using System;
using System.Collections.Generic;
using Sarand.Net.Standard.Base.Core;
using Sarand.Net.Standard.Base.Bus;
using Sarand.Net.Standard.Base.Utils;

namespace Sarand.Net.Standard.Base.Security
{
	//=======================================================================
	public class SaSecurityProfile
	{
		//-------------------------------------------------------------------
		public class GroupData
		{
			public readonly List<SaSecurityProfile.RightData> rights = new List<RightData>();
			public GroupData (SaSecurityItem secGroup, List<SaSecurityProfile.RightData> groupRights)
			{
				if (secGroup.ItemType != SaSecurity.ItemType.Group) throw new NotSupportedException("SaSecurityProfile.GroupData - Invalid security item type: "+ secGroup.ItemType.ToString());
				GroupId = secGroup.Id;
				GroupCode = secGroup.Code;
				GroupDesc = secGroup.Description;
				rights.AddRange(groupRights);
			}
			protected GroupData () { }
			public SysId GroupId { get; protected set; }
			public String GroupCode { get; protected set; }
			public String GroupDesc { get; protected set; }
			public List<SaSecurityProfile.RightData> Rights { get { return new List<RightData>(rights); } }
		}
		public class RightData
		{
			public RightData (SaSecurityItem secRight, SaSecurityLink secRightLink)
			{
				if (secRight.ItemType != SaSecurity.ItemType.Right) throw new NotSupportedException("SaSecurityProfile.RightData - Invalid security item type: " + secRight.ItemType.ToString());
				RightId = secRight.Id;
				RightCode = secRight.Code;
				RightDesc = secRight.Description;
				DataItemId = secRightLink.ItemIdContext;
				Granted = (secRightLink.Status == SaStatus.Granted);
			}
			protected RightData () { }
			public SysId RightId { get; protected set; }
			public String RightCode { get; protected set; }
			public String RightDesc { get; protected set; }
			public SysId DataItemId { get; protected set; }
			public bool Granted { get; protected set; }
		}

		//-------------------------------------------------------------------
		// Data members.
		protected readonly List<SaSecurityProfile.GroupData> securityGroups = new List<GroupData>();
		protected readonly List<SaSecurityProfile.RightData> securityRights = new List<RightData>();

		//-------------------------------------------------------------------
		// Construction.
		internal SaSecurityProfile (SaSecurityItem secItem, List<SaSecurityProfile.GroupData> profileGroups, List<SaSecurityProfile.RightData> profileRights, bool systemAdmin)
		{
			Clear();
			if (secItem != null)
			{
				// Security item properties.
				Id = secItem.Id;
				SecurityItemType = secItem.ItemType;
				Code = secItem.Code;
				EmailAddress = secItem.EmailAddress;
				Description = secItem.Description;
				Location = secItem.Location;
				LastLogin = secItem.LastLogin;
			}
			if (profileGroups != null)
				securityGroups.AddRange(profileGroups);
			if (profileRights != null)
				securityRights.AddRange(profileRights);
			SystemAdmin = systemAdmin;
		}
		/// <summary>
		/// Protected construction - for derived classes.
		/// <para>Ref. Mobile Security Profile.</para>
		/// </summary>
		protected SaSecurityProfile()
		{
			Clear();
		}

		//-------------------------------------------------------------------
		// Properties.
		public SysId Id { get; protected set; }
		public SaSecurity.ItemType SecurityItemType { get; protected set; } = SaSecurity.ItemType.Unknown;
		public String Code { get; protected set; }
		public String EmailAddress { get; protected set; }
		public String Description { get; protected set; }
		public String Location { get; protected set; }
		public DateTime LastLogin { get; protected set; } = DateTime.MinValue;
		public List<SaSecurityProfile.GroupData> Groups { get { return new List<GroupData>(securityGroups); } }
		public List<SaSecurityProfile.RightData> Rights { get { return new List<RightData>(securityRights); } }
		public bool SystemAdmin { get; protected set; } = false;

		//-------------------------------------------------------------------
		// Population.

		//-------------------------------------------------------------------
		// Clear profile.
		public void Clear()
		{
			Id = new SysId();
			SecurityItemType = SaSecurity.ItemType.Unknown;
			Code = String.Empty;
			Description = String.Empty;
			Location = String.Empty;
			LastLogin = DateTime.MinValue;
			securityGroups.Clear();
			securityRights.Clear();
			SystemAdmin = false;
		}

		//-------------------------------------------------------------------
		// Utilities.
		public bool IsMemberOfSecurityGroup (SysId secGroupId)
		{
			return securityGroups.Exists(item => item.GroupId.Equals(secGroupId));
		}

		//-------------------------------------------------------------------
		/// <summary>
		/// Retrieve the list of data items for which the user is explicitly granted the
		/// specified security right, or where the right is explicitly denied if the flag is false.
		/// </summary>
		public List<SysId> GetDataItemsForRight (String rightCode, bool granted = true)
		{
			return securityGroups.GetDataItemsForRight(rightCode, granted);
		}

		//-------------------------------------------------------------------
		/// <summary>Is the Security Right code granted access for the Data item (if specified).</summary>
		public bool IsSecurityRightGranted (String rightCode, SysId dataItemId = null)
		{
			if (SystemAdmin) return true;
			return (securityGroups.IsSecurityRightGranted(rightCode, dataItemId) || securityRights.IsSecurityRightGranted(rightCode, dataItemId));
		}

		//-------------------------------------------------------------------
		/// <summary>Is the Security Right code denined access for the Data item (if specified).</summary>
		public bool IsSecurityRightDenied (String rightCode, SysId dataItemId = null)
		{
			if (SystemAdmin) return false;
			return (securityGroups.IsSecurityRightDenied(rightCode, dataItemId) || securityRights.IsSecurityRightDenied(rightCode, dataItemId));
		}

		//-------------------------------------------------------------------
	}

	//=======================================================================
	public static class SaSecurityProfileGroupDataList
	{
		/// <summary>
		/// Retrieve the list of data items for which the user is explicitly granted the
		/// specified security right, or where the right is explicitly denied if the flag is false.
		/// </summary>
		public static List<SysId> GetDataItemsForRight (this List<SaSecurityProfile.GroupData> groups, String rightCode, bool granted = true)
		{
			List<SysId> dataItemIds = new List<SysId>();
			foreach (var securityGroup in groups)
				dataItemIds.AddIds(securityGroup.rights.GetDataItemsForRight(rightCode,granted));
			return dataItemIds;
		}
		/// <summary>Is the Security Right code granted access for the Data item (if specified).</summary>
		public static bool IsSecurityRightGranted (this List<SaSecurityProfile.GroupData> groups, String rightCode, SysId dataItemId = null)
		{
			return groups.Exists(item => item.rights.IsSecurityRightGranted(rightCode, dataItemId));
		}
		/// <summary>Is the Security Right code denined access for the Data item (if specified).</summary>
		public static bool IsSecurityRightDenied (this List<SaSecurityProfile.GroupData> groups, String rightCode, SysId dataItemId = null)
		{
			return groups.Exists(item => item.rights.IsSecurityRightDenied(rightCode, dataItemId));
		}
	}

	//=======================================================================
	public static class SaSecurityProfileRightDataList
	{
		/// <summary>
		/// Retrieve the list of data items for which the user is explicitly granted the
		/// specified security right, or where the right is explicitly denied if the flag is false.
		/// </summary>
		public static List<SysId> GetDataItemsForRight (this List<SaSecurityProfile.RightData> rights, String rightCode, bool granted = true)
		{
			List<SysId> dataItemIds = new List<SysId>();
			foreach (var securityRight in rights.FindAll(x => x.RightCode.EqualsCI(rightCode) && x.Granted == granted))
				dataItemIds.AddId(securityRight.DataItemId);
			return dataItemIds;
		}
		/// <summary>Is the Security Right code granted access for the Data item (if specified).</summary>
		public static bool IsSecurityRightGranted (this List<SaSecurityProfile.RightData> rights, String rightCode, SysId dataItemId = null)
		{
			foreach (var userSecurityRight in rights.FindAll(item => item.RightCode.EqualsCI(rightCode)))
			{
				if (SysId.ToInt(dataItemId) != SysId.ToInt(userSecurityRight.DataItemId)) continue;
				return userSecurityRight.Granted;
			}
			return false;
		}
		/// <summary>Is the Security Right code denined access for the Data item (if specified).</summary>
		public static bool IsSecurityRightDenied (this List<SaSecurityProfile.RightData> rights, String rightCode, SysId dataItemId = null)
		{
			foreach (var userSecurityRight in rights.FindAll(item => item.RightCode.EqualsCI(rightCode)))
			{
				if (SysId.ToInt(dataItemId) != SysId.ToInt(userSecurityRight.DataItemId)) continue;
				return !userSecurityRight.Granted;
			}
			return false;
		}
	}

	//=======================================================================
}