<?php

/*

 * This file is part of the Symfony package.

 *

 * (c) Fabien Potencier <fabien@symfony.com>

 *

 * For the full copyright and license information, please view the LICENSE

 * file that was distributed with this source code.

 */

namespace Symfony\Component\Security\Acl\Dbal;

use Doctrine\Common\PropertyChangedListener;

use Doctrine\DBAL\Driver\Connection;

use Symfony\Component\Security\Acl\Domain\RoleSecurityIdentity;

use Symfony\Component\Security\Acl\Domain\UserSecurityIdentity;

use Symfony\Component\Security\Acl\Exception\AclAlreadyExistsException;

use Symfony\Component\Security\Acl\Exception\ConcurrentModificationException;

use Symfony\Component\Security\Acl\Exception\Exception;

use Symfony\Component\Security\Acl\Model\AclCacheInterface;

use Symfony\Component\Security\Acl\Model\AclInterface;

use Symfony\Component\Security\Acl\Model\EntryInterface;

use Symfony\Component\Security\Acl\Model\MutableAclInterface;

use Symfony\Component\Security\Acl\Model\MutableAclProviderInterface;

use Symfony\Component\Security\Acl\Model\ObjectIdentityInterface;

use Symfony\Component\Security\Acl\Model\PermissionGrantingStrategyInterface;

use Symfony\Component\Security\Acl\Model\SecurityIdentityInterface;

/**

 * An implementation of the MutableAclProviderInterface using Doctrine DBAL.

 *

 * @author Johannes M. Schmitt <schmittjoh@gmail.com>

 */

class MutableAclProvider extends AclProvider implements MutableAclProviderInterface, PropertyChangedListener

{

    private $propertyChanges;

    /**

     * {@inheritDoc}

     */

    public function __construct(Connection $connection, PermissionGrantingStrategyInterface $permissionGrantingStrategy, array $options, AclCacheInterface $cache = null)

    {

        parent::__construct($connection, $permissionGrantingStrategy, $options, $cache);

        $this->propertyChanges = new \SplObjectStorage();

    }

    /**

     * {@inheritDoc}

     */

    public function createAcl(ObjectIdentityInterface $oid)

    {

        if (false !== $this->retrieveObjectIdentityPrimaryKey($oid)) {

            throw new AclAlreadyExistsException(sprintf('%s is already associated with an ACL.', $oid));

        }

        $this->connection->beginTransaction();

        try {

            $this->createObjectIdentity($oid);

            $pk = $this->retrieveObjectIdentityPrimaryKey($oid);

            $this->connection->executeQuery($this->getInsertObjectIdentityRelationSql($pk, $pk));

            $this->connection->commit();

        } catch (\Exception $failed) {

            $this->connection->rollBack();

            throw $failed;

        }

        // re-read the ACL from the database to ensure proper caching, etc.

        return $this->findAcl($oid);

    }

    /**

     * {@inheritDoc}

     */

    public function deleteAcl(ObjectIdentityInterface $oid)

    {

        $this->connection->beginTransaction();

        try {

            foreach ($this->findChildren($oid, true) as $childOid) {

                $this->deleteAcl($childOid);

            }

            $oidPK = $this->retrieveObjectIdentityPrimaryKey($oid);

            $this->deleteAccessControlEntries($oidPK);

            $this->deleteObjectIdentityRelations($oidPK);

            $this->deleteObjectIdentity($oidPK);

            $this->connection->commit();

        } catch (\Exception $failed) {

            $this->connection->rollBack();

            throw $failed;

        }

        // evict the ACL from the in-memory identity map

        if (isset($this->loadedAcls[$oid->getType()][$oid->getIdentifier()])) {

            $this->propertyChanges->offsetUnset($this->loadedAcls[$oid->getType()][$oid->getIdentifier()]);

            unset($this->loadedAcls[$oid->getType()][$oid->getIdentifier()]);

        }

        // evict the ACL from any caches

        if (null !== $this->cache) {

            $this->cache->evictFromCacheByIdentity($oid);

        }

    }

    /**

     * {@inheritDoc}

     */

    public function findAcls(array $oids, array $sids = array())

    {

        $result = parent::findAcls($oids, $sids);

        foreach ($result as $oid) {

            $acl = $result->offsetGet($oid);

            if (false === $this->propertyChanges->contains($acl) && $acl instanceof MutableAclInterface) {

                $acl->addPropertyChangedListener($this);

                $this->propertyChanges->attach($acl, array());

            }

            $parentAcl = $acl->getParentAcl();

            while (null !== $parentAcl) {

                if (false === $this->propertyChanges->contains($parentAcl) && $acl instanceof MutableAclInterface) {

                    $parentAcl->addPropertyChangedListener($this);

                    $this->propertyChanges->attach($parentAcl, array());

                }

                $parentAcl = $parentAcl->getParentAcl();

            }

        }

        return $result;

    }

    /**

     * Implementation of PropertyChangedListener

     *

     * This allows us to keep track of which values have been changed, so we don't

     * have to do a full introspection when ->updateAcl() is called.

     *

     * @param mixed $sender

     * @param string $propertyName

     * @param mixed $oldValue

     * @param mixed $newValue

     * @return void

     */

    public function propertyChanged($sender, $propertyName, $oldValue, $newValue)

    {

        if (!$sender instanceof MutableAclInterface && !$sender instanceof EntryInterface) {

            throw new \InvalidArgumentException('$sender must be an instance of MutableAclInterface, or EntryInterface.');

        }

        if ($sender instanceof EntryInterface) {

            if (null === $sender->getId()) {

                return;

            }

            $ace = $sender;

            $sender = $ace->getAcl();

        } else {

            $ace = null;

        }

        if (false === $this->propertyChanges->contains($sender)) {

            throw new \InvalidArgumentException('$sender is not being tracked by this provider.');

        }

        $propertyChanges = $this->propertyChanges->offsetGet($sender);

        if (null === $ace) {

            if (isset($propertyChanges[$propertyName])) {

                $oldValue = $propertyChanges[$propertyName][0];

                if ($oldValue === $newValue) {

                    unset($propertyChanges[$propertyName]);

                } else {

                    $propertyChanges[$propertyName] = array($oldValue, $newValue);

                }

            } else {

                $propertyChanges[$propertyName] = array($oldValue, $newValue);

            }

        } else {

            if (!isset($propertyChanges['aces'])) {

                $propertyChanges['aces'] = new \SplObjectStorage();

            }

            $acePropertyChanges = $propertyChanges['aces']->contains($ace)? $propertyChanges['aces']->offsetGet($ace) : array();

            if (isset($acePropertyChanges[$propertyName])) {

                $oldValue = $acePropertyChanges[$propertyName][0];

                if ($oldValue === $newValue) {

                    unset($acePropertyChanges[$propertyName]);

                } else {

                    $acePropertyChanges[$propertyName] = array($oldValue, $newValue);

                }

            } else {

                $acePropertyChanges[$propertyName] = array($oldValue, $newValue);

            }

            if (count($acePropertyChanges) > 0) {

                $propertyChanges['aces']->offsetSet($ace, $acePropertyChanges);

            } else {

                $propertyChanges['aces']->offsetUnset($ace);

                if (0 === count($propertyChanges['aces'])) {

                    unset($propertyChanges['aces']);

                }

            }

        }

        $this->propertyChanges->offsetSet($sender, $propertyChanges);

    }

    /**

     * {@inheritDoc}

     */

    public function updateAcl(MutableAclInterface $acl)

    {

        if (!$this->propertyChanges->contains($acl)) {

            throw new \InvalidArgumentException('$acl is not tracked by this provider.');

        }

        $propertyChanges = $this->propertyChanges->offsetGet($acl);

        // check if any changes were made to this ACL

        if (0 === count($propertyChanges)) {

            return;

        }

        $sets = $sharedPropertyChanges = array();

        $this->connection->beginTransaction();

        try {

            if (isset($propertyChanges['entriesInheriting'])) {

                $sets[] = 'entries_inheriting = '.$this->connection->getDatabasePlatform()->convertBooleans($propertyChanges['entriesInheriting'][1]);

            }

            if (isset($propertyChanges['parentAcl'])) {

                if (null === $propertyChanges['parentAcl'][1]) {

                    $sets[] = 'parent_object_identity_id = NULL';

                } else {

                    $sets[] = 'parent_object_identity_id = '.intval($propertyChanges['parentAcl'][1]->getId());

                }

                $this->regenerateAncestorRelations($acl);

                $childAcls = $this->findAcls($this->findChildren($acl->getObjectIdentity(), false));

                foreach ($childAcls as $childOid) {

                    $this->regenerateAncestorRelations($childAcls[$childOid]);

                }

            }

            // this includes only updates of existing ACEs, but neither the creation, nor

            // the deletion of ACEs; these are tracked by changes to the ACL's respective

            // properties (classAces, classFieldAces, objectAces, objectFieldAces)

            if (isset($propertyChanges['aces'])) {

                $this->updateAces($propertyChanges['aces']);

            }

            // check properties for deleted, and created ACEs

            if (isset($propertyChanges['classAces'])) {

                $this->updateAceProperty('classAces', $propertyChanges['classAces']);

                $sharedPropertyChanges['classAces'] = $propertyChanges['classAces'];

            }

            if (isset($propertyChanges['classFieldAces'])) {

                $this->updateFieldAceProperty('classFieldAces', $propertyChanges['classFieldAces']);

                $sharedPropertyChanges['classFieldAces'] = $propertyChanges['classFieldAces'];

            }

            if (isset($propertyChanges['objectAces'])) {

                $this->updateAceProperty('objectAces', $propertyChanges['objectAces']);

            }

            if (isset($propertyChanges['objectFieldAces'])) {

                $this->updateFieldAceProperty('objectFieldAces', $propertyChanges['objectFieldAces']);

            }

            // if there have been changes to shared properties, we need to synchronize other

            // ACL instances for object identities of the same type that are already in-memory

            if (count($sharedPropertyChanges) > 0) {

                $classAcesProperty = new \ReflectionProperty('Symfony\Component\Security\Acl\Domain\Acl', 'classAces');

                $classAcesProperty->setAccessible(true);

                $classFieldAcesProperty = new \ReflectionProperty('Symfony\Component\Security\Acl\Domain\Acl', 'classFieldAces');

                $classFieldAcesProperty->setAccessible(true);

                foreach ($this->loadedAcls[$acl->getObjectIdentity()->getType()] as $sameTypeAcl) {

                    if (isset($sharedPropertyChanges['classAces'])) {

                        if ($acl !== $sameTypeAcl && $classAcesProperty->getValue($sameTypeAcl) !== $sharedPropertyChanges['classAces'][0]) {

                            throw new ConcurrentModificationException('The "classAces" property has been modified concurrently.');

                        }

                        $classAcesProperty->setValue($sameTypeAcl, $sharedPropertyChanges['classAces'][1]);

                    }

                    if (isset($sharedPropertyChanges['classFieldAces'])) {

                        if ($acl !== $sameTypeAcl && $classFieldAcesProperty->getValue($sameTypeAcl) !== $sharedPropertyChanges['classFieldAces'][0]) {

                            throw new ConcurrentModificationException('The "classFieldAces" property has been modified concurrently.');

                        }

                        $classFieldAcesProperty->setValue($sameTypeAcl, $sharedPropertyChanges['classFieldAces'][1]);

                    }

                }

            }

            // persist any changes to the acl_object_identities table

            if (count($sets) > 0) {

                $this->connection->executeQuery($this->getUpdateObjectIdentitySql($acl->getId(), $sets));

            }

            $this->connection->commit();

        } catch (\Exception $failed) {

            $this->connection->rollBack();

            throw $failed;

        }

        $this->propertyChanges->offsetSet($acl, array());

        if (null !== $this->cache) {

            if (count($sharedPropertyChanges) > 0) {

                // FIXME: Currently, there is no easy way to clear the cache for ACLs

                //        of a certain type. The problem here is that we need to make

                //        sure to clear the cache of all child ACLs as well, and these

                //        child ACLs might be of a different class type.

                $this->cache->clearCache();

            } else {

                // if there are no shared property changes, it's sufficient to just delete

                // the cache for this ACL

                $this->cache->evictFromCacheByIdentity($acl->getObjectIdentity());

                foreach ($this->findChildren($acl->getObjectIdentity()) as $childOid) {

                    $this->cache->evictFromCacheByIdentity($childOid);

                }

            }

        }

    }

    /**

     * Constructs the SQL for deleting access control entries.

     *

     * @param integer $oidPK

     * @return string

     */

    protected function getDeleteAccessControlEntriesSql($oidPK)

    {

        return sprintf(

              'DELETE FROM %s WHERE object_identity_id = %d',

            $this->options['entry_table_name'],

            $oidPK

        );

    }

    /**

     * Constructs the SQL for deleting a specific ACE.

     *

     * @param integer $acePK

     * @return string

     */

    protected function getDeleteAccessControlEntrySql($acePK)

    {

        return sprintf(

            'DELETE FROM %s WHERE id = %d',

            $this->options['entry_table_name'],

            $acePK

        );

    }

    /**

     * Constructs the SQL for deleting an object identity.

     *

     * @param integer $pk

     * @return string

     */

    protected function getDeleteObjectIdentitySql($pk)

    {

        return sprintf(

            'DELETE FROM %s WHERE id = %d',

            $this->options['oid_table_name'],

            $pk

        );

    }

    /**

     * Constructs the SQL for deleting relation entries.

     *

     * @param integer $pk

     * @return string

     */

    protected function getDeleteObjectIdentityRelationsSql($pk)

    {

        return sprintf(

            'DELETE FROM %s WHERE object_identity_id = %d',

            $this->options['oid_ancestors_table_name'],

            $pk

        );

    }

    /**

     * Constructs the SQL for inserting an ACE.

     *

     * @param integer $classId

     * @param integer|null $objectIdentityId

     * @param string|null $field

     * @param integer $aceOrder

     * @param integer $securityIdentityId

     * @param string $strategy

     * @param integer $mask

     * @param Boolean $granting

     * @param Boolean $auditSuccess

     * @param Boolean $auditFailure

     * @return string

     */

    protected function getInsertAccessControlEntrySql($classId, $objectIdentityId, $field, $aceOrder, $securityIdentityId, $strategy, $mask, $granting, $auditSuccess, $auditFailure)

    {

        $query = <<<QUERY

            INSERT INTO %s (

                class_id,

                object_identity_id,

                field_name,

                ace_order,

                security_identity_id,

                mask,