/*
   jGuard is a security framework based on top of jaas (java authentication and authorization security).
   it is written for web applications, to resolve simply, access control problems.
   version $Name$
   http://sourceforge.net/projects/jguard/
   
   Copyright (C) 2004  Charles GAY
   
   This library is free software; you can redistribute it and/or
  modify it under the terms of the GNU Lesser General Public
  License as published by the Free Software Foundation; either
  version 2.1 of the License, or (at your option) any later version.
  
  This library is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  Lesser General Public License for more details.
  
  You should have received a copy of the GNU Lesser General Public
  License along with this library; if not, write to the Free Software
  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  
  
  jGuard project home page:
  http://sourceforge.net/projects/jguard/
  
  */
  package net.sf.jguard.ext.util;
  
  import java.security.AccessControlContext;
  import java.security.AccessController;
  import java.security.Principal;
  import java.util.Collection;
  import java.util.HashSet;
  import java.util.Iterator;
  import java.util.Set;
  
  import javax.security.auth.Subject;
  
  import net.sf.jguard.core.authentication.AuthenticationException;
  import net.sf.jguard.core.authentication.credentials.JGuardCredential;
  import net.sf.jguard.core.authentication.manager.AuthenticationManager;
  import net.sf.jguard.core.authorization.permissions.PermissionUtils;
  import net.sf.jguard.core.organization.Organization;
  import net.sf.jguard.core.principals.RolePrincipal;
  import net.sf.jguard.core.principals.UserPrincipal;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  /**
   * utility class to query against subject credentials.
   * @author <a href="mailto:diabolo512@users.sourceforge.net">Charles Gay</a>
   * @author <a href="mailto:tandilero@users.sourceforge.net">Maximiliano Batelli</a>
   */
  public class SubjectUtils {
  
  	private static final Logger logger = LoggerFactory.getLogger(SubjectUtils.class.getName());
  
  	/**
  	 * return credential values from private and public credential set
  	 * which are mapped to the specified credentialId.
  	 * @param subject
  	 * @param credentialId
  	 * @return Collection of Object credential values
  	 */
  	public static Collection getCredentialValues(Subject subject,String credentialId){
  		Collection valuesFound = new HashSet();
  		valuesFound.addAll(getCredentialValues(subject,true,credentialId));
  		valuesFound.addAll(getCredentialValues(subject,false,credentialId));
  		return valuesFound;
  	}
  
  	/**
  	 * return credential values from the specified credential set
  	 * which are mapped to the specified credentialId.
  	 * @param subject
  	 * @param publicVisibility <i>true</i> for publicCredentials, <i>false</i> for
  	 * private credentials.
  	 * @param credentialId
  	 * @return Collection of Object credential values
  	 */
  	public static Collection getCredentialValues(Subject subject,boolean publicVisibility ,String credentialId){
  		Collection valuesFound = new HashSet();
  		Collection credentials = null;
  		if(publicVisibility==true){
  			credentials = subject.getPublicCredentials(JGuardCredential.class);
  		}else{
  			try{
  			credentials = subject.getPrivateCredentials(JGuardCredential.class);
  			}catch(SecurityException sex){
  				logger.debug(" you don't have the permission to grab private credentials ");
  				return valuesFound;
  			}
  		}
  		Iterator it = credentials.iterator();
  		while(it.hasNext()){
  			Object credential = (JGuardCredential)it.next();
  			//we skip non JGuardCredentials
  			if(credential instanceof JGuardCredential == false){
 				continue;
 			}
 			JGuardCredential cred = (JGuardCredential)credential;
 			if(cred.getName().equals(credentialId)){
 				valuesFound.add(cred.getValue());
 			}
 		}
 
 		return valuesFound;
 	}
 
         public static Organization getOrganization(Subject subject){
 		 Set organizationSet = subject.getPrincipals(Organization.class);
                  if(organizationSet.size()>1){
                      throw new IllegalStateException(" a Subject object must contains only one organization in the principal set . ");
                  }else if(organizationSet.size()==0){
                      throw new IllegalStateException(" if no organization is set in the principal set of the subject, the default 'system' organization is used  ");
                  }
                  return (Organization) organizationSet.iterator().next();
 	}
         
 	/**
 	 * return credential value from the specified credential set
 	 * This function assume that credential have only one value
 	 * return empty string if it is not found
 	 * @param subject
 	 * @param publicVisibility <i>true</i> for publicCredentials, <i>false</i> for
 	 * private credentials.
 	 * @param credentialId
 	 * @return credential value as string
 	 */
 	public static String getCredentialValueAsString(Subject subject, boolean publicVisibility, String credentialId){
 		String valueFound = "";
 		Collection credentials = null;
 		if(publicVisibility==true){
 			credentials = subject.getPublicCredentials(JGuardCredential.class);
 		}else{
 			try{
 				credentials = subject.getPrivateCredentials(JGuardCredential.class);
 			}catch(SecurityException sex){
 				logger.debug(" you don't have the permission to grab private credentials ");
 				return valueFound;
 			}
 		}
 		Iterator it = credentials.iterator();
 		while(it.hasNext()){
 			JGuardCredential cred = (JGuardCredential)it.next();
 			if(cred.getName().equals(credentialId)){
 				valueFound = cred.getValue().toString();
 			}
 		}
 
 		return valueFound;
 	}
 
 	/**
 	 * Set credential's value, this method assume that credential have only one value
 	 * If credentialId exists then the value is replaced, else the credential is created
 	 * @param subject
 	 * @param publicVisibility <i>true</i> for publicCredentials, <i>false</i> for
 	 * private credentials.
 	 * @param credentialId
 	 * @param credentialValue
 	 * @param isIdentity <i>true</i> for identity credential, <i>false</i> otherwise
 	 */
 	public static void setCredentialValue(Subject subject, boolean publicVisibility, String credentialId, Object credentialValue, boolean isIdentity) {
 		Set credentials = null;
 		boolean credFound = false;
 		if(publicVisibility){
 			credentials = subject.getPublicCredentials();
 		}else{
 			try{
 				credentials = subject.getPrivateCredentials();
 			}catch(SecurityException sex){
 				logger.debug(" you don't have the permission to grab private credentials ");
 				return;
 			}
 		}
 		Iterator it = credentials.iterator();
 		JGuardCredential jCred = null;
 		while(it.hasNext()){
 			Object credential = it.next();
 			if(!(credential instanceof JGuardCredential)){
 				continue;
 			}else{
 				jCred = (JGuardCredential)credential;
 			}
 
 			if(jCred.getName().equals(credentialId)){
 				jCred.setValue(credentialValue);
 				credFound = true;
 				break;
 			}
 		}
 		if(!credFound) {
 			jCred = new JGuardCredential();
 			jCred.setName(credentialId);
 			jCred.setValue(credentialValue);
 			credentials.add(jCred);
 		}
 	}
 
 	/**
 	 * adds new credential value if it does not already exist. Added credential can not be an identity credential.
 	 * @param subject
 	 * @param publicVisibility
 	 * @param credentialId
 	 * @param credentialValue
 	 */
 	public static void addCredentialValue(Subject subject, boolean publicVisibility, String credentialId, Object credentialValue) {
                 Set credentials = getCredentials(subject,publicVisibility);
 		JGuardCredential jCred = getCredential(credentials,credentialId,credentialValue);
 		
                 //credential is not found
 		if(jCred==null){
 			jCred = new JGuardCredential();
 			jCred.setName(credentialId);
 			jCred.setValue(credentialValue);
 			credentials.add(jCred);
 		}
 	}
         
         private static Set getCredentials(Subject subject,boolean publicVisibility){
             Set credentials = null;
                 if(publicVisibility){
 			credentials = subject.getPublicCredentials();
 		}else{
 			try{
 				credentials = subject.getPrivateCredentials();
 			}catch(SecurityException sex){
 				logger.debug(" you don't have the permission to grab private credentials ");
 				throw sex;
 			}
 		}
             return credentials;
         }
         
         /**
          *
          *@return null if the credential is not found, JGuardCredential otherwise.
          */
         private static JGuardCredential getCredential(Set credentials, String credentialId, Object credentialValue){
                 boolean credentialExists = false;
 		Iterator it = credentials.iterator();
 		JGuardCredential jCred = null;
 		while(it.hasNext()){
 			Object credential = it.next();
 			if(!(credential instanceof JGuardCredential)){
 				continue;
 			}else{
 				jCred = (JGuardCredential)credential;
 			}
 
 			if(jCred.getName().equals(credentialId) && jCred.getValue().equals(credentialValue)){
 				credentialExists = true;
 				break;
 			}
 		}
                 if(credentialExists){
                     return jCred;
                 }else{
                     return null;
                 }
         }
                 
 
 	/**
 	 * return the {link {@link JGuardCredential} identifying uniquely the user.
 	 * @param subject
 	 * @param template
 	 * @return
 	 * @throws AuthenticationException
 	 */
 	public static JGuardCredential getIdentityCredential(Subject subject ,AuthenticationManager authenticationManager) {
 		String userCredentialId = authenticationManager.getCredentialId();
 		if(subject == null){
 			throw new IllegalArgumentException("'subject' parameter is null");
 		}
 		
 		JGuardCredential  idCredential = new JGuardCredential();
 		idCredential.setName(userCredentialId);
 		Collection values = getCredentialValues(subject,idCredential.getName());
 		Iterator it = values.iterator();
 		if(it.hasNext()){
 			idCredential.setValue(it.next());
 		}
 		return idCredential;
 	}
 
 	/**
 	 * remove credential value if it already exists. Removed credential can not be an identity credential.
 	 * @param subject
 	 * @param publicVisibility
 	 * @param credentialId
 	 * @param credentialValue
 	 */
 	public static void removeCredentialValue(Subject subject, boolean publicVisibility, String credentialId, Object credentialValue) {
 		Set credentials = getCredentials(subject,publicVisibility);
 		JGuardCredential jCred = getCredential(credentials,credentialId,credentialValue);
                 if(jCred!= null){
 			credentials.remove(jCred);
                 }
 	}
 	
 	public static Set getEnabledPrincipals(Set userPrincipals) {
 		Set enabledPrincipals = new HashSet();
     	// Find the UserPrincipal to evaluate principal definition
     	UserPrincipal userPrincipal = null;
 		Iterator userPrincipalsIt = userPrincipals.iterator();
 		while(userPrincipalsIt.hasNext()){
     		Principal ppal = (Principal)userPrincipalsIt.next();
     		if(ppal instanceof UserPrincipal) {
     			userPrincipal = (UserPrincipal)ppal;
     			break;
     		}
 		}
 		userPrincipalsIt = userPrincipals.iterator();
     	//add all enabled Principals to set
     	while(userPrincipalsIt.hasNext()) {
     		Principal ppal = (Principal)userPrincipalsIt.next();
     		if(ppal instanceof RolePrincipal) {
     			RolePrincipal tempUserPrincipal = (RolePrincipal) ppal;
     			if(!"userPrincipal".equals(tempUserPrincipal.getLocalName())&& PermissionUtils.evaluatePrincipal(tempUserPrincipal, userPrincipal)) {
                             enabledPrincipals.add(tempUserPrincipal);
                         }
     		}
     	}	
     	
     	return enabledPrincipals;
 	}
         
         /**
          * grab the authenticated PersistedSubject in the execution stack.
          * @return authenticated PersistedSubject or null if user is not authenticated
          * @throws SecurityExceptionthe caller does not have the permission to call the subject
          */
         public static Subject getSubject(){
                 AccessControlContext acc = AccessController.getContext();
                 if(acc==null){
                     //acc== null signifies System code,
                     //so, no SUbject is bound to it
                     return null;
                 }
 		Subject subject = Subject.getSubject(acc);
                 return subject;
         }
         
        
         
         public static Set getJavaxSecuritySubjects(Set jguardSubjects){
             Set set = new HashSet();
             Iterator it = jguardSubjects.iterator();
             while(it.hasNext()){
                 net.sf.jguard.ext.authentication.PersistedSubject subject = (net.sf.jguard.ext.authentication.PersistedSubject)it.next();
                 Subject s = subject.toJavaxSecuritySubject();
                 set.add(s);
             }
             return set;
         }
 
 }