed with this work for additional
    * information regarding copyright ownership.
    *
    *
    * The Apereo Foundation licenses this file to you under the Educational
    * Community License, Version 2.0 (the "License"); you may not use this file
    * except in compliance with the License. You may obtain a copy of the License
   * at:
   *
   *   http://opensource.org/licenses/ecl2.txt
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
   * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
   * License for the specific language governing permissions and limitations under
   * the License.
   *
   */
  
  package org.opencastproject.authorization.xacml;
  
  import static org.opencastproject.mediapackage.MediaPackageElements.XACML_POLICY_EPISODE;
  import static org.opencastproject.mediapackage.MediaPackageElements.XACML_POLICY_SERIES;
  import static org.opencastproject.security.util.SecurityUtil.getEpisodeRoleId;
  import static org.opencastproject.util.data.Tuple.tuple;
  
  import org.opencastproject.mediapackage.Attachment;
  import org.opencastproject.mediapackage.MediaPackage;
  import org.opencastproject.mediapackage.MediaPackageElementBuilderFactory;
  import org.opencastproject.mediapackage.MediaPackageElementFlavor;
  import org.opencastproject.mediapackage.MediaPackageException;
  import org.opencastproject.mediapackage.MediaPackageSerializer;
  import org.opencastproject.security.api.AccessControlEntry;
  import org.opencastproject.security.api.AccessControlList;
  import org.opencastproject.security.api.AclScope;
  import org.opencastproject.security.api.AuthorizationService;
  import org.opencastproject.security.api.Role;
  import org.opencastproject.security.api.SecurityService;
  import org.opencastproject.security.api.User;
  import org.opencastproject.util.MimeTypes;
  import org.opencastproject.util.NotFoundException;
  import org.opencastproject.util.data.Tuple;
  import org.opencastproject.workspace.api.Workspace;
  
  import org.apache.commons.io.IOUtils;
  import org.apache.commons.lang3.StringUtils;
  import org.osgi.service.component.ComponentContext;
  import org.osgi.service.component.annotations.Activate;
  import org.osgi.service.component.annotations.Component;
  import org.osgi.service.component.annotations.Modified;
  import org.osgi.service.component.annotations.Reference;
  import org.osgi.service.component.annotations.ReferenceCardinality;
  import org.osgi.service.component.annotations.ReferencePolicy;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  import java.io.IOException;
  import java.io.InputStream;
  import java.net.URI;
  import java.net.URISyntaxException;
  import java.util.Arrays;
  import java.util.Optional;
  
  import javax.xml.bind.JAXBException;
  
  /**
   * A XACML implementation of the {@link AuthorizationService}.
   */
  @Component(
      property = {
          "service.description=Provides translation between access control entries and xacml documents"
      },
      service = { AuthorizationService.class }
  )
  public class XACMLAuthorizationService implements AuthorizationService {
  
    /** The logger */
    private static final Logger logger = LoggerFactory.getLogger(XACMLAuthorizationService.class);
  
    /** The default filename for XACML attachments */
    private static final String XACML_FILENAME = "xacml.xml";
  
    /** The workspace */
    protected Workspace workspace;
  
    /** The security service */
    protected SecurityService securityService;
  
    /** The serializer for media pacakge */
    private MediaPackageSerializer serializer;
  
    private static final String CONFIG_MERGE_MODE = "merge.mode";
  
    /** Definition of how merging of series and episode ACLs work */
    private static MergeMode mergeMode = MergeMode.OVERRIDE;
  
    enum MergeMode {
     OVERRIDE, ROLES, ACTIONS
   }
 
   @Activate
   @Modified
   public void activate(ComponentContext cc) {
     var properties = cc.getProperties();
 
     if (properties == null) {
       mergeMode = MergeMode.OVERRIDE;
       logger.debug("Merge mode set to {}", mergeMode);
       logger.debug("Using episode ID roles is deactivated");
       return;
     }
     final String mode = StringUtils.defaultIfBlank((String) properties.get(CONFIG_MERGE_MODE),
         MergeMode.OVERRIDE.toString());
     try {
       mergeMode = MergeMode.valueOf(mode.toUpperCase());
     } catch (IllegalArgumentException e) {
       logger.warn("Invalid value set for ACL merge mode, defaulting to {}", MergeMode.OVERRIDE);
       mergeMode = MergeMode.OVERRIDE;
     }
     logger.debug("Merge mode set to {}", mergeMode);
   }
 
   @Reference(
       cardinality = ReferenceCardinality.OPTIONAL,
       policy = ReferencePolicy.DYNAMIC,
       unbind = "unsetMediaPackageSerializer",
       target = "(service.pid=org.opencastproject.mediapackage.ChainingMediaPackageSerializer)"
   )
   public void setMediaPackageSerializer(MediaPackageSerializer serializer) {
     this.serializer = serializer;
   }
 
   protected void unsetMediaPackageSerializer(MediaPackageSerializer serializer) {
     if (this.serializer == serializer) {
       this.serializer = null;
     }
   }
 
   @Override
   public Tuple<AccessControlList, AclScope> getActiveAcl(final MediaPackage mp) {
     logger.debug("getActiveACl for media package {}", mp.getIdentifier());
     return getAcl(mp, AclScope.Episode);
   }
 
   @Override
   public Tuple<AccessControlList, AclScope> getAcl(final MediaPackage mp, final AclScope scope) {
     Optional<AccessControlList> episode = Optional.empty();
     Optional<AccessControlList> series = Optional.empty();
 
     // Start with the requested scope but fall back to the less specific scope if it does not exist.
     // The order is: episode -> series -> general (deprecated) -> global
     if (AclScope.Episode.equals(scope) || AclScope.Merged.equals(scope)) {
       episode = getAclByFlavor(mp, XACML_POLICY_EPISODE);
     }
     if (Arrays.asList(AclScope.Episode, AclScope.Series, AclScope.Merged).contains(scope)) {
       series = getAclByFlavor(mp, XACML_POLICY_SERIES);
     }
 
     if (episode.isPresent() && series.isPresent()) {
       logger.debug("Found event and series ACL for media package {}", mp.getIdentifier());
       switch (mergeMode) {
         case ACTIONS:
           logger.debug("Merging ACLs based on individual actions");
           return tuple(series.get().mergeActions(episode.get()), AclScope.Merged);
         case ROLES:
           logger.debug("Merging ACLs based on roles");
           return tuple(series.get().merge(episode.get()), AclScope.Merged);
         default:
           logger.debug("Episode ACL overrides series ACL");
           return tuple(episode.get(), AclScope.Merged);
       }
     }
     if (episode.isPresent()) {
       logger.debug("Found event ACL for media package {}", mp.getIdentifier());
       return tuple(episode.get(), AclScope.Episode);
     }
     if (series.isPresent()) {
       logger.debug("Found series ACL for media package {}", mp.getIdentifier());
       return tuple(series.get(), AclScope.Series);
     }
 
     logger.debug("Falling back to global default ACL");
     return tuple(new AccessControlList(), AclScope.Global);
   }
 
   private Optional<AccessControlList> getAclByFlavor(MediaPackage mp, MediaPackageElementFlavor xacmlPolicyFlavor) {
     Optional<AccessControlList> acl = Optional.empty();
     for (Attachment xacml : mp.getAttachments(xacmlPolicyFlavor)) {
       URI uri = xacml.getURI();
       try {
         if (serializer != null) {
           uri = serializer.decodeURI(uri);
         }
       } catch (URISyntaxException e) {
         logger.warn("URI {} syntax error, skip decoding", uri);
       }
       acl = loadAcl(uri);
     }
     return acl;
   }
 
   @Override
   public Tuple<MediaPackage, Attachment> setAcl(
       final MediaPackage mp,
       final AclScope scope,
       final AccessControlList acl
   ) throws MediaPackageException {
     // Get XACML representation of these role + action tuples
     String xacmlContent;
     try {
       xacmlContent = XACMLUtils.getXacml(mp, acl);
     } catch (JAXBException e) {
       throw new MediaPackageException("Unable to generate xacml for media package " + mp.getIdentifier());
     }
 
     // Remove the old xacml file(s)
     Attachment attachment = removeFromMediaPackageAndWorkspace(mp, toFlavor(scope)).getB();
 
     // add attachment
     final String elementId = toElementId(scope);
     URI uri;
     try (InputStream in = IOUtils.toInputStream(xacmlContent, "UTF-8")) {
       uri = workspace.put(mp.getIdentifier().toString(), elementId, XACML_FILENAME, in);
     } catch (IOException e) {
       throw new MediaPackageException("Error storing xacml for media package " + mp.getIdentifier());
     }
 
     if (attachment == null) {
       attachment = (Attachment) MediaPackageElementBuilderFactory.newInstance().newElementBuilder()
               .elementFromURI(uri, Attachment.TYPE, toFlavor(scope));
     }
     attachment.setURI(uri);
     attachment.setIdentifier(elementId);
     attachment.setMimeType(MimeTypes.XML);
     // setting the URI to a new source so the checksum will most like be invalid
     attachment.setChecksum(null);
     mp.add(attachment);
 
     logger.debug("Saved XACML as {}", uri);
 
     // return augmented media package
     return tuple(mp, attachment);
   }
 
   @Override
   public MediaPackage removeAcl(MediaPackage mp, AclScope scope) {
     return removeFromMediaPackageAndWorkspace(mp, toFlavor(scope)).getA();
   }
 
   /** Get the flavor associated with a scope. */
   private static MediaPackageElementFlavor toFlavor(AclScope scope) {
     switch (scope) {
       case Episode:
         return XACML_POLICY_EPISODE;
       case Series:
         return XACML_POLICY_SERIES;
       default:
         throw new IllegalArgumentException("No flavors match the given ACL scope");
     }
   }
 
   /** Get the element id associated with a scope. */
   private static String toElementId(AclScope scope) {
     switch (scope) {
       case Episode:
         return "security-policy-episode";
       case Series:
         return "security-policy-series";
       default:
         throw new IllegalArgumentException("No element id matches the given ACL scope");
     }
   }
 
   /**
    * Remove all attachments of the given flavors from media package and workspace.
    *
    * @return the a tuple with the mutated (!) media package as A and the deleted Attachment as B
    */
   private Tuple<MediaPackage, Attachment> removeFromMediaPackageAndWorkspace(MediaPackage mp,
           MediaPackageElementFlavor flavor) {
     Attachment attachment = null;
     for (Attachment a : mp.getAttachments(flavor)) {
       attachment = (Attachment) a.clone();
       try {
         workspace.delete(a.getURI());
       } catch (Exception e) {
         logger.warn("Unable to delete XACML file:", e);
       }
       mp.remove(a);
     }
     return Tuple.tuple(mp, attachment);
   }
 
   /** Load an ACL from the given URI. */
   private Optional<AccessControlList> loadAcl(final URI uri) {
     logger.debug("Load Acl from {}", uri);
     try (InputStream is = workspace.read(uri)) {
       AccessControlList acl = XACMLUtils.parseXacml(is);
       return Optional.of(acl);
     } catch (NotFoundException e) {
       logger.debug("URI {} not found", uri);
     } catch (Exception e) {
       logger.warn("Unable to load or parse Acl from URI {}", uri, e);
     }
     return Optional.empty();
   }
 
   public boolean hasPermission(final MediaPackage mp, final String action) {
     AccessControlList acl = getActiveAcl(mp).getA();
 
     // Check special ROLE_EPISODE_<ID>_<ACTION> permissions
     final User user = securityService.getUser();
     var episodeRole = getEpisodeRoleId(mp.getIdentifier().toString(), action);
     logger.debug("Checking for role: {}", episodeRole);
     var allowed = user.getRoles().stream().map(Role::getName).anyMatch(r -> r.equals(episodeRole));
 
     return allowed || hasPermission(acl, action);
   }
 
   @Override
   public boolean hasPermission(AccessControlList acl, final String action) {
     final User user = securityService.getUser();
     var allowed = false;
 
     // Check ACL
     for (AccessControlEntry entry: acl.getEntries()) {
       // ignore entries for other actions
       if (!entry.getAction().equals(action)) {
         continue;
       }
       for (Role role : user.getRoles()) {
         if (entry.getRole().equals(role.getName())) {
           // immediately abort on matching deny rules
           // (never allow if a deny rule matches, even if another allow rule matches)
           if (!entry.isAllow()) {
             logger.debug("Access explicitly denied for role({}), action({})", role.getName(), action);
             return false;
           }
           allowed = true;
         }
       }
     }
     logger.debug("XACML file allowed access");
     return allowed;
   }
 
   /**
    * Sets the workspace to use for retrieving XACML policies
    *
    * @param workspace
    *          the workspace to set
    */
   @Reference
   public void setWorkspace(Workspace workspace) {
     this.workspace = workspace;
   }
 
   /**
    * Declarative services callback to set the security service.
    *
    * @param securityService
    *          the security service
    */
   @Reference
   public void setSecurityService(SecurityService securityService) {
     this.securityService = securityService;
   }
 
 }