/*
 * To change this license header, choose License Headers in Project Properties.
 * To change this template file, choose Tools | Templates
 * and open the template in the editor.
 */
package cz.csu.sdmx.web.security;

import cz.csu.sdmx.constants.SESSION;
import cz.csu.sdmx.constants.URL;
import cz.csu.sdmx.dao.UsersDao;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

/**
 *
 * @author themi
 */
@Component
public class SecurityInterceptor extends HandlerInterceptorAdapter{
    
    private static final String IDENT_KEY = "ident";
    
    @Autowired
    private UsersDao usersDao;
    
    @Autowired
    private HttpSession session;
    
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        if(request.getRequestURI().contains("/debug"))
            return true;
        
        String unauthorized = request.getContextPath() + URL.UNAUTHORIZED;

        //if not request for unauthorized view
        if(!request.getRequestURI().equals(unauthorized)){
            User currentUser = (User) session.getAttribute(SESSION.USER);
            //if no user present yet
            if(currentUser == null){
                //get ident param that should be supplied
                String ident = (String) request.getParameter(IDENT_KEY);
                //if not supplied, redirect to unauthorized view
                if(ident == null){
                    response.sendRedirect(unauthorized);
                    return false;
                }
                
                //if ident present, decode it
                String decodedIdent = usersDao.decodePersonalNumber(ident);
//                String decodedIdent = ident;
                
                currentUser = usersDao.find(decodedIdent);
                //if no user with decoded ident found, create a default one
                if(currentUser == null)
                    currentUser = new User(decodedIdent);
                
                session.setAttribute(SESSION.USER, currentUser);
            }
            
            if(handler.getClass().equals(HandlerMethod.class)){
                HandlerMethod hm =(HandlerMethod)handler;
                
                Access access = hm.getMethodAnnotation(Access.class);
                //if requested method in controller has annotation 'Access', check if current user has permission to access
                if(access != null){
                    Permission permission = access.value();
                    //if user does not have permission, redirect to unauthorized view 
                    if(permission != null && !currentUser.hasPermission(permission)){
                        response.sendRedirect(unauthorized);
                        return false;
                    }
                }
            }
        }
        
        return super.preHandle(request, response, handler); 
    }

}
