<?php

/*
 * Copyright 2010 Johannes M. Schmitt <schmittjoh@gmail.com>
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

namespace JMS\SecurityExtraBundle\Security\Authorization\AfterInvocation;

use Symfony\Component\HttpKernel\Log\LoggerInterface;
use Symfony\Component\Security\Acl\Exception\AclNotFoundException;
use Symfony\Component\Security\Acl\Exception\NoAceFoundException;
use Symfony\Component\Security\Acl\Model\SecurityIdentityRetrievalStrategyInterface;
use Symfony\Component\Security\Acl\Model\ObjectIdentityRetrievalStrategyInterface;
use Symfony\Component\Security\Acl\Model\AclProviderInterface;
use Symfony\Component\Security\Acl\Permission\PermissionMapInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\AccessDeniedException;

/**
 * This after invocation provider filters returned objects based on ACLs.
 *
 * @author Johannes M. Schmitt <schmittjoh@gmail.com>
 */
class AclAfterInvocationProvider implements AfterInvocationProviderInterface
{
    private $aclProvider;
    private $oidRetrievalStrategy;
    private $sidRetrievalStrategy;
    private $permissionMap;
    private $logger;

    public function __construct(AclProviderInterface $aclProvider, ObjectIdentityRetrievalStrategyInterface $oidRetrievalStrategy, SecurityIdentityRetrievalStrategyInterface $sidRetrievalStrategy, PermissionMapInterface $permissionMap, LoggerInterface $logger = null)
    {
        $this->aclProvider = $aclProvider;
        $this->oidRetrievalStrategy = $oidRetrievalStrategy;
        $this->sidRetrievalStrategy = $sidRetrievalStrategy;
        $this->permissionMap = $permissionMap;
        $this->logger = $logger;
    }

    public function decide(TokenInterface $token, $secureObject, array $attributes, $returnedObject)
    {
        if (null === $returnedObject) {
            if (null !== $this->logger) {
                $this->logger->debug('Returned object was null, skipping security check.');
            }

            return null;
        }

        foreach ($attributes as $attribute) {
            if (!$this->supportsAttribute($attribute)) {
                continue;
            }

            if (null === $oid = $this->oidRetrievalStrategy->getObjectIdentity($returnedObject)) {
                if (null !== $this->logger) {
                    $this->logger->debug('Returned object was no domain object, skipping security check.');
                }

                return $returnedObject;
            }

            $sids = $this->sidRetrievalStrategy->getSecurityIdentities($token);

            try {
                $acl = $this->aclProvider->findAcl($oid, $sids);
                if ($acl->isGranted($this->permissionMap->getMasks($attribute, $returnedObject), $sids, false)) {
                    return $returnedObject;
                }

                if (null !== $this->logger) {
                    $this->logger->debug('Token has been denied access for returned object.');
                }
            } catch (AclNotFoundException $noAcl) {
                throw new AccessDeniedException('No applicable ACL found for domain object.');
            } catch (NoAceFoundException $noAce) {
                if (null !== $this->logger) {
                    $this->logger->debug('No applicable ACE found for the given Token, denying access.');
                }
            }

            throw new AccessDeniedException('ACL has denied access for attribute: '.$attribute);
        }

        // no attribute was supported
        return $returnedObject;
    }

    public function supportsAttribute($attribute)
    {
        return $this->permissionMap->contains($attribute);
    }

    public function supportsClass($className)
    {
        return true;
    }
}