/*
    * Licensed to The Apereo Foundation under one or more contributor license
    * agreements. See the NOTICE file distributed with this work for additional
    * information regarding copyright ownership.
    *
    *
    * The Apereo Foundation licenses this file to you under the Educational
    * Community License, Version 2.0 (the "License"); you may not use this file
    * except in compliance with the License. You may obtain a copy of the License
   * at:
   *
   *   http://opensource.org/licenses/ecl2.txt
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
   * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
   * License for the specific language governing permissions and limitations under
   * the License.
   *
   */
  
  package org.opencastproject.userdirectory;
  
  import static org.opencastproject.db.Queries.namedQuery;
  
  import org.opencastproject.db.DBSession;
  import org.opencastproject.db.DBSessionFactory;
  import org.opencastproject.kernel.security.CustomPasswordEncoder;
  import org.opencastproject.security.api.Group;
  import org.opencastproject.security.api.Role;
  import org.opencastproject.security.api.RoleProvider;
  import org.opencastproject.security.api.SecurityService;
  import org.opencastproject.security.api.UnauthorizedException;
  import org.opencastproject.security.api.User;
  import org.opencastproject.security.api.UserProvider;
  import org.opencastproject.security.impl.jpa.JpaOrganization;
  import org.opencastproject.security.impl.jpa.JpaRole;
  import org.opencastproject.security.impl.jpa.JpaUser;
  import org.opencastproject.userdirectory.utils.UserDirectoryUtils;
  import org.opencastproject.util.NotFoundException;
  
  import com.google.common.cache.CacheBuilder;
  import com.google.common.cache.CacheLoader;
  import com.google.common.cache.LoadingCache;
  
  import org.apache.commons.lang3.StringUtils;
  import org.apache.commons.lang3.tuple.Pair;
  import org.osgi.service.component.ComponentContext;
  import org.osgi.service.component.annotations.Activate;
  import org.osgi.service.component.annotations.Component;
  import org.osgi.service.component.annotations.Reference;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  import java.util.ArrayList;
  import java.util.Collection;
  import java.util.Collections;
  import java.util.HashSet;
  import java.util.Iterator;
  import java.util.List;
  import java.util.Optional;
  import java.util.Set;
  import java.util.concurrent.TimeUnit;
  import java.util.stream.Collectors;
  
  import javax.persistence.EntityManagerFactory;
  
  /**
   * Manages and locates users using JPA.
   */
  @Component(
      property = {
          "service.description=Provides a user directory"
      },
      immediate = true,
      service = { UserProvider.class, RoleProvider.class, JpaUserAndRoleProvider.class }
  )
  public class JpaUserAndRoleProvider implements UserProvider, RoleProvider {
  
    /** The logger */
    private static final Logger logger = LoggerFactory.getLogger(JpaUserAndRoleProvider.class);
  
    public static final String PERSISTENCE_UNIT = "org.opencastproject.common";
  
    /** The user provider name */
    public static final String PROVIDER_NAME = "opencast";
  
    /** Username constant used in JSON formatted users */
    public static final String USERNAME = "username";
  
    /** Role constant used in JSON formatted users */
    public static final String ROLES = "roles";
  
    /** Encoding expected from all inputs */
    public static final String ENCODING = "UTF-8";
  
    /** The delimiter for the User cache */
    private static final String DELIMITER = ";==;";
  
   /** The security service */
   protected SecurityService securityService = null;
 
   /** Group provider */
   protected JpaGroupRoleProvider groupRoleProvider;
 
   /** A cache of users, which lightens the load on the SQL server */
   private LoadingCache<String, Object> cache = null;
 
   /** A token to store in the miss cache */
   protected Object nullToken = new Object();
 
   /** Password encoder for storing user passwords */
   private CustomPasswordEncoder passwordEncoder = new CustomPasswordEncoder();
 
   /** The factory used to generate the entity manager */
   protected EntityManagerFactory emf = null;
 
   protected DBSessionFactory dbSessionFactory;
 
   protected DBSession db;
 
   /** OSGi DI */
   @Reference(target = "(osgi.unit.name=org.opencastproject.common)")
   void setEntityManagerFactory(EntityManagerFactory emf) {
     this.emf = emf;
   }
 
   @Reference
   public void setDBSessionFactory(DBSessionFactory dbSessionFactory) {
     this.dbSessionFactory = dbSessionFactory;
   }
 
   /**
    * @param securityService
    *          the securityService to set
    */
   @Reference
   public void setSecurityService(SecurityService securityService) {
     this.securityService = securityService;
   }
 
   /**
    * @param groupRoleProvider
    *          the groupRoleProvider to set
    */
   @Reference
   void setGroupRoleProvider(JpaGroupRoleProvider groupRoleProvider) {
     this.groupRoleProvider = groupRoleProvider;
   }
 
   /**
    * Callback for activation of this component.
    *
    * @param cc
    *          the component context
    */
   @Activate
   public void activate(ComponentContext cc) {
     logger.debug("activate");
 
     // Setup the caches
     cache = CacheBuilder.newBuilder().expireAfterWrite(1, TimeUnit.MINUTES).build(new CacheLoader<>() {
       @Override
       public Object load(String id) {
         String[] key = id.split(DELIMITER);
         logger.trace("Loading user '{}':'{}' from database", key[0], key[1]);
         User user = loadUser(key[0], key[1]);
         return user == null ? nullToken : user;
       }
     });
 
     db = dbSessionFactory.createSession(emf);
   }
 
   /**
    * {@inheritDoc}
    *
    * @see org.opencastproject.security.api.RoleProvider#getRolesForUser(String)
    */
   @Override
   public List<Role> getRolesForUser(String userName) {
     ArrayList<Role> roles = new ArrayList<>();
     User user = loadUser(userName);
     if (user == null) {
       return roles;
     }
     roles.addAll(user.getRoles());
     return roles;
   }
 
   /**
    * {@inheritDoc}
    *
    * @see org.opencastproject.security.api.UserProvider#findUsers(String, int, int)
    */
   @Override
   public Iterator<User> findUsers(String query, int offset, int limit) {
     if (query == null) {
       throw new IllegalArgumentException("Query must be set");
     }
     String orgId = securityService.getOrganization().getId();
     return db.exec(UserDirectoryPersistenceUtil.findUsersByQuery(orgId, query, limit, offset)).stream()
         .map(JpaUserAndRoleProvider::addProviderName)
         .collect(Collectors.toList())
         .iterator();
   }
 
   @Override
   public Iterator<User> findUsers(Collection<String> userNames) {
     String orgId = securityService.getOrganization().getId();
     return db.exec(UserDirectoryPersistenceUtil.findUsersByUserNameQuery(userNames, orgId)).stream()
         .map(JpaUserAndRoleProvider::addProviderName)
         .collect(Collectors.toList())
         .iterator();
   }
 
   /**
    * List all users with insecure password hashes
    */
   public List<User> findInsecurePasswordHashes() {
     final String orgId = securityService.getOrganization().getId();
     return db.exec(namedQuery.findAll(
         "User.findInsecureHash",
         User.class,
         Pair.of("org", orgId)
     ));
   }
 
   /**
    * {@inheritDoc}
    *
    * @see org.opencastproject.security.api.RoleProvider#findRoles(String, Role.Target, int, int)
    */
   @Override
   public Iterator<Role> findRoles(String query, Role.Target target, int offset, int limit) {
     if (query == null) {
       throw new IllegalArgumentException("Query must be set");
     }
 
     // This provider persists roles but is not authoritative for any roles, so return an empty set
     return Collections.emptyIterator();
   }
 
   /**
    * {@inheritDoc}
    *
    * @see org.opencastproject.security.api.UserProvider#loadUser(java.lang.String)
    */
   @Override
   public User loadUser(String userName) {
     String orgId = securityService.getOrganization().getId();
     Object user = cache.getUnchecked(userName.concat(DELIMITER).concat(orgId));
     if (user == nullToken) {
       return null;
     } else {
       return (User) user;
     }
   }
 
   @Override
   public Iterator<User> getUsers() {
     String orgId = securityService.getOrganization().getId();
     return db.exec(UserDirectoryPersistenceUtil.findUsersQuery(orgId, 0, 0)).stream()
         .map(JpaUserAndRoleProvider::addProviderName)
         .collect(Collectors.toList())
         .iterator();
   }
 
   /**
    * {@inheritDoc}
    *
    * @see org.opencastproject.security.api.UserProvider#getOrganization()
    */
   @Override
   public String getOrganization() {
     return ALL_ORGANIZATIONS;
   }
 
   /**
    * {@inheritDoc}
    *
    * @see java.lang.Object#toString()
    */
   @Override
   public String toString() {
     return getClass().getName();
   }
 
   /**
    * Loads a user from persistence
    *
    * @param userName
    *          the user name
    * @param organization
    *          the organization id
    * @return the loaded user or <code>null</code> if not found
    */
   public User loadUser(String userName, String organization) {
     return db.exec(UserDirectoryPersistenceUtil.findUserQuery(userName, organization))
         .map(JpaUserAndRoleProvider::addProviderName)
         .orElse(null);
   }
 
   /**
    * Loads a user from persistence
    *
    * @param userId
    *          the user's id
    * @param organization
    *          the organization id
    * @return the loaded user or <code>null</code> if not found
    */
   public User loadUser(long userId, String organization) {
     return db.exec(UserDirectoryPersistenceUtil.findUserQuery(userId, organization))
         .map(JpaUserAndRoleProvider::addProviderName)
         .orElse(null);
   }
 
   /**
    * Adds a user to the persistence
    *
    * @param user
    *          the user to add
    *
    * @throws org.opencastproject.security.api.UnauthorizedException
    *          if the user is not allowed to create other user with the given roles
    */
   public void addUser(JpaUser user) throws UnauthorizedException {
     addUser(user, false);
   }
 
   /**
    * Adds a user to the persistence
    *
    * @param user
    *          the user to add
    * @param passwordEncoded
    *          if the password is already encoded or should be encoded
    *
    * @throws org.opencastproject.security.api.UnauthorizedException
    *          if the user is not allowed to create other user with the given roles
    */
   public void addUser(JpaUser user, final boolean passwordEncoded) throws UnauthorizedException {
     if (!UserDirectoryUtils.isCurrentUserAuthorizedHandleRoles(securityService, user.getRoles())) {
       throw new UnauthorizedException("The user is not allowed to set the admin role on other users");
     }
 
     // Create a JPA user with an encoded password.
     String encodedPassword = passwordEncoded
         ? user.getPassword()
         : passwordEncoder.encodePassword(user.getPassword());
 
     db.execTx(em -> {
       // Only save internal roles
       Set<JpaRole> roles = UserDirectoryPersistenceUtil.saveRolesQuery(filterRoles(user.getRoles())).apply(em);
       JpaOrganization organization = UserDirectoryPersistenceUtil.saveOrganizationQuery(
           (JpaOrganization) user.getOrganization()).apply(em);
 
       JpaUser newUser = new JpaUser(user.getUsername(), encodedPassword, organization, user.getName(), user.getEmail(),
           user.getProvider(), user.isManageable(), roles);
 
       // Then save the user
       em.persist(newUser);
       cache.put(user.getUsername() + DELIMITER + user.getOrganization().getId(), newUser);
     });
     updateGroupMembership(user);
   }
 
   /**
    * Updates a user to the persistence
    *
    * @param user
    *          the user to save
    * @throws NotFoundException
    * @throws org.opencastproject.security.api.UnauthorizedException
    *          if the current user is not allowed to update user with the given roles
    */
   public User updateUser(JpaUser user) throws NotFoundException, UnauthorizedException {
     return updateUser(user, false);
   }
 
   /**
    * Updates a user to the persistence
    *
    * @param user
    *          the user to save
    * @param passwordEncoded
    *          if the password is already encoded or should be encoded
    * @throws NotFoundException
    * @throws org.opencastproject.security.api.UnauthorizedException
    *          if the current user is not allowed to update user with the given roles
    */
   public User updateUser(JpaUser user, final boolean passwordEncoded) throws NotFoundException, UnauthorizedException {
     if (!UserDirectoryUtils.isCurrentUserAuthorizedHandleRoles(securityService, user.getRoles())) {
       throw new UnauthorizedException("The user is not allowed to set the admin role on other users");
     }
 
     try {
       return db.execTxChecked(em -> {
         Optional<JpaUser> updateUser = UserDirectoryPersistenceUtil.findUserQuery(user.getUsername(),
             user.getOrganization().getId()).apply(em);
         if (updateUser.isEmpty()) {
           throw new NotFoundException("User " + user.getUsername() + " not found.");
         }
 
         logger.debug("updateUser({})", user.getUsername());
 
         if (!UserDirectoryUtils.isCurrentUserAuthorizedHandleRoles(securityService, updateUser.get().getRoles())) {
           throw new UnauthorizedException("The user is not allowed to update an admin user");
         }
 
         String encodedPassword;
         //only update Password if a value is set
         if (StringUtils.isEmpty(user.getPassword())) {
           encodedPassword = updateUser.get().getPassword();
         } else  {
           // Update an JPA user with an encoded password.
           if (passwordEncoded) {
             encodedPassword = user.getPassword();
           } else {
             encodedPassword = passwordEncoder.encodePassword(user.getPassword());
           }
         }
 
         // Only save internal roles
         Set<JpaRole> roles = UserDirectoryPersistenceUtil.saveRolesQuery(filterRoles(user.getRoles())).apply(em);
         JpaOrganization organization = UserDirectoryPersistenceUtil.saveOrganizationQuery(
             (JpaOrganization) user.getOrganization()).apply(em);
 
         JpaUser updatedUser = UserDirectoryPersistenceUtil.saveUserQuery(
             new JpaUser(user.getUsername(), encodedPassword, organization, user.getName(), user.getEmail(), user
                 .getProvider(), true, roles)).apply(em);
         cache.put(user.getUsername() + DELIMITER + organization.getId(), updatedUser);
 
         updateGroupMembership(user);
 
         return updatedUser;
       });
     } catch (NotFoundException | UnauthorizedException | RuntimeException e) {
       throw e;
     } catch (Exception e) {
       throw new IllegalStateException(e);
     }
   }
 
   /**
    * Select only internal roles
    *
    * @param userRoles
    *          the user's full set of roles
    */
   private Set<JpaRole> filterRoles(Set<Role> userRoles) {
     Set<JpaRole> roles = new HashSet<>();
     for (Role role : userRoles) {
       if (Role.Type.INTERNAL.equals(role.getType()) && !role.getName().startsWith(Group.ROLE_PREFIX)) {
         JpaRole jpaRole = (JpaRole) role;
         roles.add(jpaRole);
       }
     }
     return roles;
   }
 
   /**
    * Updates a user's groups based on assigned roles
    *
    * @param user
    *          the user for whom groups should be updated
    */
   private void updateGroupMembership(JpaUser user) {
     logger.debug("updateGroupMembership({}, roles={})", user.getUsername(), user.getRoles().size());
     List<String> internalGroupRoles = new ArrayList<>();
 
     for (Role role : user.getRoles()) {
       if (Role.Type.GROUP.equals(role.getType())
           || (Role.Type.INTERNAL.equals(role.getType()) && role.getName().startsWith(Group.ROLE_PREFIX))) {
         internalGroupRoles.add(role.getName());
       }
     }
 
     groupRoleProvider.updateGroupMembershipFromRoles(
         user.getUsername(),
         user.getOrganization().getId(),
         internalGroupRoles
     );
   }
 
   /**
    * Delete the given user
    *
    * @param username
    *          the name of the user to delete
    * @param orgId
    *          the organization id
    * @throws NotFoundException
    *          if the requested user is not exist
    * @throws org.opencastproject.security.api.UnauthorizedException
    *          if you havn't permissions to delete an admin user (only admins may do that)
    * @throws Exception
    */
   public void deleteUser(String username, String orgId) throws NotFoundException, UnauthorizedException, Exception {
     User user = loadUser(username, orgId);
     if (user != null && !UserDirectoryUtils.isCurrentUserAuthorizedHandleRoles(securityService, user.getRoles())) {
       throw new UnauthorizedException("The user is not allowed to delete an admin user");
     }
 
     // Remove the user's group membership
     groupRoleProvider.removeMemberFromAllGroups(username, orgId);
 
     // Remove the user
     db.execTxChecked(UserDirectoryPersistenceUtil.deleteUserQuery(username, orgId));
 
     cache.invalidate(username + DELIMITER + orgId);
   }
 
   /**
    * Adds a role to the persistence
    *
    * @param jpaRole
    *          the role
    */
   public void addRole(JpaRole jpaRole) {
     HashSet<JpaRole> roles = new HashSet<>();
     roles.add(jpaRole);
     db.execTx(UserDirectoryPersistenceUtil.saveRolesQuery(roles));
   }
 
   @Override
   public String getName() {
     return PROVIDER_NAME;
   }
 
   private static User addProviderName(JpaUser u) {
     u.setProvider(PROVIDER_NAME);
     return u;
   }
 
   @Override
   public long countUsers() {
     String orgId = securityService.getOrganization().getId();
     return db.exec(UserDirectoryPersistenceUtil.countUsersQuery(orgId));
   }
 
   /**
    * Returns the number of all users in the database
    *
    * @return the count of all users in the database
    */
   public long countAllUsers() {
     return db.exec(UserDirectoryPersistenceUtil.countUsersQuery());
   }
 
   @Override
   public void invalidate(String userName) {
     String orgId = securityService.getOrganization().getId();
     cache.invalidate(userName + DELIMITER + orgId);
   }
 }