/*  
 * (C) Copyright 2006-2014 Nuxeo SA (http://nuxeo.com/) and others.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * Contributors:
 *     Thierry Delprat <tdelprat@nuxeo.com>
 */

package org.nuxeo.ecm.multi.tenant.acl;

import java.util.List;

import org.nuxeo.ecm.core.api.DocumentModel;
import org.nuxeo.ecm.core.api.event.CoreEventConstants;
import org.nuxeo.ecm.core.api.event.DocumentEventTypes;
import org.nuxeo.ecm.core.api.security.ACE;
import org.nuxeo.ecm.core.api.security.ACL;
import org.nuxeo.ecm.core.api.security.ACP;
import org.nuxeo.ecm.core.event.Event;
import org.nuxeo.ecm.core.event.EventListener;
import org.nuxeo.ecm.core.event.impl.DocumentEventContext;
import org.nuxeo.ecm.multi.tenant.MultiTenantHelper;
import org.nuxeo.ecm.multi.tenant.MultiTenantService;
import org.nuxeo.runtime.api.Framework;

/**
 * Intercepts ACL changes and restrict Grant to Tenant bound groups for a configured list of global groups
 * 
 * @author tiry
 */
public class ACLUpdateListener implements EventListener {

    @Override
    public void handleEvent(Event event) {

        if (DocumentEventTypes.BEFORE_DOC_SECU_UPDATE.equals(event.getName())) {

            MultiTenantService mts = Framework.getService(MultiTenantService.class);
            if (!mts.isTenantIsolationEnabled(event.getContext().getCoreSession())) {
                return;
            }
            List<String> prohibitedGroups = mts.getProhibitedGroups();

            DocumentModel target = ((DocumentEventContext) event.getContext()).getSourceDocument();
            ACP newACP = (ACP) event.getContext().getProperty(CoreEventConstants.NEW_ACP);

            for (ACL acl : newACP.getACLs()) {
                int idx = 0;
                for (ACE ace : acl.getACEs()) {
                    if (ace.isGranted() && prohibitedGroups.contains(ace.getUsername())) {
                        String tenantId = MultiTenantHelper.getOwningTenantId(target);
                        if (tenantId != null) {
                            acl.set(idx,
                                    new ACE(MultiTenantHelper.computeTenantMembersGroup(tenantId), ace.getPermission(),
                                            ace.isGranted()));
                        }
                    }
                    idx++;
                }
            }
        }
    }
}
