/**
    * Copyright 2011-2013 The Kuali Foundation Licensed under the
    * Educational Community License, Version 2.0 (the "License"); you may
    * not use this file except in compliance with the License. You may
    * obtain a copy of the License at
    *
    * http://www.osedu.org/licenses/ECL-2.0
    *
    * Unless required by applicable law or agreed to in writing,
   * software distributed under the License is distributed on an "AS IS"
   * BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
   * or implied. See the License for the specific language governing
   * permissions and limitations under the License.
   */
  
  package org.kuali.mobility.security.authn.interceptors;
  
  import org.apache.log4j.Logger;
  import org.kuali.mobility.security.authn.util.AuthenticationConstants;
  import org.kuali.mobility.security.user.api.User;
  import org.kuali.mobility.security.user.api.UserDao;
  import org.kuali.mobility.security.user.entity.UserImpl;
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.beans.factory.annotation.Qualifier;
  import org.springframework.web.servlet.HandlerInterceptor;
  import org.springframework.web.servlet.ModelAndView;
  
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  
  /**
   * The RemoteUserInterceptor looks for a remote_user and creates a user 
   * object in the session for it.  It is the base hook to start an authenticated 
   * session. All authN and authZ should either be added to it or come after 
   * it in the filter/interceptor chain.
   */
  public class RemoteUserInterceptor implements HandlerInterceptor {
  	private static final Logger LOG = Logger.getLogger( RemoteUserInterceptor.class );
  
  	@Autowired
  	@Qualifier("kmeUserDao")
  	private UserDao userDao;
  
  	@Override
  	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
  		LOG.trace("RemoteUserInterceptor preHandle");
          User user = (User)request.getSession(true).getAttribute( AuthenticationConstants.KME_USER_KEY );
  		if( user == null )
  		{
              LOG.debug("No user found in session, creating a new one.");
  			user = new UserImpl();
  			request.getSession().setAttribute( AuthenticationConstants.KME_USER_KEY, user );
  		}
  		if( request.getRemoteUser() != null && !request.getRemoteUser().isEmpty() )
  		{
              LOG.debug("REMOTE_USER exists. Preparing to reconcile user :"+request.getRemoteUser());
  
  			if( user.isPublicUser() )
  			{
                  LOG.debug("User was public, loading user "+request.getRemoteUser()+" from database.");
  				User existingUser = getUserDao().loadUserByLoginName(request.getRemoteUser());
  				if( existingUser == null ) {
                      LOG.debug("User "+request.getRemoteUser()+" not found in database.");
  					user.setLoginName(request.getRemoteUser());
  					getUserDao().saveUser(user);
  				} else {
                      LOG.debug("User found and being pushed into session.");
  					request.getSession().setAttribute( AuthenticationConstants.KME_USER_KEY, existingUser );
  				}
  			}
  			else if( !request.getRemoteUser().equalsIgnoreCase( user.getLoginName() ) )
  			{
  				LOG.info( "Identify mismatch. Expected ["+user.getLoginName()+"] recieved ["+request.getRemoteUser()+"]" );
  				user.invalidateUser();
  				request.getSession().invalidate();
  				request.getSession(true);
  				response.sendError(401, "Identity Mismatch.  Attempting to override existing user with a new one." );
  			}
  
  		}
  
          /*	Comment out the following block as all requests (include static contents i.e. image, cs and js files) go through
              this interceptor, while only requests for protected/secured contents have REMOTE_USER.
              Should improve or refactor in the future.
          */
          /*
          else
  		{
              LOG.info("REMOTE_USER NOT exists");
  			if( user.getLoginName() != null )
  			{
  				if( !user.getLoginName().startsWith( AuthenticationConstants.PUBLIC_USER ) )
  				{
  					LOG.info( "Identity mismatch. Session user populated when no REMOTE_USER provided. User removed from session." );
  					user.setLoginName(AuthenticationConstants.PUBLIC_USER + request.getSession().getId());
  				}
  				else if( !user.getLoginName().equalsIgnoreCase( AuthenticationConstants.PUBLIC_USER + request.getSession().getId() ) )
  				{
  					LOG.info( "Identity mismatch. Public user key does not match expected id. User updated in session.");
 					user.invalidateUser();
                     user = new UserImpl();
 					user.setLoginName(AuthenticationConstants.PUBLIC_USER + request.getSession().getId());
                     request.getSession().setAttribute( AuthenticationConstants.KME_USER_KEY, user );
                 }
 			}
 		}
 		*/
 		return true;
 	}
 
 	@Override
 	public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {}
 
 	@Override
 	public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {}
 
 	public UserDao getUserDao() {
 		return userDao;
 	}
 
 	public void setUserDao(UserDao userDao) {
 		this.userDao = userDao;
 	}
 }