package fr.ifremer.quadrige2.ui.swing.common.content.login;
   
   /*-
    * #%L
    * Quadrige2 Core :: Quadrige2 UI Common
    * $Id:$
    * $HeadURL:$
    * %%
    * Copyright (C) 2017 Ifremer
   * %%
   * This program is free software: you can redistribute it and/or modify
   * it under the terms of the GNU Affero General Public License as published by
   * the Free Software Foundation, either version 3 of the License, or
   * (at your option) any later version.
   * 
   * This program is distributed in the hope that it will be useful,
   * but WITHOUT ANY WARRANTY; without even the implied warranty of
   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   * GNU General Public License for more details.
   * 
   * You should have received a copy of the GNU Affero General Public License
   * along with this program.  If not, see <http://www.gnu.org/licenses/>.
   * #L%
   */
  
  
  import com.google.common.base.Objects;
  import fr.ifremer.quadrige2.core.exception.Quadrige2TechnicalException;
  import fr.ifremer.quadrige2.core.security.AuthenticationInfo;
  import fr.ifremer.quadrige2.core.security.SecurityContextHelper;
  import fr.ifremer.quadrige2.core.security.remote.AuthenticationRemoteException;
  import fr.ifremer.quadrige2.core.security.remote.AuthenticationRemoteService;
  import fr.ifremer.quadrige2.core.service.ClientServiceLocator;
  import fr.ifremer.quadrige2.core.service.administration.user.UserService;
  import fr.ifremer.quadrige2.core.vo.administration.user.QuserVO;
  import fr.ifremer.quadrige2.synchro.service.client.SynchroRestClientService;
  import fr.ifremer.quadrige2.ui.swing.common.action.AbstractMainUIAction;
  import fr.ifremer.quadrige2.ui.swing.common.action.CloseApplicationAction;
  import fr.ifremer.quadrige2.ui.swing.common.content.AbstractMainUIHandler;
  import org.apache.commons.lang3.StringUtils;
  import org.apache.commons.lang3.builder.ToStringBuilder;
  import org.apache.commons.lang3.builder.ToStringStyle;
  import org.apache.commons.logging.Log;
  import org.apache.commons.logging.LogFactory;
  import org.nuiton.jaxx.application.swing.action.AbstractApplicationAction;
  
  import javax.swing.SwingUtilities;
  
  import static org.nuiton.i18n.I18n.t;
  
  /**
   * Manage authentification. This Action is called directly or when a security error occur.
   * After an authentification, a callback action could be called
   *
   * @author Ludovic Pecquot <ludovic.pecquot@e-is.pro>
   */
  public class AuthenticationAction extends AbstractMainUIAction {
  
      private static final Log LOG = LogFactory.getLog(AuthenticationAction.class);
  
  
      // TODO : use JXLoginPane to ask credentials
  //    JXLoginPane loginPane = new JXLoginPane(new LoginService() {
  //        @Override
  //        public boolean authenticate(String name, char[] password, String server) throws Exception {
  //            return false;
  //        }
  //    },
  //            null, new DefaultUserNameStore());
  
  
      private AbstractApplicationAction callbackAction;
      private boolean authenticated;
      private boolean authenticationCanceled;
  
      /**
       * <p>Constructor for AuthenticationAction.</p>
       *
       * @param handler a {@link AbstractMainUIHandler} object.
       */
      public AuthenticationAction(AbstractMainUIHandler handler) {
          this(handler, null);
      }
  
      /**
       * <p>Constructor for AuthenticationAction.</p>
       *
       * @param handler a {@link AbstractMainUIHandler} object.
       * @param callbackAction a {@link AbstractApplicationAction} object.
       */
      public AuthenticationAction(AbstractMainUIHandler handler, AbstractApplicationAction callbackAction) {
          super(handler, true);
          this.callbackAction = callbackAction;
          setActionDescription(t("quadrige2.action.authenticate.title"));
      }
  
      /** {@inheritDoc} */
      @Override
      public void doAction() throws Exception {
 
         // init
         authenticated = false;
         authenticationCanceled = false;
         UserService userService = ClientServiceLocator.instance().getUserService();
 
         // action message
         String message = null;
         if (callbackAction != null) {
             message = callbackAction.getActionDescription();
         }
 
         while (!authenticated) {
 
             // ask authentication information
             AuthenticationInfo authenticationInfo = getHandler().askAuthenticationInfo(message);
 
             if (authenticationInfo == null
                 || StringUtils.isBlank(authenticationInfo.getLogin())) {
 
                 if (LOG.isDebugEnabled()) {
                     LOG.debug("insufficient authentication information, cancelling action");
                 }
                 callbackAction = null;
                 authenticationCanceled = true;
 
                 if (getConfig().isAuthenticationForced() && !getContext().isAuthenticated()) {
                     // if authentication is forced, the application can't continue
                     getContext().getErrorHelper().showErrorDialog(t("quadrige2.action.authenticate.forced.message", getConfig().getApplicationName()));
                     getActionEngine().runInternalAction(handler, CloseApplicationAction.class);
                 }
 
                 return;
             }
 
             String login = authenticationInfo.getLogin();
             boolean isLocalUserWithEmptyPassword = userService.isLocalUserWithNoPassword(login);
 
             try {
 
                 // If local user with NO password : authenticated using login only
                 if (isLocalUserWithEmptyPassword) {
 
                     // Check password IS empty
                     if (StringUtils.isNotEmpty(authenticationInfo.getPassword())) {
                         getContext().getErrorHelper().showErrorDialog(t("quadrige2.error.authenticate.badCredential"));
 
                         // don't loop if authentication is not forced
                         if (!getConfig().isAuthenticationForced()) {
                             return;
                         }
                     }
                     else {
                         authenticated = SecurityContextHelper.authenticate(login, null);
                     }
                 }
 
                 else {
                     // Check password is NOT blank
                     if (StringUtils.isBlank(authenticationInfo.getPassword())) {
                         throw new AuthenticationRemoteException(t("quadrige2.error.authenticate.badCredential"));
                     }
 
                     boolean hasPasswordInDatabase;
                     if (getConfig().isAuthenticationDisabled()) {
 
                         // password always provided, don't connect to authentication site
                         hasPasswordInDatabase = true;
                     } else {
 
                         // check if user has a stored password
                         hasPasswordInDatabase = userService.hasPassword(login);
                     }
 
                     // First, try to connect using password in local DB
                     if (hasPasswordInDatabase) {
 
                         // security authentication
                         authenticated = SecurityContextHelper.authenticate(login, authenticationInfo.getPassword());
 
                     }
 
                     // If authentication on local password failed, or not possible
                     if (!authenticated) {
 
                         // Try to auth against remote sites
                         AuthenticationRemoteService authRemoteService = ClientServiceLocator.instance().getAuthenticationRemoteService();
                         boolean remoteAuthenticated = authRemoteService.canAuthenticate(authenticationInfo);
 
                         if (remoteAuthenticated) {
 
                             // delete password in database because it can be updated
                             userService.resetPassword(login);
                             hasPasswordInDatabase = false;
 
                             // authenticate with empty password to force authentication process, it will be updated only if the person is in the database
                             authenticated = SecurityContextHelper.authenticate(login, null);
 
                             // Try to update person from server, then retry
                             if (!authenticated) {
 
                                 if (tryUpdatePersonFromServer(authenticationInfo)) {
                                     // new attempt to delete password because login can change after tryUpdatePersonFromServer
                                     userService.resetPassword(login);
                                     authenticated = SecurityContextHelper.authenticate(login, null);
                                 } else {
                                     throw new AuthenticationRemoteException(t("quadrige2.error.authenticate.badCredential"));
                                 }
                             }
                         }
                     }
 
                     if (!authenticated) {
                         throw new AuthenticationRemoteException(t("quadrige2.error.authenticate.notFound", login));
                     }
 
                     if (LOG.isDebugEnabled()) {
                         LOG.debug("user '" + login + "' authenticated");
                     }
 
                     if (!hasPasswordInDatabase) {
                         // update user password in local database
                         userService.updatePasswordByUserId(
                                 SecurityContextHelper.getQuadrige2UserId(),
                                 authenticationInfo.getPassword());
                     }
                 }
             } catch (AuthenticationRemoteException ae) {
 
                 getContext().getErrorHelper().showErrorDialog(ae.getLocalizedMessage());
 
                 // don't loop if authentication is not forced
                 if (!getConfig().isAuthenticationForced()) {
                     return;
                 }
             }
         }
     }
 
     /** {@inheritDoc} */
     @Override
     public void postSuccessAction() {
         super.postSuccessAction();
 
         // don't go further if user hits 'cancel'
         if (authenticationCanceled) {
             return;
         }
 
         getContext().setAuthenticated(authenticated);
 
         // re-attempt the action
         if (authenticated && callbackAction != null) {
             if (LOG.isDebugEnabled()) {
                 LOG.debug("run callback action " + callbackAction.getClass().getSimpleName());
             }
             SwingUtilities.invokeLater(new Runnable() {
 
                 @Override
                 public void run() {
                     getActionEngine().runAction(callbackAction);
                 }
             });
         }
 
     }
 
     /** {@inheritDoc} */
     @Override
     public void postFailedAction(Throwable error) {
         super.postFailedAction(error);
 
         getContext().setAuthenticated(false);
 
     }
 
     /* -- internal methods -- */
 
     /**
      * <p>tryUpdatePersonFromServer.</p>
      *
      * @param authenticationInfo a {@link fr.ifremer.quadrige2.core.security.AuthenticationInfo} object.
      * @return a boolean.
      */
     protected boolean tryUpdatePersonFromServer(AuthenticationInfo authenticationInfo) {
         if (!getConfig().isSynchronizationEnabled()) {
             return false;
         }
 
         // Get the user from the synchro server
         SynchroRestClientService synchroRestClientService = ClientServiceLocator.instance().getSynchroRestClientService();
         QuserVO user;
         try {
             user = synchroRestClientService.getUser(authenticationInfo);
         } catch (Quadrige2TechnicalException e) {
             return false;
         }
 
         if (user == null) {
             return false;
         }
 
         // Make sure the person given by the server is the good one
         if (!Objects.equal(user.getQuserIntranetLg(), authenticationInfo.getLogin())
             && !Objects.equal(user.getQuserExtranetLg(), authenticationInfo.getLogin())) {
             LOG.warn(String.format("Synchronization server send a bad person, with wrong login: expected [%s] but found [username=%s] and [usernameExtranet=%s]. Check configuration on synchro server.",
                     authenticationInfo.getLogin(),
                     user.getQuserIntranetLg(),
                     user.getQuserExtranetLg()));
             return false;
         }
 
         if (LOG.isDebugEnabled()) {
             LOG.debug("Will save person, retrieve from synchro server: " + ToStringBuilder.reflectionToString(user, ToStringStyle.SHORT_PREFIX_STYLE));
         }
         UserService personService = ClientServiceLocator.instance().getUserService();
         personService.save(user, true);
 
         return true;
     }
 
 }