package org.argeo.maintenance;

import java.io.IOException;
import java.util.EnumSet;
import java.util.HashSet;
import java.util.Set;

import javax.jcr.NoSuchWorkspaceException;
import javax.jcr.Repository;
import javax.jcr.RepositoryException;
import javax.jcr.Session;
import javax.transaction.UserTransaction;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.argeo.api.NodeUtils;
import org.argeo.jcr.Jcr;
import org.argeo.jcr.JcrUtils;
import org.argeo.naming.Distinguished;
import org.osgi.service.useradmin.Group;
import org.osgi.service.useradmin.Role;
import org.osgi.service.useradmin.UserAdmin;

/** Make sure roles and access rights are properly configured. */
public abstract class AbstractMaintenanceService {
	private final static Log log = LogFactory.getLog(AbstractMaintenanceService.class);

	private Repository repository;
//	private UserAdminService userAdminService;
	private UserAdmin userAdmin;
	private UserTransaction userTransaction;

	public void init() {
		makeSureRolesExists(getRequiredRoles());
		configureStandardRoles();

		Set<String> workspaceNames = getWorkspaceNames();
		if (workspaceNames == null || workspaceNames.isEmpty()) {
			configureJcr(repository, null);
		} else {
			for (String workspaceName : workspaceNames)
				configureJcr(repository, workspaceName);
		}
	}

	/** Configures a workspace. */
	protected void configureJcr(Repository repository, String workspaceName) {
		Session adminSession;
		try {
			adminSession = NodeUtils.openDataAdminSession(repository, workspaceName);
		} catch (RuntimeException e1) {
			if (e1.getCause() != null && e1.getCause() instanceof NoSuchWorkspaceException) {
				Session defaultAdminSession = NodeUtils.openDataAdminSession(repository, null);
				try {
					defaultAdminSession.getWorkspace().createWorkspace(workspaceName);
					log.info("Created JCR workspace " + workspaceName);
				} catch (RepositoryException e) {
					throw new IllegalStateException("Cannot create workspace " + workspaceName, e);
				} finally {
					Jcr.logout(defaultAdminSession);
				}
				adminSession = NodeUtils.openDataAdminSession(repository, workspaceName);
			} else
				throw e1;
		}
		try {
			if (prepareJcrTree(adminSession)) {
				configurePrivileges(adminSession);
			}
		} catch (RepositoryException | IOException e) {
			throw new IllegalStateException("Cannot initialise JCR data layer.", e);
		} finally {
			JcrUtils.logoutQuietly(adminSession);
		}
	}

	/** To be overridden. */
	protected Set<String> getWorkspaceNames() {
		return null;
	}

	/**
	 * To be overridden in order to programmatically set relationships between
	 * roles. Does nothing by default.
	 */
	protected void configureStandardRoles() {
	}

	/**
	 * Creates the base JCR tree structure expected for this app if necessary.
	 * 
	 * Expects a clean session ({@link Session#hasPendingChanges()} should return
	 * false) and saves it once the changes have been done. Thus the session can be
	 * rolled back if an exception occurs.
	 * 
	 * @return true if something as been updated
	 */
	public boolean prepareJcrTree(Session adminSession) throws RepositoryException, IOException {
		return false;
	}

	/**
	 * Adds app specific default privileges.
	 * 
	 * Expects a clean session ({@link Session#hasPendingChanges()} should return
	 * false} and saves it once the changes have been done. Thus the session can be
	 * rolled back if an exception occurs.
	 * 
	 * Warning: no check is done and corresponding privileges are always added, so
	 * only call this when necessary
	 */
	public void configurePrivileges(Session session) throws RepositoryException {
	}

	/** The system roles that must be available in the system. */
	protected Set<String> getRequiredRoles() {
		return new HashSet<>();
	}

	public void destroy() {

	}

	/*
	 * UTILITIES
	 */

	/** Create these roles as group if they don't exist. */
	protected void makeSureRolesExists(EnumSet<? extends Distinguished> enumSet) {
		makeSureRolesExists(Distinguished.enumToDns(enumSet));
	}

	/** Create these roles as group if they don't exist. */
	protected void makeSureRolesExists(Set<String> requiredRoles) {
		if (requiredRoles == null)
			return;
		if (getUserAdmin() == null) {
			log.warn("No user admin service available, cannot make sure that role exists");
			return;
		}
		for (String role : requiredRoles) {
			Role systemRole = getUserAdmin().getRole(role);
			if (systemRole == null) {
				try {
					getUserTransaction().begin();
					getUserAdmin().createRole(role, Role.GROUP);
					getUserTransaction().commit();
					log.info("Created role " + role);
				} catch (Exception e) {
					try {
						getUserTransaction().rollback();
					} catch (Exception e1) {
						// silent
					}
					throw new IllegalStateException("Cannot create role " + role, e);
				}
			}
		}
	}

	/** Add a user or group to a group. */
	protected void addToGroup(String groupToAddDn, String groupDn) {
		if (groupToAddDn.contentEquals(groupDn)) {
			if (log.isTraceEnabled())
				log.trace("Ignore adding group " + groupDn + " to itself");
			return;
		}

		if (getUserAdmin() == null) {
			log.warn("No user admin service available, cannot add group " + groupToAddDn + " to " + groupDn);
			return;
		}
		Group groupToAdd = (Group) getUserAdmin().getRole(groupToAddDn);
		if (groupToAdd == null)
			throw new IllegalArgumentException("Group " + groupToAddDn + " not found");
		Group group = (Group) getUserAdmin().getRole(groupDn);
		if (group == null)
			throw new IllegalArgumentException("Group " + groupDn + " not found");
		try {
			getUserTransaction().begin();
			if (group.addMember(groupToAdd))
				log.info("Added " + groupToAddDn + " to " + group);
			getUserTransaction().commit();
		} catch (Exception e) {
			try {
				getUserTransaction().rollback();
			} catch (Exception e1) {
				// silent
			}
			throw new IllegalStateException("Cannot add " + groupToAddDn + " to " + groupDn);
		}
	}

	/*
	 * DEPENDENCY INJECTION
	 */
	public void setRepository(Repository repository) {
		this.repository = repository;
	}

//	public void setUserAdminService(UserAdminService userAdminService) {
//		this.userAdminService = userAdminService;
//	}

	protected UserTransaction getUserTransaction() {
		return userTransaction;
	}

	protected UserAdmin getUserAdmin() {
		return userAdmin;
	}

	public void setUserAdmin(UserAdmin userAdmin) {
		this.userAdmin = userAdmin;
	}

	public void setUserTransaction(UserTransaction userTransaction) {
		this.userTransaction = userTransaction;
	}

}