/*-
 * #%L
 * Smile CDR - CDR
 * %%
 * Copyright (C) 2016 - 2025 Smile CDR, Inc.
 * %%
 * All rights reserved.
 * #L%
 */
package ca.cdr.api.security;

import ca.cdr.api.log.Logs;
import ca.cdr.api.security.SmartPermissions.SmartV2Permission;
import jakarta.annotation.Nonnull;
import jakarta.annotation.Nullable;
import org.apache.commons.lang3.StringUtils;
import org.apache.commons.lang3.Validate;

import java.util.Objects;
import java.util.Optional;
import java.util.Set;

import static ca.cdr.api.security.ScopeConstants.SUPPORTED_SCOPE_PREFIXES;

/**
 * Parsed smart scope for access to clinical data.
 * <a href="http://hl7.org/fhir/smart-app-launch/scopes-and-launch-context.html">...</a>
 * Only clinical scopes; not used for context, identity, or extension scopes.
 */
public final class SmartClinicalScope implements Comparable<SmartClinicalScope> {
        @Nonnull
        private final String myPrefix;

        @Nonnull
        private final String myResourceType;

        @Nonnull
        private final SmartPermissions myPermissions;

        @Nullable
        private final String myFilter;

        /**
         * Inspect the scope, and parse if it is a resource access scope.
         * e.g. "patient/*.read?code=foo" will parse, but "openid" will not.
         * @param theScope the requested scope
         * @return a parsed SmartClinicalScope if the scope affected resource access.
         */
        public static Optional<SmartClinicalScope> fromScopeString(String theScope) {
                // "patient/Observation.read?code=foo"
                theScope = StringUtils.trim(theScope);
                if (StringUtils.isEmpty(theScope)) {
                        return Optional.empty();
                }
                int slashIdx = theScope.indexOf('/');
                if (slashIdx == -1) {
                        Logs.getSecurityTroubleshootingLog().trace("Not a clinical scope - no /: {}", theScope);
                        return Optional.empty();
                }
                int dotIdx = theScope.indexOf('.', slashIdx);
                if (dotIdx == -1) {
                        Logs.getSecurityTroubleshootingLog().trace("Not a clinical scope - no .: {}", theScope);
                        return Optional.empty();
                }
                int questIdx = theScope.indexOf('?', dotIdx);

                String compartment = theScope.substring(0, slashIdx);
                String resourceType = theScope.substring(slashIdx + 1, dotIdx);
                String perms;
                String filter = null;
                if (questIdx == -1) {
                        perms = theScope.substring(dotIdx + 1);
                } else {
                        perms = theScope.substring(dotIdx + 1, questIdx);
                        filter = theScope.substring(questIdx + 1);
                        if (filter.isBlank()) {
                                filter = null;
                        }
                }

                if (isValidPrefix(compartment)
                                && isValidResourceType(resourceType)
                                && SmartPermissions.isValidPermission(perms)) {
                        return Optional.of(
                                        new SmartClinicalScope(compartment, resourceType, SmartPermissions.parse(perms), filter));
                } else {
                        Logs.getSecurityTroubleshootingLog().debug("Unrecognized scope: {}", theScope);
                        return Optional.empty();
                }
        }

        public SmartClinicalScope(
                        @Nonnull String thePrefix,
                        @Nonnull String theResourceType,
                        @Nonnull SmartPermissions thePerms,
                        @Nullable String theFilter) {

                Validate.notEmpty(thePrefix);
                Validate.notNull(thePerms);
                Validate.notEmpty(theResourceType);

                myPrefix = thePrefix;
                myResourceType = theResourceType;
                myPermissions = thePerms;
                myFilter = theFilter;
        }

        /**
         * Get the prefix.  E.g. "patient" from patient/Observation.read
         */
        @Nonnull
        public String getPrefix() {
                return myPrefix;
        }

        /**
         * Get the resource scope.  E.g. "Observation" from patient/Observation.read
         * Can be "*"
         */
        @Nonnull
        public String getResourceType() {
                return myResourceType;
        }

        /**
         * Is the resource scope "*".  E.g. patient/*.read?code=foo
         */
        public boolean isStarType() {
                return myResourceType.equals("*");
        }

        @Nonnull
        public SmartPermissions getPermissions() {
                return myPermissions;
        }

        @Nonnull
        public Set<SmartV2Permission> getV2Permissions() {
                return myPermissions.getV2Permissions();
        }

        /**
         * Does the scope have the given V2 permission, or the equivalent from v1.
         */
        public boolean hasV2Permission(SmartV2Permission read) {
                return myPermissions.hasV2Permission(read);
        }

        /**
         * Get the (optional) filter from the scope. E.g. "code=foo" from patient/*.read?code=foo
         */
        @Nullable
        public String getFilter() {
                return myFilter;
        }

        public boolean hasFilter() {
                return StringUtils.isNotEmpty(myFilter);
        }

        /** one of patient, user, or system */
        private static boolean isValidPrefix(String thePrefix) {
                return SUPPORTED_SCOPE_PREFIXES.contains(thePrefix + '/');
        }

        /**
         * alpha-numeric or *
         */
        private static boolean isValidResourceType(String theResourceType) {
                return "*".equals(theResourceType) || StringUtils.isAlphanumeric(theResourceType);
        }

        /**
         * Is this scope implied by theOtherScope.
         * We need to know if requested scopes are permitted by the registered allowed scopes.
         * This isn't just simple string-set membership since the allowed scopes might be patient/*.read
         * while the requested scope could be patient/Observation.read, or patient/Observation.r
         */
        public boolean isImpliedBy(SmartClinicalScope theOtherScope) {
                return Objects.equals(theOtherScope.getPrefix(), getPrefix())
                                && (theOtherScope.isStarType() || Objects.equals(theOtherScope.getResourceType(), getResourceType()))
                                && (theOtherScope.getV2Permissions().containsAll(this.getV2Permissions()))
                                && (!theOtherScope.hasFilter() || Objects.equals(theOtherScope.myFilter, myFilter));
        }

        @Override
        public String toString() {
                return "SmartClinicalScope(" + getScopeString() + ")";
        }

        @Nonnull
        public String getScopeString() {
                return myPrefix + "/" + myResourceType + "." + myPermissions.getPermissionString()
                                + (StringUtils.isNotEmpty(myFilter) ? ("?" + myFilter) : "");
        }

        @Override
        public boolean equals(Object theOther) {
                if (this == theOther) {
                        return true;
                }
                if (theOther == null || getClass() != theOther.getClass()) {
                        return false;
                }
                SmartClinicalScope that = (SmartClinicalScope) theOther;
                return myPrefix.equals(that.myPrefix)
                                && myResourceType.equals(that.myResourceType)
                                && myPermissions.equals(that.myPermissions)
                                && Objects.equals(myFilter, that.myFilter);
        }

        @Override
        public int hashCode() {
                return Objects.hash(myPrefix, myResourceType, myPermissions, myFilter);
        }

        public boolean hasSearch() {
                return hasV2Permission(SmartV2Permission.SEARCH);
        }

        @Override
        public int compareTo(@Nonnull SmartClinicalScope o) {
                return toString().compareTo(o.toString());
        }
}