/**
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
 *
 * Copyright (c) 2009 Sun Microsystems Inc. All Rights Reserved
 *
 * The contents of this file are subject to the terms
 * of the Common Development and Distribution License
 * (the License). You may not use this file except in
 * compliance with the License.
 *
 * You can obtain a copy of the License at
 * https://opensso.dev.java.net/public/CDDLv1.0.html or
 * opensso/legal/CDDLv1.0.txt
 * See the License for the specific language governing
 * permission and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL
 * Header Notice in each file and include the License file
 * at opensso/legal/CDDLv1.0.txt.
 * If applicable, add the following below the CDDL Header,
 * with the fields enclosed by brackets [] replaced by
 * your own identifying information:
 * "Portions Copyrighted [year] [name of copyright owner]"
 *
 * $Id: PrivilegePolicyMapping.java,v 1.2 2009/11/12 18:37:40 veiming Exp $
 */

package com.sun.identity.entitlement.opensso;

import com.iplanet.sso.SSOToken;
import com.sun.identity.entitlement.EntitlementCondition;
import com.sun.identity.entitlement.EntitlementSubject;
import com.sun.identity.entitlement.IPrivilege;
import com.sun.identity.entitlement.OrCondition;
import com.sun.identity.entitlement.Privilege;
import com.sun.identity.entitlement.util.IdRepoUtils;
import com.sun.identity.idm.AMIdentity;
import com.sun.identity.policy.ConditionTypeManager;
import com.sun.identity.policy.Policy;
import com.sun.identity.policy.PolicyException;
import com.sun.identity.policy.PolicyManager;
import com.sun.identity.policy.Rule;
import com.sun.identity.policy.SubjectTypeManager;
import com.sun.identity.policy.interfaces.Condition;
import com.sun.identity.policy.interfaces.Subject;
import com.sun.identity.policy.plugins.PrivilegeCondition;
import com.sun.identity.policy.plugins.PrivilegeSubject;
import com.sun.identity.security.AdminTokenAction;
import com.sun.identity.unittest.UnittestLog;
import java.security.AccessController;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import org.testng.annotations.AfterClass;
import org.testng.annotations.BeforeClass;
import org.testng.annotations.Test;

/**
 *
 * @author dennis
 */
public class PrivilegePolicyMapping {
    private final static String TEST_USER_NAME =
        "PrivilegePolicyMappingTestUser";
    private final static String POLICY_NAME = "PrivilegePolicyMappingPolicy";
    private final static String RES_NAME =
        "http://whatever.privilegepolicymapping.com:80";
    private final static String EXCLUDED_RES =
        "http://whatever.privilegepolicymapping.com:80/cb";

    private AMIdentity testUser;
    private Policy policy;
    private Privilege privilege;
    private Map<String, Set<String>> ipConditionEnvMap;
    private Map<String, Set<String>> ipConditionEnvMap1;
    private Map<String, Set<String>> actionValues;

    @BeforeClass
    public void setup() throws Exception {
        try {
            UnittestLog.logMessage("PrivilegePolicyMapping.setUp():" +
                    "entered");
            ipConditionEnvMap = new HashMap<String, Set<String>>();
            Set<String> set = new HashSet<String>();
            set.add("whatever.whatever");
            ipConditionEnvMap.put(Condition.DNS_NAME, set);

            ipConditionEnvMap1 = new HashMap<String, Set<String>>();
            set = new HashSet<String>();
            set.add("whatever1.whatever1");
            ipConditionEnvMap1.put(Condition.DNS_NAME, set);

            SSOToken adminToken = (SSOToken) AccessController.doPrivileged(
                    AdminTokenAction.getInstance());
            testUser = IdRepoUtils.createUser("/", TEST_USER_NAME);
            PolicyManager pm = new PolicyManager(adminToken, "/");
            policy = new Policy(POLICY_NAME, "", false, true);
            policy.addRule(createRule());
            policy.addSubject("subjectName", createSubject(pm));
            policy.addCondition("conditionName", createIPCondition(pm));
            policy.addCondition("conditionName1", createIPCondition1(pm));
            pm.addPolicy(policy);
        } catch (Exception e) {
            UnittestLog.logError("PrivilegePolicyMapping.setUp();"
                    + "Exception STACKTRACE:"
                    + e.getMessage());
            StackTraceElement[] elems = e.getStackTrace();
            for (StackTraceElement elem : elems) {
                UnittestLog.logMessage(elem.toString());
            }
            UnittestLog.logMessage("END STACKTRACE");
            throw e;
        }
    }

    @AfterClass
    public void cleanup() throws Exception {
        SSOToken adminToken = (SSOToken) AccessController.doPrivileged(
            AdminTokenAction.getInstance());
        IdRepoUtils.deleteIdentity("/", testUser);
        PolicyManager pm = new PolicyManager(adminToken, "/");
        pm.removePolicy(POLICY_NAME);
    }

    @Test (dependsOnMethods = {"policyToPrivilege"})
    public void privilegeToPolicy() throws Exception {
        Policy p = PrivilegeUtils.privilegeToPolicy("/", privilege);
        Set<String> ruleNames = p.getRuleNames();
        for (String ruleName : ruleNames ) {
            Rule r = p.getRule(ruleName);
            if (!RES_NAME.equals(r.getResourceName())) {
                throw new Exception(
                    "PrivilegePolicyMapping.privilegeToPolicy: resource is incorrect");
            }
            if (!actionValues.equals(r.getActionValues())) {
                throw new Exception(
                    "PrivilegePolicyMapping.privilegeToPolicy: action value is incorrect");
            }
        }

        Set<String> subjectNames = p.getSubjectNames();
        for (String subjectName : subjectNames) {
            Subject sbj = p.getSubject(subjectName);
            if (!(sbj instanceof PrivilegeSubject)) {
                throw new Exception(
                    "PrivilegePolicyMapping.privilegeToPolicy: not instance of privilege subject");
            }
        }

        Set<String> conditionNames = p.getConditionNames();
        if (conditionNames.size() != 1) {
            throw new Exception(
                "PrivilegePolicyMapping.privilegeToPolicy: number of condition is incorrect");
        }

        for (String conditionName : conditionNames) {
            Condition cond = p.getCondition(conditionName);
            if (!(cond instanceof PrivilegeCondition)) {
                throw new Exception(
                    "PrivilegePolicyMapping.privilegeToPolicy: not instance of privilege condition");
            }
        }

    }

    @Test
    public void policyToPrivilege() throws Exception {
        Set<IPrivilege> privileges = PrivilegeUtils.policyToPrivileges(policy);
        if (privileges.isEmpty()) {
            throw new Exception(
                "PrivilegePolicyMapping.policyToPrivilege: cannot get privilege");
        }

        privilege = (Privilege)privileges.iterator().next();

        EntitlementCondition cond = privilege.getCondition();
        if (!(cond instanceof OrCondition)) {
            throw new Exception(
                "PrivilegePolicyMapping.policyToPrivilege: condition is not AND condition");
        }
        OrCondition pOrCond = (OrCondition)cond;

        for (EntitlementCondition ec : pOrCond.getEConditions()) {
            if (!(ec instanceof PolicyCondition)) {
                throw new Exception(
                    "PrivilegePolicyMapping.policyToPrivilege: condition is not policy condition");
            }
            PolicyCondition pCond = (PolicyCondition) ec;
            Map<String, Set<String>> pCondProp = pCond.getProperties();
            if (!pCondProp.equals(ipConditionEnvMap) &&
                !pCondProp.equals(ipConditionEnvMap1)
            ) {
                throw new Exception(
                    "PrivilegePolicyMapping.policyToPrivilege: condition values are not correct");
            }
        }

        EntitlementSubject sbj = privilege.getSubject();
        if (!(sbj instanceof PolicySubject)) {
            throw new Exception(
                "PrivilegePolicyMapping.policyToPrivilege: subject is not privilege subject");
        }
        PolicySubject pSbj = (PolicySubject)sbj;
        Set pSbjValue = pSbj.getValues();
        if ((pSbjValue == null) || pSbjValue.isEmpty()) {
            throw new Exception(
                "PrivilegePolicyMapping.policyToPrivilege: subject value is empty");
        }
        if (!pSbjValue.contains(testUser.getUniversalId())) {
            throw new Exception(
                "PrivilegePolicyMapping.policyToPrivilege: subject value is incorrect");
        }
    }

    private Rule createRule() throws PolicyException {
        actionValues = new HashMap<String, Set<String>>();
        {
            Set<String> set = new HashSet<String>();
            set.add("allow");
            actionValues.put("GET", set);
        }
        {
            Set<String> set = new HashSet<String>();
            set.add("deny");
            actionValues.put("POST", set);
        }

        return new Rule("rule1", "iPlanetAMWebAgentService",
            RES_NAME, actionValues);
    }

    private Subject createSubject(PolicyManager pm) throws PolicyException {
        SubjectTypeManager mgr = pm.getSubjectTypeManager();
        Subject subject = mgr.getSubject("AMIdentitySubject");
        Set<String> set = new HashSet<String>();
        set.add(testUser.getUniversalId());
        subject.setValues(set);
        return subject;
    }

    private Condition createIPCondition(PolicyManager pm)
        throws PolicyException {
        ConditionTypeManager mgr = pm.getConditionTypeManager();
        Condition cond = mgr.getCondition("IPCondition");
        cond.setProperties(ipConditionEnvMap);
        return cond;
    }

    private Condition createIPCondition1(PolicyManager pm)
        throws PolicyException {
        ConditionTypeManager mgr = pm.getConditionTypeManager();
        Condition cond = mgr.getCondition("IPCondition");
        cond.setProperties(ipConditionEnvMap1);
        return cond;
    }
}