/*-
 * #%L
 * Smile CDR - CDR
 * %%
 * Copyright (C) 2016 - 2025 Smile CDR, Inc.
 * %%
 * All rights reserved.
 * #L%
 */
package ca.cdr.api.security.permission;

import ca.cdr.api.i18n.ILocalizer;
import ca.cdr.api.model.enm.PermissionEnum;
import ca.cdr.api.model.json.GrantedAuthorityJson;
import jakarta.annotation.Nonnull;
import jakarta.annotation.Nullable;
import org.apache.commons.lang3.Validate;
import org.hl7.fhir.instance.model.api.IIdType;

import java.util.Collection;
import java.util.Optional;
import java.util.regex.Pattern;

/**
 * Public interface for the various permission argument formats.
 * @param <F> The type this format parses/formats
 */
public interface PermissionArgumentFormat<F extends PermissionArgumentValue> {

        char FILTER_DELIMITER = '?';
        char TYPE_COMPARTMENT_DELIMITER = ':';
        String RESOURCE_TYPE_LIST_DELIMITER = " ";
        String RESOURCE_TYPE_PATTERN = "[A-Z][a-zA-Z\\d]*";
        /**
         * format for resource ids - used for compartments.
         * The spec says [a-zA-Z0-9.\-]{1,36}, but hybrid might do any crazy thing,
         * so we only verify we don't have any of our permission-format chars.
         * @see ca.uhn.fhir.model.primitive.IdDt */
        Pattern ID_FORMAT = Pattern.compile(RESOURCE_TYPE_PATTERN + "/[^" + FILTER_DELIMITER + TYPE_COMPARTMENT_DELIMITER
                        + RESOURCE_TYPE_LIST_DELIMITER + "]+");

        /**
         * Typesafe authority builder.
         * Validates the argument format against the declared format for thePermissionEnum
         * @param thePermissionEnum the permission
         * @param theArgumentValue the concrete parsed argument type - use {@link NoArgument#INSTANCE} for no-arg.
         */
        static GrantedAuthorityJson buildAuthority(
                        @Nonnull PermissionEnum thePermissionEnum, @Nonnull PermissionArgumentValue theArgumentValue) {
                String formattedArg = thePermissionEnum.getFormat().formatIfValid(theArgumentValue);
                return new GrantedAuthorityJson(thePermissionEnum, formattedArg);
        }

        /**
         * Parse a permission argument string.
         * @param theArgumentString The string to parse.  null is treated as empty.
         * @param theIdBuilder factory for parsing IIdType types
         * @return the parsed arg value if the input matches this format
         */
        @Nonnull
        Optional<F> parse(@Nullable String theArgumentString, @Nonnull IdBuilder theIdBuilder);

        @Nonnull
        default <T extends PermissionArgumentValue> String formatIfValid(@Nonnull T theArgument) {
                Validate.isInstanceOf(this.getType(), theArgument);
                //noinspection unchecked
                return format((F) theArgument);
        }

        /**
         * @return the type of the value bean we parse
         */
        Class<F> getType();

        /**
         * format the value back into a string for persistence.
         * @param theArgument the arg value bean
         * @return the formatted string - empty will be the empty string, not null
         */
        @Nonnull
        String format(@Nonnull F theArgument);

        /**
         *
         * @return the name of the argument format
         */
        default String getName(ILocalizer theLocalizer) {
                return theLocalizer.getMessage(
                                "permission.argument_format." + this.getType().getName() + ".name");
        }

        /**
         *
         * @return A description of the argument format that users can use to properly format arguments
         */
        default String getDescription(ILocalizer theLocalizer) {
                return theLocalizer.getMessage(
                                "permission.argument_format." + this.getType().getName() + ".desc");
        }

        /* -------------- */
        /* format components */
        /* -------------- */
        /** Empty marker for facets of permission arguments */
        interface IPermissionComponent {}

        /** The permission is scoped to only apply to a type */
        interface IResourceTypeRestriction extends IPermissionComponent {
                /** A resource type - e.g. Patient */
                String getResourceType();
        }

        /** the permission is scoped to a compartment */
        interface ICompartmentRestriction extends IPermissionComponent {
                /** Get compartment owner */
                IIdType getOwner();

                /** The type of the compartment - i.e. the type of the compartment owner.  E.g Patient, Device, etc. */
                default String getCompartmentType() {
                        return getOwner().getResourceType();
                }
        }

        interface ICompartmentsRestriction extends IPermissionComponent {
                /** Get compartment owners */
                Collection<IIdType> getOwners();
        }

        /** The permission is scoped to a single instance */
        interface IInstanceRestriction extends IPermissionComponent, IResourceTypeRestriction {
                /** The scope instance */
                IIdType getInstanceId();

                /** The type of the instance */
                @Override
                default String getResourceType() {
                        return getInstanceId().getResourceType();
                }
        }

        /** The permission has an optional FHIR filter */
        interface IOptionalFilterRestriction extends IPermissionComponent {
                /** The fhir query - optional */
                Optional<String> getFilter();
                /** Is this permission scoped by a fhir query? */
                default boolean hasFilter() {
                        return getFilter().isPresent();
                }
        }

        interface ICodeInValueSetRestriction extends IPermissionComponent {
                /** A resource type - e.g., Patient */
                String getResourceType();

                /** a search parameter */
                String getSearchParamName();

                /** a URL identifying a value set */
                String getValueSetUrl();
        }

        interface IOperationRestriction extends IPermissionComponent {
                /** the name of an operation */
                String getOperationName();
        }

        interface IExportResourceTypesRestriction extends IPermissionComponent {
                /** indicates that the user has permission to export all types */
                boolean canExportAllResourceTypes();

                /** the names of the types that the user has permission to export */
                Collection<String> getResourceTypes();
        }

        interface ICompartmentWithExportResourceTypesRestriction extends IPermissionComponent, ICompartmentRestriction {

                /** the names of the types that the user has permission to export */
                Collection<String> getResourceTypes();
        }

        interface ICompartmentsWithExportResourceTypesRestriction
                        extends IPermissionComponent, ICompartmentsRestriction, IExportResourceTypesRestriction {}

        interface INodeAndModuleIdRestriction extends IPermissionComponent {
                /** the nodeId that the user has permission for */
                String getNodeId();
                /** the moduleId that the user has permission for */
                String getModuleId();
        }
}