/**
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
 *
 * Copyright (c) 2008 Sun Microsystems Inc. All Rights Reserved
 *
 * The contents of this file are subject to the terms
 * of the Common Development and Distribution License
 * (the License). You may not use this file except in
 * compliance with the License.
 *
 * You can obtain a copy of the License at
 * https://opensso.dev.java.net/public/CDDLv1.0.html or
 * opensso/legal/CDDLv1.0.txt
 * See the License for the specific language governing
 * permission and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL
 * Header Notice in each file and include the License file
 * at opensso/legal/CDDLv1.0.txt.
 * If applicable, add the following below the CDDL Header,
 * with the fields enclosed by brackets [] replaced by
 * your own identifying information:
 * "Portions Copyrighted [year] [name of copyright owner]"
 *
 * $Id: Evaluator.java,v 1.2 2009/09/10 16:35:38 veiming Exp $
 *
 * Portions copyright 2013-2015 ForgeRock AS.
 */
package com.sun.identity.entitlement;

import com.sun.identity.shared.Constants;
import com.sun.identity.shared.configuration.SystemPropertiesManager;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import java.util.Set;
import javax.security.auth.Subject;
import org.forgerock.guice.core.InjectorHolder;
import org.forgerock.openam.entitlement.PolicyConstants;
import org.forgerock.openam.entitlement.monitoring.EntitlementConfigurationWrapper;
import org.forgerock.openam.entitlement.monitoring.PolicyMonitor;
import org.forgerock.openam.entitlement.monitoring.PolicyMonitoringType;

/**
 * The class evaluates entitlement request and provides decisions.
 * @supported.api
 */
public class Evaluator {

    private Subject adminSubject;
    private String applicationName =
        ApplicationTypeManager.URL_APPLICATION_TYPE_NAME;

    public static final int DEFAULT_POLICY_EVAL_THREAD = 10;

    private final PolicyMonitor policyMonitor;
    private final EntitlementConfigurationWrapper configWrapper;

    /**
     * Constructor to create an evaluator of default service type.
     *
     * @throws EntitlementException if any other abnormal condition occ.
     */
    private Evaluator()
        throws EntitlementException {
        policyMonitor = getPolicyMonitor();
        configWrapper = new EntitlementConfigurationWrapper();

    }

    private PolicyMonitor getPolicyMonitor() {
        //used as no direct access to SystemProperties
        boolean serverMode = Boolean.parseBoolean(SystemPropertiesManager.get(Constants.SERVER_MODE));

        if (serverMode) {
            return InjectorHolder.getInstance(PolicyMonitor.class);
        } else {
            return null;
        }
    }

    /**
     * Constructor to create an evaluator given the service type.
     *
     * @param subject Subject who credential is used for performing the 
     *        evaluation.
     * @param applicationName the name of the aplication for
     *        which this evaluator can be used.
     * @throws EntitlementException if any other abnormal condition occured.
     */
    public Evaluator(Subject subject, String applicationName)
        throws EntitlementException {
        adminSubject = subject;
        this.applicationName = applicationName;
        policyMonitor = getPolicyMonitor();
        configWrapper = new EntitlementConfigurationWrapper();
    }

    /**
     * Constructor to create an evaluator the default service type.
     *
     * @param subject Subject who credential is used for performing the 
     *        evaluation.
     * @throws EntitlementException if any other abnormal condition occured.
     */
    public Evaluator(Subject subject)
        throws EntitlementException {
        adminSubject = subject;
        policyMonitor = getPolicyMonitor();
        configWrapper = new EntitlementConfigurationWrapper();
    }
    
    /**
     * Returns <code>true</code> if the subject is granted to an
     * entitlement.
     *
     * @param realm Realm name.
     * @param subject Subject who is under evaluation.
     * @param e Entitlement object which describes the resource name and 
     *          actions.
     * @param envParameters Map of environment parameters.
     * @return <code>true</code> if the subject is granted to an
     *         entitlement.
     * @throws EntitlementException if the result cannot be determined.
     */
    public boolean hasEntitlement(
        String realm,
        Subject subject, 
        Entitlement e,
        Map<String, Set<String>> envParameters
    ) throws EntitlementException {

        PrivilegeEvaluator evaluator = new PrivilegeEvaluator();
        boolean result = evaluator.hasEntitlement(realm,
            adminSubject, subject, applicationName, e, envParameters);

        return result;
    }

    /**
     * Returns a list of entitlements for a given subject, resource names
     * and environment.
     *
     * @param realm Realm Name.
     * @param subject Subject who is under evaluation.
     * @param resourceNames Resource names.
     * @param environment Environment parameters.
     * @return a list of entitlements for a given subject, resource name
     *         and environment.
     * @throws EntitlementException if the result cannot be determined.
     */
    public List<Entitlement> evaluate(
        String realm,
        Subject subject,
        Set<String> resourceNames,
        Map<String, Set<String>> environment
    ) throws EntitlementException {
        if ((resourceNames == null) || resourceNames.isEmpty()) {
            throw new EntitlementException(424);
        }

        List<Entitlement> results = new ArrayList<Entitlement>();

        for (String res : resourceNames) {
            List<Entitlement> r = evaluate(realm, subject, res, environment,
                false);
            if ((r != null) && !r.isEmpty()) {
                results.addAll(r);
            }
        }
        return results;
    }

    /**
     * Returns a list of entitlements for a given subject, resource name
     * and environment.
     *
     * @param realm
     *         Realm Name.
     * @param subject
     *         Subject who is under evaluation.
     * @param resourceName
     *         Resource name.
     * @param environment
     *         Environment parameters.
     * @param recursive
     *         <code>true</code> to perform evaluation on sub resources
     *         from the given resource name.
     * @return a list of entitlements for a given subject, resource name
     *         and environment.
     * @throws EntitlementException
     *         if the result cannot be determined.
     */
    public List<Entitlement> evaluate(
            String realm,
            Subject subject,
            String resourceName,
            Map<String, Set<String>> environment,
            boolean recursive
    ) throws EntitlementException {

        long startTime = System.currentTimeMillis();

        // Delegation to applications is currently not configurable, passing super admin (see AME-4959)
        Application application = ApplicationManager
                .getApplication(PolicyConstants.SUPER_ADMIN_SUBJECT, realm, applicationName);

        if (application == null) {
            // App retrieval error.
            throw new EntitlementException(EntitlementException.APP_RETRIEVAL_ERROR, new String[] {realm});
        }

        // Normalise the incoming resource URL.
        String normalisedResourceName = application.getResourceComparator().canonicalize(resourceName);

        PrivilegeEvaluator evaluator = new PrivilegeEvaluator();
        List<Entitlement> results = evaluator.evaluate(realm, adminSubject, subject,
                applicationName, normalisedResourceName, resourceName, environment, recursive);

        if (configWrapper.isMonitoringRunning()) {
            policyMonitor.addEvaluation(System.currentTimeMillis() - startTime, realm, applicationName, resourceName,
                    subject, recursive ? PolicyMonitoringType.SUBTREE : PolicyMonitoringType.SELF);
        }

        return results;
    }

    /**
     * Returns application name.
     * 
     * @return application name.
     */
    public String getApplicationName() {
        return applicationName;
    }
}