//******************************************************************************************************
//  AuthorizeControllerRoleAttribute.cs - Gbtc
//
//  Copyright © 2016, Grid Protection Alliance.  All Rights Reserved.
//
//  Licensed to the Grid Protection Alliance (GPA) under one or more contributor license agreements. See
//  the NOTICE file distributed with this work for additional information regarding copyright ownership.
//  The GPA licenses this file to you under the MIT License (MIT), the "License"; you may not use this
//  file except in compliance with the License. You may obtain a copy of the License at:
//
//      http://opensource.org/licenses/MIT
//
//  Unless agreed to in writing, the subject software distributed under the License is distributed on an
//  "AS-IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. Refer to the
//  License for the specific language governing permissions and limitations.
//
//  Code Modification History:
//  ----------------------------------------------------------------------------------------------------
//  02/23/2016 - J. Ritchie Carroll
//       Generated original version of source code.
//
//******************************************************************************************************

using System;
using System.Linq;
using System.Security;
using System.Threading;
using System.Web.Mvc;
using GSF.Collections;
using GSF.Security;

namespace GSF.Web.Security
{
    /// <summary>
    /// Defines an MVC filter attribute to handle the GSF role based security model.
    /// </summary>
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = false)]
    public class AuthorizeControllerRoleAttribute : FilterAttribute, IAuthorizationFilter, IExceptionFilter
    {
        #region [ Members ]

        // Fields

        /// <summary>
        /// Gets allowed roles as a string array.
        /// </summary>
        public readonly string[] AllowedRoles;

        #endregion

        #region [ Constructors ]

        /// <summary>
        /// Creates a new MVC based authorization attribute.
        /// </summary>
        public AuthorizeControllerRoleAttribute()
        {
            AllowedRoles = new string[0];
        }

        /// <summary>
        /// Creates a new MVC based authorization attribute for specified roles.
        /// </summary>
        public AuthorizeControllerRoleAttribute(string allowedRoles)
        {
            AllowedRoles = allowedRoles?.Split(',').Select(role => role.Trim()).
                Where(role => !string.IsNullOrEmpty(role)).ToArray() ?? new string[0];
        }

        #endregion

        #region [ Properties ]

        /// <summary>
        /// Gets or sets settings category used to lookup security connection for user data context.
        /// </summary>
        public string SecuritySettingsCategory { get; set; } = "securityProvider";

        /// <summary>
        /// Gets or sets view name to show for security exceptions.
        /// </summary>
        public string SecurityExceptionViewName { get; set; } = "SecurityError";

        #endregion

        #region [ Methods ]

        /// <summary>
        /// Called when authorization is required.
        /// </summary>
        /// <param name="filterContext">The filter context.</param>
        public void OnAuthorization(AuthorizationContext filterContext)
        {
            SecurityPrincipal securityPrincipal = filterContext.HttpContext.User as SecurityPrincipal;

            if ((object)securityPrincipal == null || (object)securityPrincipal.Identity == null)
            {
                filterContext.Result = new HttpUnauthorizedResult($"Authentication failed for user \"{filterContext.HttpContext.User?.Identity.Name}\".");
                filterContext.HttpContext.User = null;
                return;
            }
            
            // Get current user name
            string username = securityPrincipal.Identity.Name;

            // Verify that the current thread principal has been authenticated.
            if (!securityPrincipal.Identity.IsAuthenticated)
            {
                filterContext.Result = new HttpUnauthorizedResult($"User \"{username}\" is not authenticated.");
                filterContext.HttpContext.User = null;
            }
            else if (AllowedRoles.Length > 0 && !AllowedRoles.Any(role => securityPrincipal.IsInRole(role)))
            {
                filterContext.Result = new HttpUnauthorizedResult($"Access is denied for user \"{username}\": minimum required roles = {AllowedRoles.ToDelimitedString(", ")}.");
                filterContext.HttpContext.User = null;
            }
            else
            {
                ThreadPool.QueueUserWorkItem(start => AuthorizationCache.CacheAuthorization(username, SecuritySettingsCategory));
            }
        }

        /// <summary>
        /// Called when an exception occurs.
        /// </summary>
        /// <param name="filterContext">The filter context.</param>
        public void OnException(ExceptionContext filterContext)
        {
            if (filterContext.Exception is SecurityException)
            {
                filterContext.Result = new ViewResult
                {
                    ViewName = SecurityExceptionViewName,
                    ViewData = new ViewDataDictionary
                    {
                        ["Exception"] = filterContext.Exception
                    }
                };
                filterContext.ExceptionHandled = true;
            }
        }

        #endregion
    }
}