/**
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
 *
 * Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
 *
 * The contents of this file are subject to the terms
 * of the Common Development and Distribution License
 * (the License). You may not use this file except in
 * compliance with the License.
 *
 * You can obtain a copy of the License at
 * https://opensso.dev.java.net/public/CDDLv1.0.html or
 * opensso/legal/CDDLv1.0.txt
 * See the License for the specific language governing
 * permission and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL
 * Header Notice in each file and include the License file
 * at opensso/legal/CDDLv1.0.txt.
 * If applicable, add the following below the CDDL Header,
 * with the fields enclosed by brackets [] replaced by
 * your own identifying information:
 * "Portions Copyrighted [year] [name of copyright owner]"
 *
 * $Id: DefaultDiscoAuthorizer.java,v 1.2 2008/06/25 05:49:56 qcheng Exp $
 *
 */


package com.sun.identity.liberty.ws.disco.plugins;

import java.util.Map;

import com.sun.identity.liberty.ws.interfaces.Authorizer;
import com.sun.identity.liberty.ws.disco.common.DiscoUtils;
import com.sun.identity.liberty.ws.disco.common.DiscoConstants;
import com.sun.identity.liberty.ws.disco.jaxb.*;
import com.sun.identity.policy.PolicyEvaluator;
import com.iplanet.sso.SSOToken;

/**
 * This class <code>DefaultDiscoAuthorizer</code> provides a default
 * implementation of the <code>Authorizer</code> interface.
 */
public class DefaultDiscoAuthorizer implements Authorizer {

    /**
     * Separator for resource.
     */
    public static final String RESOURCE_SEPERATOR = ";";

    PolicyEvaluator pe = null;
    
    /**
     * Default Constructor.
     */
    public DefaultDiscoAuthorizer() {
        DiscoUtils.debug.message("in DefaultDiscoAuthorizer.constructor");
        try {
            pe = new PolicyEvaluator("sunIdentityServerDiscoveryService");
        } catch (Exception e) {
            DiscoUtils.debug.error("DefaultDiscoAuthorizer.constructor: "
                + "Exception obtaining PolicyEvaluator: ", e);
        }
    }

    /**
     * Checks if the WSC is authorized to query or modify the select data.
     * @param credential credential of a WSC.
     *      In this implmentation, credential is the SSOToken of the WSC.
     * @param action request action.
     *      In this implementation, action is either
     *      <code>DiscoConstants.ACTION_LOOKUP</code> or
     *      <code>DiscoConstants.ACTION_UPDATE</code>.
     * @param data Object who is being accessed.
     *      In this implementation, data is of type ResourceOfferingType.
     * @param env A Map contains information useful for policy evaluation.
     *      The following key is defined and its value should be passed in:
     *      Key: <code>USER_ID</code>
     *      Value: id of the user whose resource is being accessed.
     *      In this implementation, the value is the userDN.
     *      Key: <code>AUTH_TYPE</code>
     *      Value: The authentication mechanism WSC used.
     *      Key: <code>MESSAGE</code>
     *      Value:
     *      <code>com.sun.identity.liberty.ws.soapbinding.Message</code>.
     * @return true if the WSC is authorized.
     */
    public boolean isAuthorized(Object credential, String action, 
    Object data, java.util.Map env)
    {
        DiscoUtils.debug.message("DefaultDiscoAuthorizer.isAuthorized.");
        if (pe == null) {
            DiscoUtils.debug.error("DefaultDiscoAuthorizer.isAuthorized: null "
                + "Policy Evaluator.");
            return false;
        }

        // another alternative to this method is not to check input and call
        // policy evaluator directly. The benefit of checking input first is
        // to obtain more meaningful error message.
        if (!checkInput(credential, action, data, env)) {
            return false;
        }

        String resource = null;
        try {
            ServiceInstanceType instance =
                ((ResourceOfferingType) data).getServiceInstance();
            resource = instance.getServiceType() + RESOURCE_SEPERATOR +
                        instance.getProviderID();
        } catch (Exception e) {
            DiscoUtils.debug.error("DefaultDiscoAuthorizer.isAuthorized: "
                + "Exception occured when constucting policy resource:", e);
            return false;
        }

        boolean result = false;
        try {
            result = pe.isAllowed((SSOToken) credential, resource, action, env);
        } catch (Exception e) {
            DiscoUtils.debug.error("DefaultDiscoAuthorizer.isAuthorized: "
                + "Exception occured during policy evaluation: ", e);
            result = false;
        }
        return result;
    }

    private boolean checkInput(Object credential, String action, Object data,
                                        Map env)
    {
        if ((credential == null) || !(credential instanceof SSOToken)) {
            DiscoUtils.debug.error("DefaultDiscoAuthorizer.checkInput: null or "
                + "wrong credential.");
            return false;
        }

        if ((action == null) || (!action.equals(DiscoConstants.ACTION_LOOKUP) &&
                                !action.equals(DiscoConstants.ACTION_UPDATE)))
        {
            DiscoUtils.debug.error("DefaultDiscoAuthorizer.checkInput: null or "
                + "wrong action.");
            return false;
        }

        if ((data == null) || !(data instanceof ResourceOfferingType)) {
            DiscoUtils.debug.error("DefaultDiscoAuthorizer.checkInput: null or "
                + "wrong data.");
            return false;
        }

        if ((env == null) || !env.containsKey(USER_ID) ||
            !env.containsKey(AUTH_TYPE) || !env.containsKey(MESSAGE))
        {
            DiscoUtils.debug.error("DefaultDiscoAuthorizer.checkInput: null or "
                + "missing env data.");
            return false;
        }
        return true;
    }

    /**
     * Returns authorization decision for the given action(query or modify)
     * and to the given select data. Currently this method always returns null.
     * @param credential credential of a <code>WSC</code>.
     * @param action request action.
     * @param data Object who is being accessed.
     * @param env A Map contains information useful for policy evaluation.
     *          The following key is defined and its value should be passed in:
     *          Key: <code>USER_ID</code>
     *          Value: id of the user whose resource is being accessed.
     *          Key: <code>AUTH_TYPE</code>
     *          Value: The authentication mechanism <code>WSC</code> used.
     *          Key: <code>MESSAGE</code>
     *          Value:
     *          <code>com.sun.identity.liberty.ws.soapbinding.Message</code>.
     * @return <code>AuthorizationDecision</code> object contains authorization
     *             decision information for the given resource.
     * @exception Exception
     */
    public Object getAuthorizationDecision(
                  Object credential,
                  String action,
                  Object data,
                  java.util.Map env)
    throws Exception {
        return null;
    }

}