using System;
using System.Collections.Generic;
using Sarand.Net.Standard.Base.Core;
using Sarand.Net.Standard.Base.Bus;
using Sarand.Net.Standard.Base.Utils;

namespace Sarand.Net.Standard.Base.Security
{
	//=======================================================================
	public class SaSecurityProfile
	{
		//-------------------------------------------------------------------
		/// <summary>Security Group definition.</summary>
		public class GroupData
		{
			private readonly List<SaSecurityProfile.RightData> rights = new List<RightData>();
			public GroupData(SaSecurityItem secGroup, List<SaSecurityProfile.RightData> groupRights)
			{
				if (secGroup.ItemType != SaSecurity.ItemType.Group) throw new NotSupportedException("SaSecurityProfile.GroupData - Invalid security item type: " + secGroup.ItemType.ToString());
				Id = secGroup.Id;
				Code = secGroup.Code;
				Desc = secGroup.Description;
				rights.AddRange(groupRights);
			}
			protected GroupData() { }
			public SysId Id { get; }
			public String Code { get; }
			public String Desc { get; }
			// Security rights.
			public List<SaSecurityProfile.RightData> Rights { get { return new List<RightData>(rights); } }
			/// <summary>
			/// Retrieve the list of data items for which the user is explicitly granted the
			/// specified security right, or where the right is explicitly denied if the flag is false.
			/// </summary>
			public List<SysId> GetDataItemsForRight(String rightCode, bool granted = true) { return rights.GetDataItemsForRight(rightCode, granted); }
			/// <summary>Is the Security Right code granted access for the Data item (if specified).</summary>
			public bool IsSecurityRightGranted(String rightCode, SysId dataItemId = null) { return rights.IsSecurityRightGranted(rightCode, dataItemId); }
			/// <summary>Is the Security Right code denined access for the Data item (if specified).</summary>
			public bool IsSecurityRightDenied(String rightCode, SysId dataItemId = null) { return rights.IsSecurityRightDenied(rightCode, dataItemId); }
		}
		/// <summary>Security Right definition.</summary>
		public class RightData
		{
			public RightData(SaSecurityItem secRight, SaSecurityLink secRightLink)
			{
				if (secRight.ItemType != SaSecurity.ItemType.Right) throw new NotSupportedException("SaSecurityProfile.RightData - Invalid security item type: " + secRight.ItemType.ToString());
				Id = secRight.Id;
				Code = secRight.Code;
				Desc = secRight.Description;
				DataItemId = secRightLink.ItemIdContext;
				Granted = (secRightLink.Status == SaStatus.Granted);
			}
			protected RightData() { }
			public SysId Id { get; }
			public String Code { get; }
			public String Desc { get; }
			public SysId DataItemId { get; }
			public bool Granted { get; }
		}

		//-------------------------------------------------------------------
		// Data members.
		protected readonly List<SaSecurityProfile.GroupData> securityGroups = new List<GroupData>();
		protected readonly List<SaSecurityProfile.RightData> securityRights = new List<RightData>();

		//-------------------------------------------------------------------
		// Construction.
		internal SaSecurityProfile(SaSecurityItem secItem, List<SaSecurityProfile.GroupData> profileGroups, List<SaSecurityProfile.RightData> profileRights, bool systemAdmin)
		{
			Clear();
			if (secItem != null)
			{
				// Security item properties.
				Id = secItem.Id;
				SecurityItemType = secItem.ItemType;
				Code = secItem.Code;
				EmailAddress = secItem.EmailAddress;
				Description = secItem.Description;
				Location = secItem.Location;
				LastLogin = secItem.LastLogin ?? DateTime.MinValue;
			}
			if (profileGroups != null)
				securityGroups.AddRange(profileGroups);
			if (profileRights != null)
				securityRights.AddRange(profileRights);
			SystemAdmin = systemAdmin;
		}
		/// <summary>
		/// Protected construction - for derived classes.
		/// <para>Ref. Mobile Security Profile.</para>
		/// </summary>
		protected SaSecurityProfile()
		{
			Clear();
		}

		//-------------------------------------------------------------------
		// Properties.
		public SysId Id { get; protected set; }
		public SaSecurity.ItemType SecurityItemType { get; protected set; } = SaSecurity.ItemType.Unknown;
		public String Code { get; protected set; }
		public String EmailAddress { get; protected set; }
		public String Description { get; protected set; }
		public String Location { get; protected set; }
		public DateTime LastLogin { get; protected set; } = DateTime.MinValue;
		public List<SaSecurityProfile.GroupData> Groups { get { return new List<GroupData>(securityGroups); } }
		public List<SaSecurityProfile.RightData> Rights { get { return new List<RightData>(securityRights); } }
		public bool SystemAdmin { get; protected set; } = false;

		//-------------------------------------------------------------------
		// Population.

		//-------------------------------------------------------------------
		// Clear profile.
		public void Clear()
		{
			Id = new SysId();
			SecurityItemType = SaSecurity.ItemType.Unknown;
			Code = String.Empty;
			Description = String.Empty;
			Location = String.Empty;
			LastLogin = DateTime.MinValue;
			securityGroups.Clear();
			securityRights.Clear();
			SystemAdmin = false;
		}

		//-------------------------------------------------------------------
		// Utilities.
		public bool IsMemberOfSecurityGroup(SysId secGroupId)
		{
			return securityGroups.Exists(item => item.Id.Equals(secGroupId));
		}

		//-------------------------------------------------------------------
		/// <summary>
		/// Retrieve the list of data items for which the user is explicitly granted the
		/// specified security right, or where the right is explicitly denied if the flag is false.
		/// </summary>
		public List<SysId> GetDataItemsForRight(String rightCode, bool granted = true)
		{
			return securityGroups.GetDataItemsForRight(rightCode, granted);
		}

		//-------------------------------------------------------------------
		/// <summary>Is the Security Right code granted access for the Data item (if specified).</summary>
		public bool IsSecurityRightGranted(String rightCode, SysId dataItemId = null)
		{
			if (SystemAdmin) return true;
			return (securityGroups.IsSecurityRightGranted(rightCode, dataItemId) || securityRights.IsSecurityRightGranted(rightCode, dataItemId));
		}

		//-------------------------------------------------------------------
		/// <summary>Is the Security Right code denined access for the Data item (if specified).</summary>
		public bool IsSecurityRightDenied(String rightCode, SysId dataItemId = null)
		{
			if (SystemAdmin) return false;
			return (securityGroups.IsSecurityRightDenied(rightCode, dataItemId) || securityRights.IsSecurityRightDenied(rightCode, dataItemId));
		}

		//-------------------------------------------------------------------
	}

	//=======================================================================
	public static class SaSecurityProfileGroupDataList
	{
		/// <summary>
		/// Retrieve the list of data items for which the user is explicitly granted the
		/// specified security right, or where the right is explicitly denied if the flag is false.
		/// </summary>
		public static List<SysId> GetDataItemsForRight(this List<SaSecurityProfile.GroupData> groups, String rightCode, bool granted = true)
		{
			HashSet<SysId> dataItemIds = new HashSet<SysId>();
			foreach (var securityGroup in groups)
				dataItemIds.AddIds(securityGroup.GetDataItemsForRight(rightCode, granted));
			return new List<SysId>(dataItemIds);
		}
		/// <summary>Is the Security Right code granted access for the Data item (if specified).</summary>
		public static bool IsSecurityRightGranted(this List<SaSecurityProfile.GroupData> groups, String rightCode, SysId dataItemId = null)
		{
			return groups.Exists(group => group.IsSecurityRightGranted(rightCode, dataItemId));
		}
		/// <summary>Is the Security Right code denined access for the Data item (if specified).</summary>
		public static bool IsSecurityRightDenied(this List<SaSecurityProfile.GroupData> groups, String rightCode, SysId dataItemId = null)
		{
			return groups.Exists(group => group.IsSecurityRightDenied(rightCode, dataItemId));
		}
	}

	//=======================================================================
	public static class SaSecurityProfileRightDataList
	{
		/// <summary>
		/// Retrieve the list of data items for which the user is explicitly granted the
		/// specified security right, or where the right is explicitly denied if the flag is false.
		/// </summary>
		public static List<SysId> GetDataItemsForRight(this List<SaSecurityProfile.RightData> rights, String rightCode, bool granted = true)
		{
			HashSet<SysId> dataItemIds = new HashSet<SysId>();
			foreach (var securityRight in rights.FindAll(x => x.Code.EqualsCI(rightCode) && x.Granted == granted))
				dataItemIds.AddId(securityRight.DataItemId);
			return new List<SysId>(dataItemIds);
		}
		/// <summary>Is the Security Right code granted access for the Data item (if specified).</summary>
		public static bool IsSecurityRightGranted(this List<SaSecurityProfile.RightData> rights, String rightCode, SysId dataItemId = null)
		{
			foreach (var userSecurityRight in rights.FindAll(item => item.Code.EqualsCI(rightCode)))
			{
				if (SysId.ToInt(dataItemId) != SysId.ToInt(userSecurityRight.DataItemId)) continue;
				return userSecurityRight.Granted;
			}
			return false;
		}
		/// <summary>Is the Security Right code denined access for the Data item (if specified).</summary>
		public static bool IsSecurityRightDenied(this List<SaSecurityProfile.RightData> rights, String rightCode, SysId dataItemId = null)
		{
			foreach (var userSecurityRight in rights.FindAll(item => item.Code.EqualsCI(rightCode)))
			{
				if (SysId.ToInt(dataItemId) != SysId.ToInt(userSecurityRight.DataItemId)) continue;
				return !userSecurityRight.Granted;
			}
			return false;
		}
	}

	//=======================================================================
}