module Scrivito
  #
  # @api public
  #
  class User
    #
    # Valid action verbs for the explicit rules.
    # @api public
    #
    VERBS = [
      # Lets the user create new working copies.
      :create,

      # Makes the content of the working copy visible to the user.
      :read,

      # Lets the user modify the content of the working copy.
      # Also lets the user rename the working copy.
      :write,

      # Permits the user to delete the working copy.
      :delete,

      # Permits the user to invite other users to collaborate on the working copy.
      :invite_to,

      # Permits the user to publish the working copy.
      :publish,

      # Permits the user to access the publishing history
      :read_history,
    ].freeze

    # Defines a new user.
    #
    # @api public
    #
    # @param [String] id The unique, unalterable id of the user.
    #   The user id is used to associate the user with the corresponding CMS resources.
    #   It is persisted in the CMS.
    #
    # @raise [Scrivito::ScrivitoError] if id is blank
    # @raise [Scrivito::ScrivitoError] if id is more than 64 characters long
    #
    # @yieldparam [Scrivito::UserDefinition] user object to define rules on
    #
    # @see Scrivito::UserDefinition#can_always
    # @see Scrivito::UserDefinition#can_never
    # @see Scrivito::UserDefinition#description
    # @see Scrivito::UserDefinition#restrict_obj_publish
    # @see Scrivito::UserDefinition#suggest_users
    #
    # @example
    #   Scrivito::User.define('alice') do |user_definition|
    #     user_definition.description { 'Alice Almighty' }
    #
    #     user_definition.can_always(:read, :workspace)
    #     user_definition.can_always(:write, :workspace)
    #     user_definition.can_always(:publish, :workspace, 'You can always publish workspaces.')
    #   end
    #
    #   Scrivito::User.define('bob') do |user_definition|
    #     user_definition.description('Bob Doe')
    #
    #     user_definition.can_never(:create, :workspace, 'You are not allowed to create workspaces.')
    #     user_definition.can_always(:read, :workspace)
    #
    #     user_definition.restrict_obj_publish(using: :_obj_class) do |obj_class|
    #       if obj_class == 'BlogPost'
    #         false
    #       else
    #         'You are not allowed to publish blog posts.'
    #       end
    #     end
    #   end
    #
    def self.define(id, &block)
      assert_valid_id(id)
      define_user(id, &block)
    end

    #
    # Returns an anonymous system user who can always create workspaces, can always read, write,
    # publish, delete, and invite others to collaborate on any workspace.
    # @example Check whether the user may publish a particular object:
    #   Scrivito::User.system_user.can_publish?(Obj.root)
    #   # => true
    #
    # @example Get the notification messages for publishing restrictions. An empty array indicates that no restrictions exist.
    #   Scrivito::User.system_user.restriction_messages_for(Obj.root)
    #   # => []
    #
    # @api public
    # @return [Scrivito::User] the system user
    #
    def self.system_user
      define_user { |user| user.is_admin! }
    end

    def self.unknown_user(id)
      new(id: id, explicit_rules: {})
    end

    def self.find(id)
      if Configuration.find_user_proc
        user = Scrivito::Configuration.find_user_proc.call(id)
        assert_valid_user(user)
        user
      end
    end

    def self.mget(*ids)
      ids.map(&method(:find))
    end

    private_class_method def self.define_user(id = nil)
      user_definition = UserDefinition.new(id)
      yield user_definition if block_given?
      user_definition.user
    end

    private_class_method def self.assert_valid_id(id)
      raise ScrivitoError.new('User id must be a string') unless id.to_s == id
      raise ScrivitoError.new('User id can not be blank') if id.blank?
      raise ScrivitoError.new('User id is too long (max length 64)') if id.length > 64
    end

    private_class_method def self.assert_valid_user(user)
      unless user.is_a?(User) || user.nil?
        raise ScrivitoError.new("Expected an instance of #{self} or nil, but got #{user.inspect}")
      end
    end

    attr_reader :id, :explicit_rules, :description_proc, :suggest_users_proc, :restriction_set

    def initialize(options)
      @id                 = options[:id]
      @explicit_rules     = options[:explicit_rules]
      @description_proc   = options[:description_proc]
      @suggest_users_proc = options[:suggest_users_proc]
      @restriction_set    = options[:restriction_set]

      @explicit_rules.each { |rule| assert_valid_verb(rule.second) }
      @explicit_rules_set = Set.new(@explicit_rules.map { |rule| rule.take(3) })
    end

    def can?(verb, workspace)
      assert_valid_verb(verb)

      return true if can_always?(verb, :workspace)
      return false if can_never?(verb, :workspace)

      case verb
      when :create                               then true
      when :read                                 then workspace.published? || owner_of?(workspace)
      when :write, :delete, :invite_to, :publish then owner_of?(workspace)
      end
    end

    def can_always?(verb, subject)
      assert_valid_verb(verb)
      @explicit_rules_set.include?([:always, verb, subject])
    end

    def can_never?(verb, subject)
      assert_valid_verb(verb)
      @explicit_rules_set.include?([:never, verb, subject])
    end

    def owner_of?(workspace)
      membership = workspace.memberships[self]
      membership ? membership.role == 'owner' : false
    end

    #
    # Checks whether the User may publish changes to a specific {Scrivito::BasicObj Obj}.
    #
    # @api public
    # @param [Scrivito::BasicObj] obj the object to be published
    # @return [Boolean] true if the user is allowed to publish the object, otherwise false
    #
    def can_publish?(obj)
      restriction_messages_for(obj).empty?
    end

    #
    # Checks whether the User may publish changes to an {Scrivito::BasicObj Obj} and returns
    # the message specified in a {Scrivito::UserDefinition#restrict_obj_publish} callback if they
    # may not. If the user may publish the CMS object, an empty array is returned.
    #
    # @api public
    # @param [Scrivito::BasicObj] obj the object to be published
    # @return [Array<String>] Hints on why the user cannot publish the object
    #
    def restriction_messages_for(obj)
      assert_restrictions_applicable(obj)

      return [] if can_always?(:publish, :workspace)

      if obj.modification == Modification::EDITED
        base_revision_obj = obj.in_revision(obj.revision.workspace.base_revision)

        restriction_set.restriction_messages_for(obj) |
          restriction_set.restriction_messages_for(base_revision_obj)
      else
        restriction_set.restriction_messages_for(obj)
      end
    end

    def description
      @description ||= calculate_description
    end

    def suggest_users(input)
      if suggest_users_proc
        suggested_users = sandbox_suggest_user_proc(input)
        suggested_users.nil? ? [] : suggested_users
      else
        user = self.class.find(input)
        user ? [user] : []
      end
    end

    # By convention, only the anonymous admin user has a +nil+ id.
    def system_user?
      id.nil?
    end

    def as_json
      {
        id: id,
        description: description,
      }
    end

    private

    def calculate_description
      description_proc ? description_proc.call : id
    end

    def assert_valid_verb(verb)
      raise ScrivitoError.new("Invalid verb '#{verb}'") unless VERBS.include?(verb)
    end

    def assert_restrictions_applicable(obj)
      if obj.revision.base?
        raise ScrivitoError.new("The revision of #{obj.inspect} may not be a base revision")
      end
    end

    def sandbox_suggest_user_proc(input)
      suggest_users_proc.call(input)
    rescue StandardError => e
      message = %{Method `suggest_users' of the user "#{id}" raised an error on input "#{input}"}
      Warning.error(message, e)

      nil
    end
  end
end