package ca.cdr.api.model.json;

/*
 * #%L
 * Smile CDR - CDR
 * %%
 * Copyright (C) 2016 - 2025 Smile CDR, Inc.
 * %%
 * All rights reserved.
 * #L%
 */

import ca.cdr.api.model.enm.PermissionEnum;
import ca.cdr.api.model.enm.UserTwoFactorAuthEnum;
import ca.uhn.fhir.context.ConfigurationException;
import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.annotation.JsonPropertyOrder;
import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
import com.fasterxml.jackson.databind.annotation.JsonSerialize;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.Parameter;
import io.swagger.v3.oas.annotations.media.Schema;
import jakarta.annotation.Nonnull;
import org.apache.commons.lang3.SerializationUtils;
import org.apache.commons.lang3.Validate;
import org.apache.commons.lang3.builder.ToStringBuilder;
import org.apache.commons.lang3.builder.ToStringStyle;
import org.hl7.fhir.dstu3.model.DateType;
import org.springframework.security.core.userdetails.UserDetails;

import java.io.Serializable;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Date;
import java.util.List;
import java.util.Set;
import java.util.TreeSet;
import java.util.stream.Collectors;

import static org.apache.commons.lang3.StringUtils.defaultString;
import static org.apache.commons.lang3.StringUtils.isNotBlank;

/**
 * Perhaps if anyone is wondering why we have such a vague fields such as associatedResources and/or defaultLaunchContexts, in our model in the first place.
 * It's because the SMART spec has this concept of launch contexts, where the launch context is simply the patient/encounter/location that should
 * be opened when the app starts.
 * And there's nothing more implied there, just "this is what you should open", so the reason could be anything:
 * - the user is that patient
 * - the user has picked that patient from a list
 * - the user is the parent of the patient
 * - etc
 */
@Schema(name = "UserDetails", description = "A user definition")
@JsonPropertyOrder({
        "pid",
        "nodeId",
        "moduleId",
        "username",
        "familyName",
        "givenName",
        "notes",
        "lastActive",
        "lastConnected",
        "credentialExpiry",
        "accountLocked",
        "systemUser",
        "authorities",
        "associatedResources",
        "defaultLaunchContexts"
})
public class UserDetailsJson implements UserDetails, Cloneable, IHasAuthorities, IModelJson {

        private static final long serialVersionUID = 2L;

        /*
         * ******************************************************************
         * Note: If you add properties, add them to the copy constructor too!
         * ******************************************************************
         */

        @JsonProperty("accountDisabled")
        @Parameter(description = "Is this account currently disabled?")
        private Boolean myAccountDisabled;

        @JsonProperty("notes")
        @Parameter(description = "Any notes regarding this user")
        private String myNotes;

        @JsonProperty("email")
        @Parameter(description = "The user email address")
        private String myEmail;

        @JsonProperty("accountExpiry")
        @JsonSerialize(using = JsonDateSerializer.class)
        @JsonDeserialize(using = JsonDateWithEmptyDeserializer.class)
        @Parameter(description = "The expiry date for the user (if any) or null if the account should not expire")
        private Date myAccountExpiry;

        @JsonProperty("accountLocked")
        @Parameter(description = "Is this account currently locked?")
        private Boolean myAccountLocked;

        @JsonProperty("failedLoginAttempts")
        @Parameter(description = "Number of consecutive failed login attempts")
        private int myFailedLoginAttempts;

        @JsonProperty("authorities")
        @Parameter(description = "Any authorities (permissions) granted to this user")
        private List<GrantedAuthorityJson> myAuthorities;

        @JsonProperty("associatedResources")
        @Schema(
                        description =
                                        "A collection of \"associated resource\" IDs. Associated resources are FHIR resources with some connection to the given user, such as a Patient or Practitioner resource representing the actual user.",
                        accessMode = Schema.AccessMode.READ_ONLY)
        private List<AssociatedResourceJson> myAssociatedResources;

        @JsonProperty("credentialExpiry")
        @JsonSerialize(using = JsonDateSerializer.class)
        @JsonDeserialize(using = JsonDateWithEmptyDeserializer.class)
        @Parameter(description = "If set, provides the date that the user credentials will expire")
        private Date myCredentialExpiry;

        @JsonProperty("familyName")
        @Parameter(description = "The user's family (last) name")
        private String myFamilyName;

        @JsonProperty("givenName")
        @Parameter(description = "The user's given (first) name")
        private String myGivenName;

        @JsonProperty(value = "lastActive")
        @JsonSerialize(using = JsonDateSerializer.class)
        @JsonDeserialize(using = JsonDateDeserializer.class)
        @Schema(
                        accessMode = Schema.AccessMode.READ_ONLY,
                        description =
                                        "The date at which the user account was last used. Note that this property is read-only, and is only updated once per day, so it is accurate only to the date.")
        private Date myLastActive;

        @JsonProperty(value = "lastConnected")
        @JsonSerialize(using = JsonDateSerializer.class)
        @JsonDeserialize(using = JsonDateDeserializer.class)
        @Schema(
                        accessMode = Schema.AccessMode.READ_ONLY,
                        description =
                                        "The date at which the user last logged in. This property is read-only and is accurate to the minute.")
        private Date myLastConnected;

        @Schema(
                        accessMode = Schema.AccessMode.READ_ONLY,
                        description =
                                        "The module ID associated with this user account. This is the module ID associated with the Inbound Security module that is responsible for authenticating this user.")
        @JsonProperty("moduleId")
        private String myModuleId;

        @Schema(
                        accessMode = Schema.AccessMode.READ_ONLY,
                        description =
                                        "The node ID associated with this user. This is the master node ID associated with the Inbound Security module that is responsible for authenticating this user.")
        @JsonProperty("nodeId")
        private String myNodeId;

        @JsonProperty("password")
        @Schema(
                        description =
                                        "The user password (note that this property will not be populated when sessions are made available to user code)",
                        readOnly = true)
        private String myPassword;

        @JsonProperty("pid")
        @Schema(accessMode = Schema.AccessMode.READ_ONLY, description = "The PID (internal ID) for this user")
        private Long myPid;

        @JsonProperty("username")
        @Schema(accessMode = Schema.AccessMode.READ_ONLY, description = "The username for this user")
        private String myUsername;

        @JsonProperty("usernameNamespace")
        @Schema(accessMode = Schema.AccessMode.READ_ONLY, description = "The username namespace associated with this user")
        private String myUsernameNamespace;

        @Schema(
                        accessMode = Schema.AccessMode.READ_ONLY,
                        description =
                                        "If this is set, the user cannot be renamed or deleted (this property may only be set by the system)")
        @JsonProperty("systemUser")
        private boolean mySystemUser;

        @Schema(
                        accessMode = Schema.AccessMode.READ_ONLY,
                        description =
                                        "If this value is set, the user is backed by an external user directory (this property may only be set by the system)")
        @JsonProperty("external")
        private boolean myExternal;

        @JsonProperty("defaultLaunchContexts")
        @Schema(
                        accessMode = Schema.AccessMode.READ_ONLY,
                        description = "The SMART launch contexts associated with this account")
        private List<LaunchContextJson> myDefaultLaunchContexts;

        @JsonProperty("serviceAccount")
        private Boolean myServiceAccount;

        @JsonProperty("twoFactorAuthStatus")
        private UserTwoFactorAuthEnum myTwoFactorAuthStatus;

        /**
         * Constructor
         */
        public UserDetailsJson() {
                super();
        }

        /**
         * Constructor
         */
        public UserDetailsJson(UserDetailsJson theCopyObject) {
                this();

                setPid(theCopyObject.getPid());

                setUsername(theCopyObject.getUsername());
                setUsernameNamespace(theCopyObject.getUsernameNamespace());
                setPassword(theCopyObject.getPassword());

                setNodeId(theCopyObject.getNodeId());
                setModuleId(theCopyObject.getModuleId());

                setFamilyName(theCopyObject.getFamilyName());
                setGivenName(theCopyObject.getGivenName());
                setEmail(theCopyObject.getEmail());

                setNotes(theCopyObject.getNotes());
                setFailedLoginAttempts(theCopyObject.getFailedLoginAttempts());
                setAccountExpiry(theCopyObject.getAccountExpiry());
                setAccountDisabled(theCopyObject.isAccountDisabled());
                setAccountLocked(theCopyObject.isAccountLocked());
                setServiceAccount(theCopyObject.isServiceAccount());
                setSystemUser(theCopyObject.isSystemUser());
                setCredentialExpiry(theCopyObject.getCredentialExpiry());
                setLastActive(theCopyObject.getLastActive());
                setLastConnected(theCopyObject.getLastConnected());

                setAuthorities(theCopyObject.getAuthorities());
                setExternal(theCopyObject.isExternal());

                setTwoFactorAuthStatus(theCopyObject.getTwoFactorAuthStatus());

                getDefaultLaunchContexts().addAll(theCopyObject.getDefaultLaunchContexts());
                getAssociatedResources().addAll(theCopyObject.getAssociatedResources());
        }

        /*
         * ******************************************************************
         * Note: If you add properties, add them to the copy constructor too!
         * ******************************************************************
         */

        public UserTwoFactorAuthEnum getTwoFactorAuthStatus() {
                return myTwoFactorAuthStatus;
        }

        public UserDetailsJson setTwoFactorAuthStatus(UserTwoFactorAuthEnum theTwoFactorAuthStatus) {
                myTwoFactorAuthStatus = theTwoFactorAuthStatus;
                return this;
        }

        public void addAssociatedResource(String theType, String theResourceId) {
                Validate.notBlank(theType, "The type must not be null");
                AssociatedResourceTypeEnum type;
                try {
                        type = AssociatedResourceTypeEnum.valueOf(theType);
                } catch (Exception e) {
                        throw new ConfigurationException("Invalid type: " + theType);
                }
                addAssociatedResource(type, theResourceId);
        }

        public void addAssociatedResource(AssociatedResourceTypeEnum theType, String theResourceId) {
                Validate.notNull(theType, "The type must not be null");
                Validate.notBlank(theResourceId, "The resource ID must not be null");

                getAssociatedResources()
                                .add(new AssociatedResourceJson()
                                                .setType(AssociatedResourceTypeEnum.SELF)
                                                .setResourceId(theResourceId));
        }

        public void addAuthorities(GrantedAuthorityJson... theAuthority) {
                for (GrantedAuthorityJson next : theAuthority) {
                        addAuthority(next);
                }
        }

        public UserDetailsJson addAuthority(PermissionEnum thePermission) {
                getAuthorities().add(new GrantedAuthorityJson(thePermission));
                return this;
        }

        public void addAuthority(GrantedAuthorityJson theAuthority) {
                Validate.notNull(theAuthority, "theAuthority must not be null");
                getAuthorities().add(theAuthority);
        }

        public LaunchContextJson addDefaultLaunchContext() {
                LaunchContextJson ctx = new LaunchContextJson();
                getDefaultLaunchContexts().add(ctx);
                return ctx;
        }

        @SuppressWarnings("MethodDoesntCallSuperMethod")
        @Override
        public UserDetailsJson clone() {
                return SerializationUtils.clone(this);
        }

        public Date getAccountExpiry() {
                return myAccountExpiry;
        }

        public void setAccountExpiry(Date theAccountExpiry) {
                myAccountExpiry = theAccountExpiry;
        }

        public boolean hasAccountExpiryDate() {
                return myAccountExpiry != null;
        }

        public String getAccountExpiryDateAsIsoString() {
                if (myAccountExpiry == null) {
                        return "";
                }
                return new DateType(myAccountExpiry).getValueAsString();
        }

        public List<AssociatedResourceJson> getAssociatedResources() {
                if (myAssociatedResources == null) {
                        myAssociatedResources = new ArrayList<>();
                }
                return myAssociatedResources;
        }

        public boolean hasAuthorities() {
                return myAuthorities != null;
        }

        @Override
        @Nonnull
        public List<GrantedAuthorityJson> getAuthorities() {
                if (myAuthorities == null) {
                        myAuthorities = new ArrayList<>();
                }
                return myAuthorities;
        }

        public UserDetailsJson setAuthorities(Collection<GrantedAuthorityJson> theAuthorities) {
                myAuthorities = new ArrayList<>(theAuthorities);
                return this;
        }

        public boolean hasCredentialExpiryDate() {
                return myCredentialExpiry != null;
        }

        public Date getCredentialExpiry() {
                return myCredentialExpiry;
        }

        public void setCredentialExpiry(Date theCredentialExpiry) {
                myCredentialExpiry = theCredentialExpiry;
        }

        public String getCredentialExpiryDateAsIsoString() {
                if (myCredentialExpiry == null) {
                        return "";
                }
                return new DateType(myCredentialExpiry).getValueAsString();
        }

        public boolean hasDefaultLaunchContexts() {
                return myDefaultLaunchContexts != null;
        }

        public List<LaunchContextJson> getDefaultLaunchContexts() {
                if (myDefaultLaunchContexts == null) {
                        myDefaultLaunchContexts = new ArrayList<>();
                }
                return myDefaultLaunchContexts;
        }

        @SuppressWarnings("unused")
        public String getDefaultLaunchContextsCommaSeparated(String theType) {
                StringBuilder b = new StringBuilder();
                getDefaultLaunchContexts().stream()
                                .filter(t -> t.getContextType().equals(theType))
                                .filter(t -> isNotBlank(t.getResourceId()))
                                .forEach(t -> {
                                        if (!b.isEmpty()) {
                                                b.append(", ");
                                        }
                                        b.append(t.getResourceId());
                                });
                return b.toString();
        }

        public boolean hasEmail() {
                return myEmail != null;
        }

        public String getEmail() {
                return myEmail;
        }

        public UserDetailsJson setEmail(String theEmail) {
                myEmail = theEmail;
                return this;
        }

        public boolean hasFamilyName() {
                return myFamilyName != null;
        }

        public String getFamilyName() {
                return myFamilyName;
        }

        public UserDetailsJson setFamilyName(String theFamilyName) {
                myFamilyName = theFamilyName;
                return this;
        }

        public String getFullName() {
                return (defaultString(myGivenName) + ' ' + defaultString(myFamilyName)).trim();
        }

        public boolean hasGivenName() {
                return myGivenName != null;
        }

        public String getGivenName() {
                return myGivenName;
        }

        public UserDetailsJson setGivenName(String theGivenName) {
                myGivenName = theGivenName;
                return this;
        }

        public Date getLastActive() {
                return myLastActive;
        }

        public void setLastActive(Date theLastActive) {
                myLastActive = theLastActive;
        }

        public Date getLastConnected() {
                return myLastConnected;
        }

        public void setLastConnected(Date theLastConnected) {
                myLastConnected = theLastConnected;
        }

        public String getModuleId() {
                return myModuleId;
        }

        public UserDetailsJson setModuleId(String theModuleId) {
                myModuleId = theModuleId;
                return this;
        }

        public String getNodeId() {
                return myNodeId;
        }

        public UserDetailsJson setNodeId(String theNodeId) {
                myNodeId = theNodeId;
                return this;
        }

        public boolean hasNotes() {
                return myNotes != null;
        }

        public String getNotes() {
                return myNotes;
        }

        public void setNotes(String theNotes) {
                myNotes = theNotes;
        }

        @Override
        public String getPassword() {
                return myPassword;
        }

        public UserDetailsJson setPassword(String thePassword) {
                myPassword = thePassword;
                return this;
        }

        public boolean hasPassword() {
                return myPassword != null;
        }

        public Long getPid() {
                return myPid;
        }

        public UserDetailsJson setPid(Long thePid) {
                myPid = thePid;
                return this;
        }

        public Set<String> getAuthorityNames() {
                return getAuthorities().stream()
                                .map(t -> t.getPermission().name())
                                .collect(Collectors.toCollection(TreeSet::new));
        }

        public Boolean getServiceUser() {
                if (myServiceAccount == null) {
                        return false;
                }
                return myServiceAccount;
        }

        public boolean hasUsername() {
                return myUsername != null;
        }

        @Override
        public String getUsername() {
                return myUsername;
        }

        public UserDetailsJson setUsername(String theUsername) {
                myUsername = theUsername;
                return this;
        }

        @Override
        public List<GrantedAuthorityJson> getPermissions() {
                return getAuthorities();
        }

        @Operation(summary = "hasAuthority", description = "Does the user have the given permission?")
        public boolean hasAuthority(
                        @Parameter(name = "thePermission", description = "The name of the permission, e.g. 'ROLE_FHIR_CLIENT'")
                                        String thePermission) {
                for (GrantedAuthorityJson next : getAuthorities()) {
                        if (next.getPermission().name().equals(thePermission)) {
                                return true;
                        }
                }
                return false;
        }

        public boolean hasAccountDisabled() {
                return myAccountDisabled != null;
        }

        public boolean isAccountDisabled() {
                if (myAccountDisabled == null) {
                        return false;
                }
                return myAccountDisabled;
        }

        public void setAccountDisabled(boolean theAccountDisabled) {
                myAccountDisabled = theAccountDisabled;
        }

        public boolean hasAccountLocked() {
                return myAccountLocked != null;
        }

        public boolean isAccountLocked() {
                if (myAccountLocked == null) {
                        return false;
                }
                return myAccountLocked;
        }

        public void lockAccount() {
                setAccountLocked(true);
        }

        public void setAccountLocked(boolean theAccountLocked) {
                myAccountLocked = theAccountLocked;
        }

        public void setFailedLoginAttempts(int theFailedLoginAttempts) {
                myFailedLoginAttempts = theFailedLoginAttempts;
        }

        public int getFailedLoginAttempts() {
                return myFailedLoginAttempts;
        }

        public int incrementFailedLoginAttempts() {
                setFailedLoginAttempts(getFailedLoginAttempts() + 1);
                return getFailedLoginAttempts();
        }

        public void resetFailedLoginAttempts() {
                setFailedLoginAttempts(0);
        }

        @Override
        public boolean isAccountNonExpired() {
                return myAccountExpiry == null || myAccountExpiry.getTime() > System.currentTimeMillis();
        }

        @Override
        public boolean isAccountNonLocked() {
                return !isAccountLocked();
        }

        @Override
        public boolean isCredentialsNonExpired() {
                return myCredentialExpiry == null || myCredentialExpiry.getTime() > System.currentTimeMillis();
        }

        @Override
        public boolean isEnabled() {
                return !isAccountDisabled();
        }

        public boolean isExternal() {
                return myExternal;
        }

        public void setExternal(boolean theExternal) {
                myExternal = theExternal;
        }

        public boolean hasServiceAccount() {
                return myServiceAccount != null;
        }

        public boolean isServiceAccount() {
                if (myServiceAccount == null) {
                        return false;
                }
                return myServiceAccount;
        }

        public void setServiceAccount(boolean theServiceAccount) {
                myServiceAccount = theServiceAccount;
        }

        public boolean isSystemUser() {
                return mySystemUser;
        }

        public UserDetailsJson setSystemUser(boolean theSystemUser) {
                mySystemUser = theSystemUser;
                return this;
        }

        @Override
        public String toString() {
                ToStringBuilder b = new ToStringBuilder(this, ToStringStyle.NO_CLASS_NAME_STYLE);
                b.append("pid", myPid);
                b.append("username", myUsername);
                b.append("familyName", myFamilyName);
                b.append("givenName", myGivenName);
                b.append("authorities", myAuthorities);
                b.append("lastActive", myLastActive);
                b.append("lastConnected", myLastConnected);
                b.append("failedLoginAttempts", myFailedLoginAttempts);
                if (myAccountDisabled != null && myAccountDisabled) {
                        b.append("accountDisabled", myAccountDisabled);
                }
                if (myAccountExpiry != null) {
                        b.append("accountExpiryDate", myAccountExpiry);
                }
                if (myAccountLocked != null && myAccountLocked) {
                        b.append("accountLocked", myAccountLocked);
                }
                if (myCredentialExpiry != null) {
                        b.append("credentialExpiryDate", myCredentialExpiry);
                }
                if (mySystemUser) {
                        b.append("systemUser", mySystemUser);
                }
                if (myExternal) {
                        b.append("external", myExternal);
                }
                b.append("nodeId", myNodeId);
                b.append("moduleId", myModuleId);
                return b.toString();
        }

        public String getUsernameNamespace() {
                return myUsernameNamespace;
        }

        public void setUsernameNamespace(String theUsernameNamespace) {
                myUsernameNamespace = theUsernameNamespace;
        }

        public boolean hasUsernameNamespace() {
                return myUsernameNamespace != null;
        }

        @Operation(
                        summary = "getOrCreateDefaultLaunchContext",
                        description = "Returns the first default launch context for the given type, creating one if none exists")
        public LaunchContextJson getOrCreateDefaultLaunchContext(
                        @Parameter(name = "theContextType", description = "The context type, e.g. \"patient\" or \"practitioner\"")
                                        String theContextType) {
                for (LaunchContextJson next : getDefaultLaunchContexts()) {
                        if (next.getContextType().equals(theContextType)) {
                                return next;
                        }
                }

                LaunchContextJson retVal = new LaunchContextJson().setContextType(theContextType);
                getDefaultLaunchContexts().add(retVal);
                return retVal;
        }

        @Operation(
                        summary = "getOrCreateDefaultLaunchContext",
                        description = "Returns the first default launch context for the given type, creating one if none exists")
        public LaunchContextJson getOrCreateDefaultLaunchContext(
                        @Parameter(name = "theContextType", description = "The context type, e.g. \"patient\" or \"practitioner\"")
                                        String theContextType,
                        @Parameter(name = "theIndex", description = "The index, starting at 0") int theIndex) {

                int foundIndex = 0;
                for (LaunchContextJson next : getDefaultLaunchContexts()) {
                        if (next.getContextType().equals(theContextType)) {
                                if (theIndex == foundIndex) {
                                        return next;
                                } else {
                                        foundIndex++;
                                }
                        }
                }

                LaunchContextJson retVal = new LaunchContextJson().setContextType(theContextType);
                getDefaultLaunchContexts().add(retVal);
                return retVal;
        }

        /**
         * What type of relationship does the user have to the
         * given resource
         */
        public enum AssociatedResourceTypeEnum {

                /**
                 * This associated resource is the user themself
                 */
                SELF
        }

        /**
         * This structure represents a link between a user in the auth database
         * and a resource in the FHIR database. This can be used, for example,
         * to specify that a particular user is a specific Patient in the
         * CDR. That linkage can then be applied in order to make
         * security/permission decisions.
         */
        @Schema(
                        name = "AssociatedResource",
                        description = "This structure represents a link between a user in the auth database "
                                        + "and a resource in the FHIR database. This can be used, for example, "
                                        + "to specify that a particular user is a specific Patient in the "
                                        + "CDR. That linkage can then be applied in order to make "
                                        + "security/permission decisions.")
        public static class AssociatedResourceJson implements Serializable, IModelJson {

                @JsonProperty("type")
                @Schema(description = "The relationship between the user and the resource")
                private AssociatedResourceTypeEnum myType;

                @JsonProperty("resourceId")
                @Schema(description = "The resource ID itself, e.g. 'Patient/123'", example = "Patient/123")
                private String myResourceId;

                public String getResourceId() {
                        return myResourceId;
                }

                public AssociatedResourceJson setResourceId(String theResourceId) {
                        myResourceId = theResourceId;
                        return this;
                }

                public AssociatedResourceTypeEnum getType() {
                        return myType;
                }

                public AssociatedResourceJson setType(String theType) {
                        myType = AssociatedResourceTypeEnum.valueOf(theType);
                        return this;
                }

                public AssociatedResourceJson setType(AssociatedResourceTypeEnum theType) {
                        myType = theType;
                        return this;
                }
        }

        public static PermissionEnum toPermissionEnum(String thePermission) {
                try {
                        return PermissionEnum.valueOf(thePermission);
                } catch (Exception e) {
                        throw new ConfigurationException("Invalid permission name: " + thePermission);
                }
        }
}