/*******************************************************************************
  * Copyright (c) 2016 Gigatronik Ingolstadt GmbH
  * All rights reserved. This program and the accompanying materials
  * are made available under the terms of the Eclipse Public License v1.0
  * which accompanies this distribution, and is available at
  * http://www.eclipse.org/legal/epl-v10.html
  *
  * Contributors:
  * Sebastian Dirsch - initial implementation
  *******************************************************************************/

package org.eclipse.mdm.realm.login.glassfish;

import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.security.Principal;
import java.util.List;
import java.util.Map;
import java.util.Set;

import javax.naming.InitialContext;
import javax.naming.NamingException;
import javax.security.auth.Subject;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;

import org.glassfish.internal.api.Globals;
import org.glassfish.security.common.Group;

import com.sun.enterprise.security.PrincipalGroupFactory;
import com.sun.enterprise.security.auth.login.common.PasswordCredential;
import com.sun.enterprise.security.auth.realm.NoSuchRealmException;
import com.sun.enterprise.security.auth.realm.Realm;

/**
 * Login Module for Glassfish
 * @author Sebastian Dirsch, Gigatronik Ingolstadt GmbH
 *
 */
public class LoginRealmModule implements LoginModule {
	
	private final static String MDM_GROUP = "MDM";
	
	private Subject subject;	
	private String username = null;
	private String password = null;
	private String realm = null;

	private Principal principal = null;
	private Group group = null;
	
	private boolean phase1Succeeded = false;
	private boolean phase2Succeeded = false;
	
	private Object connector = null;
	private Object entityManagerList = null;
	
	
	@Override
	public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
			Map<String, ?> options) {
		this.subject = subject;		
	}

	
	@Override
	public boolean login() throws LoginException {		
		try {		
			PasswordCredential passwordCredential = lookupPasswordCredential(this.subject);
			
			this.realm = passwordCredential.getRealm();
			this.username = passwordCredential.getUser();
			this.password = String.valueOf(passwordCredential.getPassword());
					
			Object connectorService = getConnector();
			Method connectionMethod = connector.getClass().getMethod("connect", String.class, String.class);
			this.entityManagerList = connectionMethod.invoke(connectorService, username, password);		
			this.phase1Succeeded = true;
			
		} catch(NoSuchMethodException | InvocationTargetException | IllegalAccessException | RuntimeException e) {
			throw new LoginException(e.getMessage());
		}				
		return true;
	}

	
	@SuppressWarnings("unchecked")
	@Override
	public boolean commit() throws LoginException {
		
		try {
			
			if(!this.phase1Succeeded) {
				return false;
			}
	
			if(this.entityManagerList != null && ((List<Object>)this.entityManagerList).size() > 0) {
				
				PrincipalGroupFactory factory = Globals.getDefaultHabitat().getService(PrincipalGroupFactory.class);
				
				this.principal = createPrincipal(factory);
				this.group = createGroup(factory);
				
				Set<Principal> principalSet = this.subject.getPrincipals();
				
				if(!principalSet.contains(this.principal)) {
					principalSet.add(this.principal);
				}
				
				if(!principalSet.contains(this.group)) {
					principalSet.add(this.group);
				}
				
				Object connectorService = getConnector();
				Method regConnectionMethod = connector.getClass().getMethod("registerConnections", Principal.class, List.class);
				regConnectionMethod.invoke(connectorService, this.principal, this.entityManagerList);
				
				this.phase2Succeeded = true;
			} else {
				throw new LoginException("unable to connect '" + this.username + "'");
			}
			
			return true;
		} catch(NoSuchMethodException | InvocationTargetException | IllegalAccessException | RuntimeException e) {
			throw new LoginException(e.getMessage());
		} finally {			
			this.username = null;
			this.password = null;		
		}
	}

	
	@Override
	public boolean abort() throws LoginException {
		
		if(!this.phase1Succeeded) {
			return false;
		} else if(this.phase2Succeeded && !this.phase2Succeeded) {
			this.phase1Succeeded = false;
			this.username = null;
			this.password = null;
			this.principal = null;
			this.group = null;
		} else {
			logout();
		}
		return true;
		
	}

	
	@SuppressWarnings("unchecked")
	@Override
	public boolean logout() throws LoginException {
		
		try {
		
			Object connectorService = getConnector();
			Method disconnectMethod = connectorService.getClass().getMethod("disconnect", Principal.class);
			disconnectMethod.invoke(connectorService, this.principal);
			
			((List<Object>)this.entityManagerList).clear();
		    
			this.subject.getPrincipals().clear();
		    this.subject.getPublicCredentials().clear();
		    this.subject.getPrivateCredentials().clear();
		    
		    this.username = null;
			this.password = null;
			this.principal = null;
			this.group = null;
		    
		    this.phase1Succeeded = false;
		    this.phase2Succeeded = false;
		    
			return true;
			
		} catch(NoSuchMethodException | InvocationTargetException | IllegalAccessException | RuntimeException e) {
			throw new LoginException(e.getMessage());
		}
	}

	
	private Principal createPrincipal(PrincipalGroupFactory factory) throws LoginException {
		try {			
			Realm realmInstance = Realm.getInstance(this.realm);
			return factory.getPrincipalInstance(this.username, realmInstance.getName());
		} catch(NoSuchRealmException e) {
			throw new LoginException(e.getMessage());
		}		 
	}
	
	
	private Group createGroup(PrincipalGroupFactory factory) throws LoginException {
		try {			
			Realm realmInstance = Realm.getInstance(this.realm);
			return factory.getGroupInstance(MDM_GROUP, realmInstance.getName());
		} catch(NoSuchRealmException e) {
			throw new LoginException(e.getMessage());
		}
	}
	
	
	private PasswordCredential lookupPasswordCredential(Subject subject) throws LoginException {
		Set<Object> privateCredentials = subject.getPrivateCredentials();
		for(Object privateCredential : privateCredentials) {
			if(privateCredential instanceof PasswordCredential) {				
				return ((PasswordCredential)privateCredential);
			}
		}		
		throw new LoginException("password credential not found!");
	}
		
	
	private Object getConnector() throws LoginException {
		try {
			if(this.connector == null) {
				String JNDIName = "java:global/org.eclipse.mdm.nucleus/ConnectorService!org.eclipse.mdm.connector.boundary.ConnectorService";
				InitialContext initialContext = new InitialContext();		
				this.connector = initialContext.lookup(JNDIName); 
			}
			return this.connector;
		} catch(NamingException e) {
			throw new LoginException(e.getMessage());
		}
	}


}