package org.springframework.security.oauth2.provider.vote;

import java.util.Collection;
import java.util.Set;

import org.springframework.security.access.AccessDecisionVoter;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.oauth2.common.exceptions.InsufficientScopeException;
import org.springframework.security.oauth2.provider.ClientDetails;
import org.springframework.security.oauth2.provider.ClientDetailsService;
import org.springframework.security.oauth2.provider.OAuth2Authentication;
import org.springframework.security.oauth2.provider.OAuth2Request;

/**
 * This voter checks scope in request is consistent with that held by the client. If there is no user in the request
 * (client_credentials grant) it checks against authorities of client instead of scopes by default. Activate by adding
 * <code>CLIENT_HAS_SCOPE</code> to security attributes.
 * 
 * @author Dave Syer
 * 
 */
public class ClientScopeVoter implements AccessDecisionVoter<Object> {

	private String clientHasScope = "CLIENT_HAS_SCOPE";

	private boolean throwException = true;

	private ClientDetailsService clientDetailsService;

	private boolean clientAuthoritiesAreScopes = true;

	/**
	 * ClientDetailsService for looking up clients by ID.
	 * 
	 * @param clientDetailsService the client details service (mandatory)
	 */
	public void setClientDetailsService(ClientDetailsService clientDetailsService) {
		this.clientDetailsService = clientDetailsService;
	}

	/**
	 * Flag to determine the behaviour on access denied. If set then we throw an {@link InsufficientScopeException}
	 * instead of returning {@link AccessDecisionVoter#ACCESS_DENIED}. This is unconventional for an access decision
	 * voter because it vetos the other voters in the chain, but it enables us to pass a message to the caller with
	 * information about the required scope.
	 * 
	 * @param throwException the flag to set (default true)
	 */
	public void setThrowException(boolean throwException) {
		this.throwException = throwException;
	}

	/**
	 * Flag to signal that when there is no user authentication client authorities are to be treated as scopes.
	 * 
	 * @param clientAuthoritiesAreScopes the flag value (default true)
	 */
	public void setClientAuthoritiesAreScopes(boolean clientAuthoritiesAreScopes) {
		this.clientAuthoritiesAreScopes = clientAuthoritiesAreScopes;
	}

	/**
	 * The name of the config attribute that can be used to deny access to OAuth2 client. Defaults to
	 * <code>DENY_OAUTH</code>.
	 * 
	 * @param denyAccess the deny access attribute value to set
	 */
	public void setDenyAccess(String denyAccess) {
		this.clientHasScope = denyAccess;
	}

	public boolean supports(ConfigAttribute attribute) {
		if (clientHasScope.equals(attribute.getAttribute())) {
			return true;
		}
		else {
			return false;
		}
	}

	/**
	 * This implementation supports any type of class, because it does not query the presented secure object.
	 * 
	 * @param clazz the secure object
	 * 
	 * @return always <code>true</code>
	 */
	public boolean supports(Class<?> clazz) {
		return true;
	}

	public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {

		int result = ACCESS_ABSTAIN;

		if (!(authentication instanceof OAuth2Authentication)) {
			return result;
		}

		OAuth2Authentication oauth2Authentication = (OAuth2Authentication) authentication;
		OAuth2Request clientAuthentication = oauth2Authentication.getOAuth2Request();
		ClientDetails client = clientDetailsService.loadClientByClientId(clientAuthentication.getClientId());
		Set<String> scopes = clientAuthentication.getScope();
		if (oauth2Authentication.isClientOnly() && clientAuthoritiesAreScopes) {
			scopes = AuthorityUtils.authorityListToSet(clientAuthentication.getAuthorities());
		}

		for (ConfigAttribute attribute : attributes) {
			if (this.supports(attribute)) {

				result = ACCESS_GRANTED;

				for (String scope : scopes) {
					if (!client.getScope().contains(scope)) {
						result = ACCESS_DENIED;
						break;
					}
				}

				if (result == ACCESS_DENIED && throwException) {
					InsufficientScopeException failure = new InsufficientScopeException(
							"Insufficient scope for this resource", client.getScope());
					throw new AccessDeniedException(failure.getMessage(), failure);
				}

				return result;
			}
		}

		return result;
	}

}