/*
    * The Kuali Financial System, a comprehensive financial management system for higher education.
    * 
    * Copyright 2005-2014 The Kuali Foundation
    * 
    * This program is free software: you can redistribute it and/or modify
    * it under the terms of the GNU Affero General Public License as
    * published by the Free Software Foundation, either version 3 of the
    * License, or (at your option) any later version.
   * 
   * This program is distributed in the hope that it will be useful,
   * but WITHOUT ANY WARRANTY; without even the implied warranty of
   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   * GNU Affero General Public License for more details.
   * 
   * You should have received a copy of the GNU Affero General Public License
   * along with this program.  If not, see <http://www.gnu.org/licenses/>.
   */
  package org.kuali.rice.kim.impl.jaxb;
  
  import static org.kuali.rice.core.api.criteria.PredicateFactory.equal;
  
  import java.util.HashMap;
  import java.util.List;
  import java.util.Set;
  
  import javax.xml.bind.UnmarshalException;
  
  import org.apache.commons.lang.StringUtils;
  import org.joda.time.DateTime;
  import org.kuali.rice.core.api.criteria.QueryByCriteria;
  import org.kuali.rice.core.api.membership.MemberType;
  import org.kuali.rice.core.util.jaxb.NameAndNamespacePair;
  import org.kuali.rice.kim.api.group.GroupContract;
  import org.kuali.rice.kim.api.identity.principal.PrincipalContract;
  import org.kuali.rice.kim.api.permission.PermissionContract;
  import org.kuali.rice.kim.api.role.Role;
  import org.kuali.rice.kim.api.role.RoleContract;
  import org.kuali.rice.kim.api.role.RoleMember;
  import org.kuali.rice.kim.api.role.RoleMemberContract;
  import org.kuali.rice.kim.api.role.RoleService;
  import org.kuali.rice.kim.api.services.KimApiServiceLocator;
  
  /**
   * Helper class containing static methods for aiding in parsing role XML.
   *
   * <p>All non-private methods are package-private so that only the KIM-parsing-related code can make use of them. (TODO: Is that necessary?)
   *
   * <p>TODO: Should this be converted into a service instead?
   *
   * @author Kuali Rice Team (rice.collab@kuali.org)
   */
  public final class RoleXmlUtil {
      // Do not allow outside code to instantiate this class.
      private RoleXmlUtil() {}
  
      /**
       * Performs the necessary validation on the new role, then saves it.
       *
       * @param newRole The role to persist.
       * @return The ID of the persisted role.
       * @throws IllegalArgumentException if newRole is null.
       * @throws UnmarshalException if newRole contains invalid data.
       */
      static String validateAndPersistNewRole(RoleXmlDTO newRole) throws UnmarshalException {
          if (newRole == null) {
              throw new IllegalArgumentException("Cannot persist a null role");
          }
  
          // Validate the role and (if applicable) retrieve the ID from an existing matching role.
          validateAndPrepareRole(newRole);
  
          Role.Builder builder = Role.Builder.create();
          builder.setActive(newRole.getActive());
          builder.setDescription(newRole.getRoleDescription());
          builder.setId(newRole.getRoleId());
          builder.setKimTypeId(newRole.getKimTypeId());
          builder.setName(newRole.getRoleName());
          builder.setNamespaceCode(newRole.getNamespaceCode());
  
          //save the role
          Role role = KimApiServiceLocator.getRoleService().createRole(builder.build());
  
          // Set a flag on the role to indicate that it has now been persisted so that the unmarshalling process will not save this role more than once.
          newRole.setAlreadyPersisted(true);
  
          return role.getId();
      }
  
      /**
       * Performs the necessary validation on the new role member, then saves it.
       *
       * @param newRoleMember The role member to save.
       * @return The ID of the persisted role member.
       * @throws IllegalArgumentException if newRoleMember is null.
       * @throws UnmarshalException if newRoleMember contains invalid data.
       */
      static String validateAndPersistNewRoleMember(RoleMemberXmlDTO newRoleMember) throws UnmarshalException {
  
         if (newRoleMember == null) {
             throw new IllegalArgumentException("Cannot persist a null role member");
         }
 
         // Validate role ID and role name/namespace.
         validateRoleIdAndRoleNameForMember(newRoleMember);
 
         // Validate member type, member ID, and member name/namespace.
         validateMemberIdentity(newRoleMember);
 
         // Validate the from/to dates, if defined.
         if (newRoleMember.getActiveFromDate() != null && newRoleMember.getActiveToDate() != null &&
                 newRoleMember.getActiveFromDate().compareTo(newRoleMember.getActiveToDate()) > 0) {
             throw new UnmarshalException("Cannot create a role member whose activeFromDate occurs after its activeToDate");
         }
 
         // Define defaults as needed.
         if (newRoleMember.getQualifications() == null) {
             newRoleMember.setQualifications(new HashMap<String, String>());
         }
 
         RoleMember.Builder builder = RoleMember.Builder.create(newRoleMember.getRoleId(), newRoleMember.getRoleIdAsMember(),
                 newRoleMember.getMemberId(), newRoleMember.getMemberType(),
                 newRoleMember.getActiveFromDate() == null ? null : new DateTime(newRoleMember.getActiveFromDate().getMillis()),
                 newRoleMember.getActiveToDate() == null ? null : new DateTime(newRoleMember.getActiveToDate().getMillis()),
                 newRoleMember.getQualifications(), null, null);
 
         // Save the role member.
         RoleMemberContract newMember = KimApiServiceLocator.getRoleService().createRoleMember(builder.build());
 
         return newMember.getId();
     }
 
     /**
      * Performs the necessary validation on the role permission, then saves it.
      *
      * @param newRolePermission The role permission to save.
      * @throws IllegalArgumentException if newRolePermission is null
      * @throws UnmarshalException if newRolePermission contains invalid data.
      */
     static void validateAndPersistNewRolePermission(RolePermissionXmlDTO newRolePermission) throws UnmarshalException {
         if (newRolePermission == null) {
             throw new IllegalArgumentException("newRolePermission cannot be null");
         }
 
         // Validate the role permission, and prepare its role ID if necessary.
         validateAndPrepareRolePermission(newRolePermission);
 
         // Save the role permission.
         KimApiServiceLocator.getRoleService().assignPermissionToRole(newRolePermission.getPermissionId(), newRolePermission.getRoleId());
     }
 
     /**
      * Removes any role members for a given role whose IDs are not listed in a given role member ID set.
      *
      * @param roleId The ID of the role containing the role members.
      * @param existingRoleMemberIds The IDs of the role members that should not be removed.
      * @throws IllegalArgumentException if roleId is blank or refers to a non-existent role, or if existingRoleMemberIds is null.
      */
     static void removeRoleMembers(String roleId, Set<String> existingRoleMemberIds) {
         if (StringUtils.isBlank(roleId)) {
             throw new IllegalArgumentException("roleId cannot be blank");
         } else if (existingRoleMemberIds == null) {
             throw new IllegalArgumentException("existingRoleMemberIds cannot be null");
         }
         RoleService roleUpdateService = KimApiServiceLocator.getRoleService();
         RoleContract role = KimApiServiceLocator.getRoleService().getRole(roleId);
         if (role == null) {
             throw new IllegalArgumentException("Cannot remove role members for role with ID \"" + roleId + "\" because that role does not exist");
         }
 
         // Remove any role members whose IDs are not in the set.
         List<RoleMember> roleMembers = KimApiServiceLocator.getRoleService().findRoleMembers(
                 QueryByCriteria.Builder.fromPredicates(equal("roleId", roleId))).getResults();
         if (roleMembers != null && !roleMembers.isEmpty()) {
             for (RoleMemberContract roleMember : roleMembers) {
                 if (!existingRoleMemberIds.contains(roleMember.getId())) {
                     // If the role member needs to be removed, use the member type code to determine which removal method to call.
                     MemberType memberType = roleMember.getType();
                     if (MemberType.PRINCIPAL.equals(memberType)) {
                         roleUpdateService.removePrincipalFromRole(roleMember.getMemberId(), role.getNamespaceCode(), role.getName(),
                                 (roleMember.getAttributes() != null) ? roleMember.getAttributes() : new HashMap<String, String>());
                     } else if (MemberType.GROUP.equals(memberType)) {
                         roleUpdateService.removeGroupFromRole(roleMember.getMemberId(), role.getNamespaceCode(), role.getName(),
                                 (roleMember.getAttributes() != null) ? roleMember.getAttributes() :new HashMap<String, String>());
                     } else if (MemberType.ROLE.equals(memberType)) {
                         roleUpdateService.removeRoleFromRole(roleMember.getMemberId(), role.getNamespaceCode(), role.getName(),
                                 (roleMember.getAttributes() != null) ? roleMember.getAttributes() : new HashMap<String, String>());
                     }
                 }
             }
         }
     }
 
     /**
      * Validates a new role's name, namespace, KIM type, and description, and sets the role's ID if the name and namespace match an existing role.
      */
     private static void validateAndPrepareRole(RoleXmlDTO newRole) throws UnmarshalException {
         // Ensure that the role name, role namespace, KIM type, and description have all been specified.
         if (StringUtils.isBlank(newRole.getRoleName()) || StringUtils.isBlank(newRole.getNamespaceCode())) {
             throw new UnmarshalException("Cannot create or override a role with a blank name or a blank namespace");
         } else if (StringUtils.isBlank(newRole.getKimTypeId())) {
             throw new UnmarshalException("Cannot create or override a role without specikfying a KIM type");
         } else if (StringUtils.isBlank(newRole.getRoleDescription())) {
             throw new UnmarshalException("Cannot create or override a role with a blank description");
         }
 
         // Attempt to find an existing matching role, and assign its ID to the validated role if it exists.
         String matchingId = KimApiServiceLocator.getRoleService().getRoleIdByNamespaceCodeAndName(
                 newRole.getNamespaceCode(), newRole.getRoleName());
         if (StringUtils.isNotBlank(matchingId)) {
             newRole.setRoleId(matchingId);
         }
     }
 
     /**
      * Validates a new role member's role ID, role name, and role namespace.
      */
     private static void validateRoleIdAndRoleNameForMember(RoleMemberXmlDTO newRoleMember) throws UnmarshalException {
         // If the "roleMember" tag was not a descendant of a "role" tag, derive and validate its role information accordingly.
         if (newRoleMember instanceof RoleMemberXmlDTO.OutsideOfRole) {
             RoleMemberXmlDTO.OutsideOfRole standaloneMember = (RoleMemberXmlDTO.OutsideOfRole) newRoleMember;
             if (standaloneMember.getRoleNameAndNamespace() != null) {
                 // If a name + namespace combo is given, verify that the combo maps to an existing role.
                 String existingId = KimApiServiceLocator.getRoleService().getRoleIdByNamespaceCodeAndName(
                         standaloneMember.getRoleNamespaceCode(), standaloneMember.getRoleName());
                 if (StringUtils.isBlank(existingId)) {
                     throw new UnmarshalException("Cannot create role member for role with name \"" + standaloneMember.getRoleName() + "\" and namespace \"" +
                             standaloneMember.getRoleNamespaceCode() + "\" because such a role does not exist");
                 }
 
                 // If the role member defines its own role ID, verify that it's the same as the one from the existing role; otherwise, assign the member's role ID.
                 if (StringUtils.isBlank(standaloneMember.getRoleId())) {
                     standaloneMember.setRoleId(existingId);
                 } else if (!standaloneMember.getRoleId().equals(existingId)) {
                     throw new UnmarshalException("Cannot create role member for role with ID \"" + standaloneMember.getRoleId() + "\", name \"" +
                             standaloneMember.getRoleName() + "\", and namespace \"" + standaloneMember.getRoleNamespaceCode() +
                                     "\" because the existing role with the same name and namespace has an ID of \"" + existingId + "\" instead");
                 }
             } else if (StringUtils.isBlank(standaloneMember.getRoleId())) {
                 throw new UnmarshalException("Cannot create role member without providing the role ID or role name + namespace that the member belongs to");
             } else if (KimApiServiceLocator.getRoleService().getRole(standaloneMember.getRoleId()) == null) {
                 throw new UnmarshalException("Cannot create role member for the role with ID \"" + standaloneMember.getRoleId() + "\" because that role does not exist");
             }
         }
 
         // Ensure that a role ID was explicitly defined or was derived from a name + namespace combo.
         if (StringUtils.isBlank(newRoleMember.getRoleId())) {
             throw new UnmarshalException("Cannot create role member without providing the role ID or role name + namespace that the member belongs to");
         }
     }
 
     /**
      * Validates a new role member's member type, member ID, member name, and (if applicable) member namespace code.
      */
     private static void validateMemberIdentity(RoleMemberXmlDTO newRoleMember) throws UnmarshalException {
         // Ensure that sufficient and non-conflicting membership info has been set. (The getMemberTypeCode() method performs such validation.)
         MemberType memberType = newRoleMember.getMemberType();
         if (memberType == null) {
             throw new UnmarshalException("Cannot create a role member with no member principal/group/role identification information specified");
         }
 
         // Ensure that a valid member ID was specified, if present.
         if (StringUtils.isNotBlank(newRoleMember.getMemberId())) {
             if (MemberType.PRINCIPAL.equals(memberType)) {
                 // If the member is a principal, ensure that the principal exists.
                 if (KimApiServiceLocator.getIdentityService().getPrincipal(newRoleMember.getPrincipalId()) == null) {
                     throw new UnmarshalException("Cannot create principal role member with principal ID \"" +
                             newRoleMember.getPrincipalId() + "\" because such a person does not exist");
                 }
             } else if (MemberType.GROUP.equals(memberType)) {
                 // If the member is a group, ensure that the group exists.
                 if (KimApiServiceLocator.getGroupService().getGroup(newRoleMember.getGroupId()) == null) {
                     throw new UnmarshalException("Cannot create group role member with group ID \"" +
                             newRoleMember.getGroupId() + "\" because such a group does not exist");
                 }
             } else if (MemberType.ROLE.equals(memberType)) {
                 // If the member is another role, ensure that the role exists and that the role is not trying to become a member of itself.
                 if (newRoleMember.getRoleId().equals(newRoleMember.getRoleIdAsMember())) {
                     throw new UnmarshalException("The role with ID \"" + newRoleMember.getRoleIdAsMember() + "\" cannot be made a member of itself");
                 } else if (KimApiServiceLocator.getRoleService().getRole(newRoleMember.getRoleIdAsMember()) == null) {
                     throw new UnmarshalException("Cannot use role with ID \"" + newRoleMember.getRoleIdAsMember() +
                             "\" as a role member because such a role does not exist");
                 }
             }
         }
 
         // Ensure that a valid member name (and namespace, if applicable) was specified, if present.
         if (StringUtils.isNotBlank(newRoleMember.getMemberName())) {
             if (MemberType.PRINCIPAL.equals(memberType)) {
                 //If the member is a principal, ensure that the principal exists and does not conflict with any existing principal ID information.
                 PrincipalContract tempPrincipal = KimApiServiceLocator.getIdentityService().getPrincipalByPrincipalName(newRoleMember.getPrincipalName());
                 if (tempPrincipal == null) {
                     throw new UnmarshalException("Cannot create principal role member with principal name \"" +
                             newRoleMember.getPrincipalName() + "\" because such a person does not exist");
                 } else if (StringUtils.isBlank(newRoleMember.getPrincipalId())) {
                     // If no principal ID was given, assign one from the retrieved principal.
                     newRoleMember.setPrincipalId(tempPrincipal.getPrincipalId());
                 } else if (!newRoleMember.getPrincipalId().equals(tempPrincipal.getPrincipalId())) {
                     throw new UnmarshalException("Cannot create principal role member with principal ID \"" + newRoleMember.getPrincipalId() +
                             "\" and principal name \"" + newRoleMember.getPrincipalName() + "\" because the principal with that name has an ID of \"" +
                                     tempPrincipal.getPrincipalId() + "\" instead");
                 }
             } else if (MemberType.GROUP.equals(memberType)) {
                 // If the member is a group, ensure that the group exists and does not conflict with any existing group ID information.
                 NameAndNamespacePair groupNameAndNamespace = newRoleMember.getGroupName();
                 GroupContract tempGroup = KimApiServiceLocator.getGroupService().getGroupByNamespaceCodeAndName(
                         groupNameAndNamespace.getNamespaceCode(), groupNameAndNamespace.getName());
                 if (tempGroup == null) {
                     throw new UnmarshalException("Cannot create group role member with namespace \"" + groupNameAndNamespace.getNamespaceCode() +
                             "\" and name \"" + groupNameAndNamespace.getName() + "\" because such a group does not exist");
                 } else if (StringUtils.isBlank(newRoleMember.getGroupId())) {
                     // If no group ID was given, assign one from the retrieved group.
                     newRoleMember.setGroupId(tempGroup.getId());
                 } else if (!newRoleMember.getGroupId().equals(tempGroup.getId())) {
                     throw new UnmarshalException("Cannot create group role member with ID \"" + newRoleMember.getGroupId() + "\", namespace \"" +
                             groupNameAndNamespace.getNamespaceCode() + "\", and name \"" + groupNameAndNamespace.getName() +
                                     "\" because the group with that namespace and name has an ID of \"" + tempGroup.getId() + "\" instead");
                 }
             } else if (MemberType.ROLE.equals(memberType)) {
                 // If the member is another role, ensure that the role exists, does not conflict with any existing role ID information, and is not the member's role.
                 NameAndNamespacePair roleNameAndNamespace = newRoleMember.getRoleNameAsMember();
                 RoleContract tempRole = KimApiServiceLocator.getRoleService().getRoleByNamespaceCodeAndName(
                         roleNameAndNamespace.getNamespaceCode(), roleNameAndNamespace.getName());
                 if (tempRole == null) {
                     throw new UnmarshalException("Cannot use role with namespace \"" + roleNameAndNamespace.getNamespaceCode() +
                             "\" and name \"" + roleNameAndNamespace.getName() + "\" as a role member because such a role does not exist");
                 } else if (newRoleMember.getRoleId().equals(tempRole.getId())) {
                     throw new UnmarshalException("The role with namespace \"" + roleNameAndNamespace.getNamespaceCode() +
                             "\" and name \"" + roleNameAndNamespace.getName() + "\" cannot be made a member of itself");
                 } else if (StringUtils.isBlank(newRoleMember.getRoleId())) {
                     // If no role ID was given, assign one from the retrieved role.
                     newRoleMember.setRoleIdAsMember(tempRole.getId());
                 } else if (!newRoleMember.getRoleId().equals(tempRole.getId())) {
                     throw new RuntimeException("Cannot use role with ID \"" + newRoleMember.getRoleId() + "\", namespace \"" +
                             roleNameAndNamespace.getNamespaceCode() + "\", and name \"" + roleNameAndNamespace.getName() +
                                     "\" as a role member because the role with that namespace and name has an ID of \"" +
                                             tempRole.getId() + "\" instead");
                 }
             }
         }
 
         // Ensure that a member ID was either explicitly defined or was derived from the member name (and namespace, if applicable).
         if (StringUtils.isBlank(newRoleMember.getMemberId())) {
             throw new RuntimeException("Cannot create a role member with no member principal/group/role identification information specified");
         }
 
     }
 
     /**
      * Validates a role permission's role and permission identification information, and assigns its role ID if needed.
      */
     private static void validateAndPrepareRolePermission(RolePermissionXmlDTO newRolePermission) throws UnmarshalException {
 
         // If this is a standalone role permission, derive and validate its role information accordingly.
         if (newRolePermission instanceof RolePermissionXmlDTO.OutsideOfRole) {
             RolePermissionXmlDTO.OutsideOfRole standaloneRolePerm = (RolePermissionXmlDTO.OutsideOfRole) newRolePermission;
             if (standaloneRolePerm.getRoleNameAndNamespace() != null) {
                 // If a role name + namespace is given, assign or validate the role ID accordingly.
                 String tempRoleId = KimApiServiceLocator.getRoleService().getRoleIdByNamespaceCodeAndName(
                         standaloneRolePerm.getRoleNamespaceCode(), standaloneRolePerm.getRoleName());
                 if (StringUtils.isBlank(tempRoleId)) {
                     throw new UnmarshalException("Cannot assign permission to role with namespace \"" + standaloneRolePerm.getRoleNamespaceCode() +
                             "\" and name \"" + standaloneRolePerm.getRoleName() + "\" because that role does not exist");
                 } else if (StringUtils.isBlank(standaloneRolePerm.getRoleId())) {
                     // If no role ID was given, assign one from the retrieved role.
                     standaloneRolePerm.setRoleId(standaloneRolePerm.getRoleId());
                 } else if (!standaloneRolePerm.getRoleId().equals(tempRoleId)) {
                     throw new UnmarshalException("Cannot assign permission to role with ID \"" + standaloneRolePerm.getRoleId() + "\", namespace \"" +
                             standaloneRolePerm.getRoleNamespaceCode() + "\", and name \"" + standaloneRolePerm.getRoleName() +
                                     "\" because the existing role with that name and namespace has an ID of \"" + tempRoleId + "\" instead");
                 }
             } else if (StringUtils.isBlank(standaloneRolePerm.getRoleId())) {
                 throw new UnmarshalException(
                         "Cannot assign permission to role without providing the role ID or role name + namespace that the permission is assigned to");
             } else if (KimApiServiceLocator.getRoleService().getRole(standaloneRolePerm.getRoleId()) == null) {
                 throw new UnmarshalException("Cannot assign permission to role with ID \"" + standaloneRolePerm.getRoleId() +
                         "\" because that role does not exist");
             }
         }
 
         // Ensure that a role ID was explicitly defined or was derived from a name + namespace combo.
         if (StringUtils.isBlank(newRolePermission.getRoleId())) {
             throw new UnmarshalException("Cannot assign permission to role without providing the role ID or role name + namespace that the permission is assigned to");
         }
 
         // If the permission is being identified by name and namespace, derive or validate its permission ID accordingly.
         if (newRolePermission.getPermissionNameAndNamespace() != null) {
             PermissionContract permission = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(
                     newRolePermission.getPermissionNamespaceCode(), newRolePermission.getPermissionName());
             if (permission == null) {
                 throw new UnmarshalException("Cannot get role assigned to permission with namespace \"" + newRolePermission.getPermissionNamespaceCode() +
                         "\" and name \"" + newRolePermission.getPermissionName() + "\" because that permission does not exist");
             } else if (StringUtils.isBlank(newRolePermission.getPermissionId())) {
                 // If no permission ID was given, assign one from the retrieved permission.
                 newRolePermission.setPermissionId(permission.getId());
             } else if (!newRolePermission.getPermissionId().equals(permission.getId())) {
                 throw new UnmarshalException("Cannot get role assigned to permission with ID \"" + newRolePermission.getPermissionId() + "\", namespace \"" +
                         newRolePermission.getPermissionNamespaceCode() + "\", and name \"" + newRolePermission.getPermissionName() +
                                 "\" because the existing permission with that name and namespace has an ID of \"" + permission.getId() + "\" instead");
             }
         } else if (StringUtils.isBlank(newRolePermission.getPermissionId())) {
             throw new UnmarshalException("Cannot assign permission to role without specifying the ID or name and namespace of the permission to assign");
         } else if (KimApiServiceLocator.getPermissionService().getPermission(newRolePermission.getPermissionId()) == null) {
             throw new UnmarshalException("Cannot get role assigned to permission with ID \"" + newRolePermission.getPermissionId() +
                     "\" because that permission does not exist");
         }
     }
 
 }