/*
    * Copyright 2004-2006 the Seasar Foundation and the Others.
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *     http://www.apache.org/licenses/LICENSE-2.0
    *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, 
   * either express or implied. See the License for the specific language
   * governing permissions and limitations under the License.
   */
  package org.seasar.tuigwaa.security;
  
  import java.io.UnsupportedEncodingException;
  import java.util.ArrayList;
  import java.util.Hashtable;
  import java.util.List;
  import java.util.Properties;
  
  import javax.naming.NamingEnumeration;
  import javax.naming.NamingException;
  import javax.naming.directory.Attribute;
  import javax.naming.directory.Attributes;
  import javax.naming.directory.BasicAttribute;
  import javax.naming.directory.BasicAttributes;
  import javax.naming.directory.DirContext;
  import javax.naming.directory.InitialDirContext;
  import javax.naming.directory.SearchControls;
  import javax.naming.directory.SearchResult;
  
  import org.apache.commons.logging.Log;
  import org.apache.commons.logging.LogFactory;
  import org.seasar.tuigwaa.security.auth.TgwRole;
  import org.seasar.tuigwaa.security.auth.TgwUser;
  
  
  /***
   * @author someda
   */
  public class DirectoryServiceImpl implements DirectoryService {
  
  	private Hashtable environment;	
  	private Properties props;
  	
  	private DirContext ctx;
  		
  	private Log log = LogFactory.getLog(getClass());
  	
  	private Attribute userObjectClass;
  	private Attribute roleObjectClass;	
  	
  	private Attributes userRequiredAttributes;
  	private Attributes roleRequiredAttributes;	
  	
  	private String searchBase;
  	
  	private String userPrefix;
  	private String userSuffix;
  	private String rolePrefix;
  	private String roleSuffix;	
  	private String roleUserAttribute;
  	
  	private String userSearchFilter;
  	private String roleSearchFilter;
  	
  	private String passwordAttribute;
  	private String descriptionAttribute;
  	
  	private String adminUsername;
  	private String adminRolename;
  	
  	private boolean prefixOnly;
  	
  	private SearchControls controls;	
  	
  	public DirectoryServiceImpl(Hashtable environment, Properties props){
  		
  		this.environment = environment;
  		this.props = props;
  		
  		try{
  			initialize();
  		}catch(NamingException ne){
  			log.error("startup failed, check config/directory.dicon.");
  			throw new RuntimeException(ne);
  		}
  	}
  			
  	public void setRoleObjectClass(Attribute roleObjectClass) {
  		this.roleObjectClass = roleObjectClass;
  	}
  
  	public void setUserObjectClass(Attribute userObjectClass) {
  		this.userObjectClass = userObjectClass;
  	}
 
 	public void setRoleRequiredAttributes(Attributes roleRequiredAttributes) {
 		this.roleRequiredAttributes = roleRequiredAttributes;
 	}
 
 	public void setUserRequiredAttributes(Attributes userRequiredAttributes) {
 		this.userRequiredAttributes = userRequiredAttributes;
 	}
 
 	public TgwUser getUser(String userdn){
 		TgwUser user = null;
 		
 		try{			
 			ctx = new InitialDirContext(environment);			
 			Attributes attrs = ctx.getAttributes(DirectoryUtils.getRDN(userdn,searchBase));
 			user = createUser(userdn,attrs);
 //			ctx.close();
 		}catch(NamingException ne){
 			log.error(ne.getMessage());
 //			ne.printStackTrace();
 		}finally{
 			DirectoryUtils.closeQuietly(ctx);
 		}
 		return user;
 	}
 	
 	public List getUsers() {
 				
 		List list = new ArrayList();
 		
 		try{			
 			ctx = new InitialDirContext(environment);		
 			String userSearchBase = DirectoryUtils.buildSuffix(userSuffix,searchBase,false,false);
 			NamingEnumeration res = ctx.search(userSearchBase,userSearchFilter,controls);
 			while(res.hasMore()){				
 				SearchResult entry = (SearchResult) res.next();				
 				Attributes attrs = entry.getAttributes();
 				
 				if(attrs == null){
 					log.info("attributes not found for " + entry.getName());
 					continue;
 				}		
 																
 				TgwUser user = createUser(getFullDN(entry.getName(),true),attrs);				
 				list.add(user);								
 			}			
 //			ctx.close();
 		}catch(NamingException ne){
 			log.error("search failed.");
 			ne.printStackTrace();
 		}finally{
 			DirectoryUtils.closeQuietly(ctx);
 		}
 		return list;
 	}
 
 	public void addUser(TgwUser user) {
 		
 		String dn = DirectoryUtils.getAbsoluteDN(user.getName(),userPrefix,userSuffix,searchBase); 
 		user.setDn(dn);
 		
 		try{
 			ctx = new InitialDirContext(environment);															
 			Attributes attrs = createUserAttributes(user);
 			
 			if(userRequiredAttributes != null){
 				NamingEnumeration reqattrs = userRequiredAttributes.getAll();
 				while(reqattrs.hasMore()){
 					attrs.put((Attribute)reqattrs.next());
 				}								
 			}			
 			updateRoles(user,user.getRoles(),DirContext.ADD_ATTRIBUTE);
 
 			ctx.createSubcontext(DirectoryUtils.getRDN(dn,searchBase),attrs);
 			log.info("adding " + dn + " completed.");
 //			ctx.close();
 		}catch(NamingException ne){			
 //			log.error(ne.getMessage());
 			ne.printStackTrace();
 		}finally{
 			DirectoryUtils.closeQuietly(ctx);
 		}
 	}
 
 	public void deleteUser(String userdn){
 
 		TgwUser user = getUser(userdn);
 		
 		if(user.isAdmin()){ // should throw Exception
 			log.warn(user.getName() + "couldn't delete user who has admin priviledge.");
 			return;			
 		}		
 				
 		try{
 			ctx = new InitialDirContext(environment);			
 			updateRoles(user,user.getRoles(),DirContext.REMOVE_ATTRIBUTE);
 			ctx.destroySubcontext(DirectoryUtils.getRDN(userdn,searchBase));
 			log.info("deleting " + userdn + " completed.");
 //			ctx.close();			
 		}catch(NamingException ne){
 			ne.printStackTrace();
 		}finally{
 			DirectoryUtils.closeQuietly(ctx);
 		}
 	}
 	
 	public void modifyUser(TgwUser user) {
 		
 		String userdn = DirectoryUtils.getAbsoluteDN(user.getName(),userPrefix,userSuffix,searchBase); 
 		
 		String[] oldroles = null;		
 		String[] deleteroles = null;
 		String[] addroles = null;
 		String[] updateroles = user.getRoles();
 		
 		// get current information
 		TgwUser olduser = getUser(userdn);
 		oldroles = olduser.getRoles();
 		
 		if(updateroles != null && updateroles.length > 0){			
 			addroles = getExclusiveStringArray(updateroles,oldroles);
 			deleteroles = getExclusiveStringArray(oldroles,updateroles);			
 		}else if(oldroles != null && oldroles.length > 0){
 			deleteroles = new String[oldroles.length];
 			System.arraycopy(oldroles,0,deleteroles,0,oldroles.length);			
 		}		
 		
 		if(olduser.isAdmin() && deleteroles != null){
 			for(int i=0;i<deleteroles.length;i++){
 				if(deleteroles[i].equals(adminRolename)){
 					deleteroles[i] = null;
 					log.info("admin role couldn't delete for admin user, ignore it.");
 					break;
 				}	
 			}
 		}
 		
 		try{
 			ctx = new InitialDirContext(environment);
 			Attributes attrs = createUserAttributes(user);
 			ctx.modifyAttributes(DirectoryUtils.getRDN(userdn,searchBase),DirContext.REPLACE_ATTRIBUTE,attrs);			
 			
 			updateRoles(olduser,addroles,DirContext.ADD_ATTRIBUTE);
 			updateRoles(olduser,deleteroles,DirContext.REMOVE_ATTRIBUTE);
 //			ctx.close();			
 		}catch(NamingException ne){
 			ne.printStackTrace();
 		}finally{
 			DirectoryUtils.closeQuietly(ctx);
 		}
 	}
 
 	public TgwRole getRole(String roledn){
 		TgwRole role = null;		
 		try{
 			ctx = new InitialDirContext(environment);			
 			Attributes attrs = ctx.getAttributes(DirectoryUtils.getRDN(roledn,searchBase));			
 			role = createRole(roledn,attrs);			
 //			ctx.close();			
 		}catch(NamingException ne){
 			log.error(ne.getMessage());
 //			ne.printStackTrace();
 		}finally{
 			DirectoryUtils.closeQuietly(ctx);
 		}
 		return role;		
 	}
 
 	public List getRoles() {
 		
 		List list = new ArrayList();
 		
 		try{			
 			ctx = new InitialDirContext(environment);									
 			NamingEnumeration res = ctx.search(DirectoryUtils.buildSuffix(roleSuffix,searchBase,false,false),roleSearchFilter,controls);
 			while(res.hasMore()){
 				SearchResult entry = (SearchResult) res.next();				
 				Attributes attrs = entry.getAttributes();
 				
 				
 				if(attrs == null){
 					log.info("attributes not found for " + entry.getName());
 					continue;
 				}
 				
 				TgwRole role = createRole(getFullDN(entry.getName(),false),attrs);
 				list.add(role);									
 			}			
 //			ctx.close();
 		}catch(NamingException ne){
 			ne.printStackTrace();
 		}finally{
 			DirectoryUtils.closeQuietly(ctx);
 		}
 		return list;		
 	}
 	
 	public void addRole(TgwRole role) {
 		String dn = DirectoryUtils.getAbsoluteDN(role.getName(),rolePrefix,roleSuffix,searchBase); 
 								
 		try{
 			ctx = new InitialDirContext(environment);									
 			Attributes attrs = createRoleAttributes(role);
 						
 			if(roleRequiredAttributes != null){
 				NamingEnumeration reqattrs = roleRequiredAttributes.getAll();
 				while(reqattrs.hasMore()){
 					attrs.put((Attribute)reqattrs.next());
 				}								
 			}			
 			ctx.createSubcontext(DirectoryUtils.getRDN(dn,searchBase),attrs);
 			
 			String adminUserDn = userPrefix + "=" + adminUsername + DirectoryUtils.buildSuffix(userSuffix,searchBase,true,true);
 			TgwUser admin = new TgwUser(adminUsername);
 			admin.setDn(adminUserDn);
 			updateRoles(admin,new String[]{role.getName()},DirContext.ADD_ATTRIBUTE);			
 			log.info("adding " + dn + " completed.");	
 //			ctx.close();			
 		}catch(NamingException ne){
 			ne.printStackTrace();
 		}finally{
 			DirectoryUtils.closeQuietly(ctx);
 		}
 	}
 
 	public void deleteRole(String roledn) {
 		
 		TgwRole role = getRole(roledn);
 		if(role.isAdmin()){ // should throw Exception ??
 			log.warn(role.getName() + "couldn't delete role which represents admin priviledge.");			
 			return; 
 		}
 						
 		try{
 			ctx = new InitialDirContext(environment);						
 			ctx.destroySubcontext(DirectoryUtils.getRDN(roledn,searchBase));
 			log.info("deleting " + roledn + " completed.");		
 //			ctx.close();			
 		}catch(NamingException ne){
 			ne.printStackTrace();
 		}finally{
 			DirectoryUtils.closeQuietly(ctx);
 		}
 	}	
 
 	public void modifyRole(TgwRole role) {
 		
 		String dn = DirectoryUtils.getAbsoluteDN(role.getName(),rolePrefix,roleSuffix,searchBase); 
 		try{
 			ctx = new InitialDirContext(environment);
 			Attributes attrs = createRoleAttributes(role);
 			ctx.modifyAttributes(DirectoryUtils.getRDN(dn,searchBase),DirContext.REPLACE_ATTRIBUTE,attrs);
 //			ctx.close();			
 		}catch(NamingException ne){
 			ne.printStackTrace();
 		}finally{
 			DirectoryUtils.closeQuietly(ctx);
 		}
 	}
 	
 	public String buildUserDN(String username){
 		return DirectoryUtils.getAbsoluteDN(username,userPrefix,userSuffix,searchBase);
 	}
 	
 	public void initialize() throws NamingException{		
 
 		// initialize properties
 		searchBase = props.getProperty(BASE_DN);		
 		userPrefix = props.getProperty(USER_PREFIX);
 		userSuffix = props.getProperty(USER_SUFFIX);
 		rolePrefix = props.getProperty(ROLE_PREFIX);
 		roleSuffix = props.getProperty(ROLE_SUFFIX);
 		
 		roleUserAttribute = props.getProperty(ROLE_USER_ATTRIBUTE);		
 		passwordAttribute = props.getProperty(PASSWORD_ATTRIBUTE);
 		descriptionAttribute = props.getProperty(DESCRIPTION_ATTRIBUTE);
 		adminUsername = props.getProperty(ADMIN_USERNAME);
 		adminRolename = props.getProperty(ADMIN_ROLENAME);
 		
 		StringBuffer buf = new StringBuffer();
 		buf.append("(" + userPrefix + "=*)");
 		userSearchFilter = buf.toString();
 		
 		buf = new StringBuffer();
 		buf.append("(" + rolePrefix + "=*)");
 		roleSearchFilter = buf.toString();		
 		
 		controls = new SearchControls();
 		controls.setSearchScope(SearchControls.SUBTREE_SCOPE);
 				
 		String value = props.getProperty(DirectoryService.EMBEDED);		
 		if(Boolean.valueOf(value).booleanValue()){
 			new InitialDirContext(environment);
 		}
 		
 		String p = props.getProperty(DirectoryService.ROLE_USER_PREFIXONLY);
 		prefixOnly = Boolean.valueOf(p).booleanValue();		
 	}
 	
 	// ----- [Start] private methods -----	
 	private TgwUser createUser(String dn, Attributes attrs) throws NamingException{
 		
 		TgwUser user = new TgwUser();
 		user.setDn(dn);
 
 		Attribute uid = attrs.get(userPrefix);
 		if(uid != null){
 			user.setName((String)uid.get());
 			user.setAdmin(user.getName().equals(adminUsername));
 		}		
 		
 		Attributes member = null;
 		if(prefixOnly){
 			member = new BasicAttributes(roleUserAttribute,user.getName());
 		}else{
 			member = new BasicAttributes(roleUserAttribute,dn);			
 		}
 		
 		String searchName = DirectoryUtils.buildSuffix(roleSuffix,searchBase,false,false); 
 		NamingEnumeration nenum = ctx.search(searchName,member);
 		List roleList = new ArrayList();
 		while(nenum.hasMore()){
 			SearchResult result = (SearchResult) nenum.next();
 			Attributes roleattrs = result.getAttributes();
 			Attribute roleattr = roleattrs.get(rolePrefix);										
 			roleList.add((String)roleattr.get());					
 		}
 		if(roleList.size() > 0)
 			user.setRoles((String[]) roleList.toArray(new String[roleList.size()]));				
 				
 		Attribute password = attrs.get(passwordAttribute);
 		if(password != null){
 			try{
 				user.setPassword((String)password.get());
 			}catch(ClassCastException cce){ // network-based access
 				try{
 					String p = new String((byte[])password.get(),"UTF8");
 					user.setPassword(p);
 				}catch(UnsupportedEncodingException uee){
 					uee.printStackTrace();
 				}
 			}
 		}
 		
 		Attribute description = attrs.get(descriptionAttribute);
 		if(description != null)
 			user.setDescription((String)description.get());			
 		
 		return user;
 	}	
 	
 	private Attributes createUserAttributes(TgwUser user){
 		
 		Attributes attrs = new BasicAttributes();
 		attrs.put(userObjectClass);
 		attrs.put(new BasicAttribute(userPrefix,user.getName()));
 		attrs.put(new BasicAttribute(passwordAttribute,user.getPassword()));
 		attrs.put(new BasicAttribute("cn",user.getName()));			
 		attrs.put(new BasicAttribute("sn",user.getName()));
 		attrs.put(new BasicAttribute(descriptionAttribute,user.getDescription()));
 		
 		return attrs;
 	}
 	
 	private TgwRole createRole(String dn, Attributes attrs) throws NamingException{
 		
 		TgwRole role = new TgwRole();
 		role.setDn(dn);
 		
 		Attribute cn = attrs.get(rolePrefix);
 		if(cn != null){
 			role.setName((String)cn.get());
 			role.setAdmin(role.getName().equals(adminRolename));
 		}
 				
 		Attribute description = attrs.get(descriptionAttribute);
 		if(description != null)
 			role.setDescription((String)description.get());		
 				
 		Attribute member = attrs.get(roleUserAttribute);
 		if(member != null){
 			int size = member.size();
 			String[] users = new String[size];			
 			for(int i=0;i<size;i++){
 				users[i] = (String)member.get(i);				
 			}			
 			role.setUsers(users);
 		}		
 		return role;		
 	}
 	
 	private Attributes createRoleAttributes(TgwRole role){
 		
 		Attributes attrs = new BasicAttributes();
 		attrs.put(roleObjectClass);
 		attrs.put(new BasicAttribute(rolePrefix,role.getName()));
 		attrs.put(new BasicAttribute(descriptionAttribute,role.getDescription()));
 		
 		return attrs;
 	}
 	
 	
 	private void updateRoles(TgwUser user, String[] roles, int mod_op) throws NamingException{
 
 		if(roles != null){
 			Attributes member = null;			
 			if(prefixOnly){
 				member = new BasicAttributes(roleUserAttribute,user.getName());				
 			}else{
 				member = new BasicAttributes(roleUserAttribute,user.getDn());
 			}
 			
 			for(int i=0;i<roles.length;i++){
 				if(roles[i] != null){ // in-case modifying admin user contains admin role, see modifyUser
 					String roledn = DirectoryUtils.getAbsoluteDN(roles[i],rolePrefix,roleSuffix,searchBase); 
 					try{
 						ctx.modifyAttributes(DirectoryUtils.getRDN(roledn,searchBase),mod_op,member);
 					}catch(NamingException ne){
 						log.error("update failed for " + roledn);
 						continue;
 					}
 				}
 			}
 		}
 	}	
 	
 	private String[] getExclusiveStringArray(String[] src, String[] dest){
 		
 		if(src == null) return null;
 		if(dest == null) return src;		
 		
 		List list = new ArrayList();
 		for(int i=0;i<src.length;i++){
 			boolean notIncluded = true;
 			for(int j=0;j<dest.length;j++){
 				if(src[i].equals(dest[j])){
 					notIncluded = false;
 					break;
 				}
 			}
 			if(notIncluded) list.add(src[i]);
 		}
 		return (list.size()>0)?(String[]) list.toArray(new String[list.size()]):null;		
 	}
 		
 	
 	// in-case network-based access, need to append searchBase to RDN
 	private String getFullDN(String dn, boolean user){
 		String ret = dn;		
 		String suffix = null;
 		
 		if(user){
 			suffix = DirectoryUtils.buildSuffix(userSuffix,searchBase,true,true);
 		}else{
 			suffix = DirectoryUtils.buildSuffix(roleSuffix,searchBase,true,true);
 		}
 		
 		if(dn.indexOf(suffix) == -1){
 			ret += suffix;
 		}		
 		return ret;	
 	}
 }