/*
    * Copyright 2024-2026 the original author or authors.
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *      http://www.apache.org/licenses/LICENSE-2.0
    *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  package org.bremersee.spring.security.ldaptive.userdetails;
  
  import static java.util.Objects.nonNull;
  import static org.springframework.util.ObjectUtils.isEmpty;
  
  import java.util.Collection;
  import java.util.Objects;
  import java.util.Optional;
  import java.util.Set;
  import java.util.function.Predicate;
  import java.util.regex.Pattern;
  import java.util.stream.Collectors;
  import java.util.stream.Stream;
  import lombok.AccessLevel;
  import lombok.Getter;
  import org.apache.commons.logging.Log;
  import org.apache.commons.logging.LogFactory;
  import org.bremersee.ldaptive.LdaptiveAttribute;
  import org.bremersee.ldaptive.LdaptiveTemplate;
  import org.bremersee.spring.security.ldaptive.authentication.AccountControlEvaluator;
  import org.bremersee.spring.security.ldaptive.authentication.LdaptiveAuthenticationProperties;
  import org.bremersee.spring.security.ldaptive.authentication.provider.NoAccountControlEvaluator;
  import org.ldaptive.FilterTemplate;
  import org.ldaptive.LdapAttribute;
  import org.ldaptive.LdapEntry;
  import org.ldaptive.SearchRequest;
  import org.ldaptive.dn.Dn;
  import org.ldaptive.dn.NameValue;
  import org.ldaptive.dn.RDn;
  import org.springframework.security.core.GrantedAuthority;
  import org.springframework.security.core.authority.SimpleGrantedAuthority;
  import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
  import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
  import org.springframework.security.core.userdetails.UserDetailsService;
  import org.springframework.security.core.userdetails.UsernameNotFoundException;
  import org.springframework.util.Assert;
  
  /**
   * The ldaptive user details service.
   *
   * @author Christian Bremer
   */
  @Getter(AccessLevel.PROTECTED)
  public class LdaptiveUserDetailsService implements UserDetailsService {
  
    /**
     * The constant USERNAME_PLACEHOLDER.
     */
    protected static final String USERNAME_PLACEHOLDER = "${username}";
  
    /**
     * The logger.
     */
    private final Log logger = LogFactory.getLog(this.getClass());
  
    /**
     * The authentication properties.
     */
    private final LdaptiveAuthenticationProperties authenticationProperties;
  
    /**
     * The ldaptive template.
     */
    private final LdaptiveTemplate ldaptiveTemplate;
  
    /**
     * The groups mapper.
     */
    private GrantedAuthoritiesMapper grantedAuthoritiesMapper;
  
    /**
     * The account control evaluator.
     */
    private AccountControlEvaluator accountControlEvaluator = new NoAccountControlEvaluator();
  
    /**
     * The remember-me token provider.
     */
    private LdaptiveRememberMeTokenProvider rememberMeTokenProvider;
  
    /**
     * Instantiates a ldaptive user details service.
     *
    * @param authenticationProperties the authentication properties
    * @param ldaptiveTemplate the ldaptive template
    */
   public LdaptiveUserDetailsService(
       LdaptiveAuthenticationProperties authenticationProperties,
       LdaptiveTemplate ldaptiveTemplate) {
 
     this.authenticationProperties = authenticationProperties;
     this.ldaptiveTemplate = ldaptiveTemplate;
     Assert.notNull(getAuthenticationProperties(), "Authentication properties are required.");
     Assert.notNull(getLdaptiveTemplate(), "Ldaptive template is required.");
     setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
     if (nonNull(authenticationProperties.getAccountControlEvaluator())) {
       setAccountControlEvaluator(authenticationProperties.getAccountControlEvaluator().get());
     }
     if (isEmpty(getAuthenticationProperties().getPasswordLastSetAttribute())) {
       setRememberMeTokenProvider(
           new LdaptiveEvaluatedRememberMeTokenProvider(getAccountControlEvaluator()));
     } else {
       setRememberMeTokenProvider(
           new LdaptivePwdLastSetRememberMeTokenProvider(getAccountControlEvaluator(),
               getAuthenticationProperties().getPasswordLastSetAttribute()));
     }
   }
 
   /**
    * Sets groups mapper.
    *
    * @param grantedAuthoritiesMapper the groups mapper
    */
   public void setGrantedAuthoritiesMapper(
       GrantedAuthoritiesMapper grantedAuthoritiesMapper) {
     if (nonNull(grantedAuthoritiesMapper)) {
       this.grantedAuthoritiesMapper = grantedAuthoritiesMapper;
     }
   }
 
   /**
    * Sets account control evaluator.
    *
    * @param accountControlEvaluator the account control evaluator
    */
   public void setAccountControlEvaluator(
       AccountControlEvaluator accountControlEvaluator) {
     if (nonNull(accountControlEvaluator)) {
       this.accountControlEvaluator = accountControlEvaluator;
     }
   }
 
   /**
    * Sets remember-me token provider.
    *
    * @param rememberMeTokenProvider the remember-me token provider
    */
   public void setRememberMeTokenProvider(LdaptiveRememberMeTokenProvider rememberMeTokenProvider) {
     if (nonNull(rememberMeTokenProvider)) {
       this.rememberMeTokenProvider = rememberMeTokenProvider;
     }
   }
 
   @Override
   public LdaptiveUserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
     logger.debug(String.format("Loading user '%s' ...", username));
     LdapEntry ldapEntry = findUser(username)
         .orElseThrow(() -> new UsernameNotFoundException(String
             .format("User '%s' was  not found.", username)));
     Collection<? extends GrantedAuthority> authorities = getAuthorities(ldapEntry);
     var userDetailsBuilder = LdaptiveUserDetails.builder()
         .dn(ldapEntry.getDn())
         .username(LdaptiveAttribute.define(getAuthenticationProperties().getUsernameAttribute())
             .getValue(ldapEntry)
             .orElse(username))
         .password(getRememberMeTokenProvider().getRememberMeToken(ldapEntry))
         .accountNonExpired(getAccountControlEvaluator().isAccountNonExpired(ldapEntry))
         .accountNonLocked(getAccountControlEvaluator().isAccountNonLocked(ldapEntry))
         .credentialsNonExpired(getAccountControlEvaluator().isCredentialsNonExpired(ldapEntry))
         .enabled(getAccountControlEvaluator().isEnabled(ldapEntry))
         .authorities(authorities);
     LdaptiveAttribute.define(getAuthenticationProperties().getFirstNameAttribute())
         .getValue(ldapEntry)
         .ifPresent(userDetailsBuilder::firstName);
     LdaptiveAttribute.define(getAuthenticationProperties().getLastNameAttribute())
         .getValue(ldapEntry)
         .ifPresent(userDetailsBuilder::lastName);
     LdaptiveAttribute.define(getAuthenticationProperties().getEmailAttribute())
         .getValue(ldapEntry)
         .ifPresent(userDetailsBuilder::email);
     return userDetailsBuilder.build();
   }
 
   /**
    * Determines whether the given username is a distinguished name or not.
    *
    * @param username the username
    * @return {@code true} if the username is a distinguished name, otherwise {@code false}
    */
   protected boolean isDn(String username) {
     try {
       Dn baseDn = new Dn(getAuthenticationProperties().getUserBaseDn());
       return Optional.ofNullable(username)
           .map(Dn::new)
           .filter(baseDn::isAncestor)
           .isPresent();
 
     } catch (RuntimeException e) {
       return false;
     }
   }
 
   /**
    * Find user.
    *
    * @param username the username
    * @return the user
    */
   public Optional<LdapEntry> findUser(String username) {
     SearchRequest searchRequest = isDn(username)
         ? SearchRequest.objectScopeSearchRequest(username)
         : SearchRequest.builder()
             .dn(getAuthenticationProperties().getUserBaseDn())
             .filter(FilterTemplate.builder()
                 .filter(getAuthenticationProperties().getUserFindOneFilter())
                 .parameters(username)
                 .build())
             .scope(getAuthenticationProperties().getUserFindOneSearchScope())
             .sizeLimit(1)
             .build();
     return getLdaptiveTemplate().findOne(searchRequest);
   }
 
   /**
    * Gets authorities.
    *
    * @param user the user
    * @return the authorities
    */
   public Collection<GrantedAuthority> getAuthorities(LdapEntry user) {
 
     return switch (getAuthenticationProperties().getGroupFetchStrategy()) {
       case NONE -> Set.of();
       case USER_CONTAINS_GROUPS -> getAuthoritiesByGroupsInUser(user);
       case GROUP_CONTAINS_USERS -> getAuthoritiesByGroupsWithUser(user);
     };
   }
 
   /**
    * Gets roles by groups in user.
    *
    * @param user the user
    * @return the roles by groups in user
    */
   protected Collection<GrantedAuthority> getAuthoritiesByGroupsInUser(LdapEntry user) {
     Collection<GrantedAuthority> authorities = Stream.ofNullable(user)
         .map(entry -> entry.getAttribute(getAuthenticationProperties().getMemberAttribute()))
         .filter(Objects::nonNull)
         .map(LdapAttribute::getStringValues)
         .filter(Objects::nonNull)
         .flatMap(Collection::stream)
         .flatMap(memberOfValue -> getGroupName(memberOfValue).stream())
         .map(SimpleGrantedAuthority::new)
         .collect(Collectors.toSet());
     return Set.copyOf(getGrantedAuthoritiesMapper().mapAuthorities(authorities));
   }
 
   private static Optional<String> getGroupName(String groupNameOrGroupDn) {
     return getDn(groupNameOrGroupDn)
         .map(Dn::getRDn)
         .map(RDn::getNameValue)
         .map(NameValue::getStringValue)
         .or(() -> Optional.ofNullable(groupNameOrGroupDn))
         .filter(Predicate.not(String::isBlank));
   }
 
   private static Optional<Dn> getDn(String dn) {
     if (isEmpty(dn)) {
       return Optional.empty();
     }
     try {
       return Optional.of(new Dn(dn));
     } catch (RuntimeException e) {
       return Optional.empty();
     }
   }
 
   /**
    * Gets roles by groups with user.
    *
    * @param user the user
    * @return the roles by groups with user
    */
   protected Collection<GrantedAuthority> getAuthoritiesByGroupsWithUser(LdapEntry user) {
     Collection<GrantedAuthority> authorities = getLdaptiveTemplate()
         .findAll(
             SearchRequest.builder()
                 .dn(getAuthenticationProperties().getGroupBaseDn())
                 .filter(FilterTemplate.builder()
                     .filter(getAuthorityFilter(user))
                     .build())
                 .scope(getAuthenticationProperties().getGroupSearchScope())
                 .build())
         .stream()
         .map(this::getAuthorityName)
         .map(SimpleGrantedAuthority::new)
         .collect(Collectors.toSet());
     return Set.copyOf(getGrantedAuthoritiesMapper().mapAuthorities(authorities));
   }
 
   /**
    * Gets group filter.
    *
    * @param user the user
    * @return the group filter
    */
   protected String getAuthorityFilter(LdapEntry user) {
     String groupObjectClass = getAuthenticationProperties().getGroupObjectClass();
     String groupMemberAttribute = getAuthenticationProperties().getGroupMemberAttribute();
     String groupMemberValue;
     String groupMemberFormat = getAuthenticationProperties().getGroupMemberFormat();
     if (isEmpty(groupMemberFormat)) {
       groupMemberValue = user.getDn();
     } else {
       String username = user.getAttribute(getAuthenticationProperties().getUsernameAttribute())
           .getStringValue();
       groupMemberValue = groupMemberFormat
           .replaceFirst(Pattern.quote(USERNAME_PLACEHOLDER), username);
     }
     return String.format("(&(objectClass=%s)(%s=%s))",
         groupObjectClass, groupMemberAttribute, groupMemberValue);
   }
 
   /**
    * Gets group name.
    *
    * @param group the group
    * @return the group name
    */
   protected String getAuthorityName(LdapEntry group) {
     String groupIdAttribute = getAuthenticationProperties().getGroupIdAttribute();
     String fallback = getGroupName(group.getDn()).orElse(null);
     if (isEmpty(groupIdAttribute)) {
       return fallback;
     }
     return Optional.ofNullable(group.getAttribute(groupIdAttribute))
         .map(LdapAttribute::getStringValue)
         .orElse(fallback);
   }
 
 }