/*
    * Licensed to the Apache Software Foundation (ASF) under one
    * or more contributor license agreements.  See the NOTICE file
    * distributed with this work for additional information
    * regarding copyright ownership.  The ASF licenses this file
    * to you under the Apache License, Version 2.0 (the
    * "License"); you may not use this file except in compliance
    * with the License.  You may obtain a copy of the License at
    *
   *     http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing,
   * software distributed under the License is distributed on an
   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
   * KIND, either express or implied.  See the License for the
   * specific language governing permissions and limitations
   * under the License.
   */
  package org.apache.shiro.guice.web;
  
  import com.google.inject.Binder;
  import com.google.inject.Key;
  import com.google.inject.TypeLiteral;
  import com.google.inject.binder.AnnotatedBindingBuilder;
  import com.google.inject.name.Names;
  import com.google.inject.servlet.ServletModule;
  import org.apache.shiro.config.ConfigurationException;
  import org.apache.shiro.env.Environment;
  import org.apache.shiro.guice.ShiroModule;
  import org.apache.shiro.lang.util.StringUtils;
  import org.apache.shiro.mgt.SecurityManager;
  import org.apache.shiro.session.mgt.SessionManager;
  import org.apache.shiro.web.env.WebEnvironment;
  import org.apache.shiro.web.filter.InvalidRequestFilter;
  import org.apache.shiro.web.filter.PathMatchingFilter;
  import org.apache.shiro.web.filter.authc.AnonymousFilter;
  import org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter;
  import org.apache.shiro.web.filter.authc.BearerHttpAuthenticationFilter;
  import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
  import org.apache.shiro.web.filter.authc.LogoutFilter;
  import org.apache.shiro.web.filter.authc.UserFilter;
  import org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter;
  import org.apache.shiro.web.filter.authz.IpFilter;
  import org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter;
  import org.apache.shiro.web.filter.authz.PortFilter;
  import org.apache.shiro.web.filter.authz.RolesAuthorizationFilter;
  import org.apache.shiro.web.filter.authz.SslFilter;
  import org.apache.shiro.web.filter.mgt.FilterChainResolver;
  import org.apache.shiro.web.filter.session.NoSessionCreationFilter;
  import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
  import org.apache.shiro.web.mgt.WebSecurityManager;
  import org.apache.shiro.web.session.mgt.ServletContainerSessionManager;
  
  import javax.servlet.Filter;
  import javax.servlet.ServletContext;
  import java.util.ArrayList;
  import java.util.Arrays;
  import java.util.Collection;
  import java.util.Collections;
  import java.util.HashMap;
  import java.util.LinkedHashMap;
  import java.util.List;
  import java.util.Map;
  
  @SuppressWarnings("checkstyle:JavadocVariable")
  /**
   * Sets up Shiro lifecycles within Guice, enables the injecting of Shiro objects, and binds a default
   * {@link org.apache.shiro.web.mgt.WebSecurityManager},
   * {@link org.apache.shiro.mgt.SecurityManager} and {@link org.apache.shiro.session.mgt.SessionManager}.
   * At least one realm must be added by
   * using {@link #bindRealm() bindRealm}.
   * <p/>
   * Also provides for the configuring of filter chains and binds a
   * {@link org.apache.shiro.web.filter.mgt.FilterChainResolver} with that information.
   */
  public abstract class ShiroWebModule extends ShiroModule {
      public static final Key<AnonymousFilter> ANON = Key.get(AnonymousFilter.class);
      public static final Key<FormAuthenticationFilter> AUTHC = Key.get(FormAuthenticationFilter.class);
      public static final Key<BasicHttpAuthenticationFilter> AUTHC_BASIC = Key.get(BasicHttpAuthenticationFilter.class);
      public static final Key<BearerHttpAuthenticationFilter> AUTHC_BEARER = Key.get(BearerHttpAuthenticationFilter.class);
      public static final Key<NoSessionCreationFilter> NO_SESSION_CREATION = Key.get(NoSessionCreationFilter.class);
      public static final Key<LogoutFilter> LOGOUT = Key.get(LogoutFilter.class);
      public static final Key<PermissionsAuthorizationFilter> PERMS = Key.get(PermissionsAuthorizationFilter.class);
      public static final Key<PortFilter> PORT = Key.get(PortFilter.class);
      public static final Key<HttpMethodPermissionFilter> REST = Key.get(HttpMethodPermissionFilter.class);
      public static final Key<RolesAuthorizationFilter> ROLES = Key.get(RolesAuthorizationFilter.class);
      public static final Key<SslFilter> SSL = Key.get(SslFilter.class);
      public static final Key<IpFilter> IP = Key.get(IpFilter.class);
      public static final Key<UserFilter> USER = Key.get(UserFilter.class);
      public static final Key<InvalidRequestFilter> INVALID_REQUEST = Key.get(InvalidRequestFilter.class);
  
      static final String NAME = "SHIRO";
  
      /**
       * We use a LinkedHashMap here to ensure that iterator order is the same as add order.  This is important, as the
       * FilterChainResolver uses iterator order when searching for a matching chain.
       */
      private final Map<String, FilterConfig<? extends Filter>[]> filterChains =
              new LinkedHashMap<String, FilterConfig<? extends Filter>[]>();
     private final ServletContext servletContext;
 
     public ShiroWebModule(ServletContext servletContext) {
         this.servletContext = servletContext;
     }
 
     public static void bindGuiceFilter(Binder binder) {
         binder.install(guiceFilterModule());
     }
 
     public static void bindGuiceFilter(final String pattern, Binder binder) {
         binder.install(guiceFilterModule(pattern));
     }
 
     public static ServletModule guiceFilterModule() {
         return guiceFilterModule("/*");
     }
 
     public static ServletModule guiceFilterModule(final String pattern) {
         return new ServletModule() {
             @Override
             protected void configureServlets() {
                 filter(pattern).through(GuiceShiroFilter.class);
             }
         };
     }
 
     public List<FilterConfig<? extends Filter>> globalFilters() {
         return Collections.singletonList(filterConfig(INVALID_REQUEST));
     }
 
     @Override
     @SuppressWarnings("unchecked")
     protected final void configureShiro() {
         bindBeanType(TypeLiteral.get(ServletContext.class), Key.get(ServletContext.class, Names.named(NAME)));
         bind(Key.get(ServletContext.class, Names.named(NAME))).toInstance(this.servletContext);
         bindWebSecurityManager(bind(WebSecurityManager.class));
         bindWebEnvironment(bind(WebEnvironment.class));
         bind(GuiceShiroFilter.class).asEagerSingleton();
         expose(GuiceShiroFilter.class);
 
         this.configureShiroWeb();
 
         // add default matching route if not already set
         if (!filterChains.containsKey("/**")) {
             // no config, this will add only the global filters
             this.addFilterChain("/**", new FilterConfig[0]);
         }
 
         bind(FilterChainResolver.class).toProvider(new FilterChainResolverProvider(setupFilterChainConfigs()));
     }
 
     @SuppressWarnings("unchecked")
     private Map<String, Key<? extends Filter>[]> setupFilterChainConfigs() {
 
         // loop through and build a map of Filter Key -> Map<Path, Config>
         Map<Key<? extends Filter>, Map<String, String>> filterToPathToConfig =
                 new HashMap<Key<? extends Filter>, Map<String, String>>();
 
         // At the same time build a map to return with Path -> Key[]
         Map<String, Key<? extends Filter>[]> resultConfigMap = new LinkedHashMap<String, Key<? extends Filter>[]>();
 
         for (Map.Entry<String, FilterConfig<? extends Filter>[]> filterChain : filterChains.entrySet()) {
 
             String path = filterChain.getKey();
 
             // collect the keys used for this path
             List<Key<? extends Filter>> keysForPath = new ArrayList<Key<? extends Filter>>();
 
             List<FilterConfig<? extends Filter>> globalFilters = this.globalFilters();
             FilterConfig<? extends Filter>[] pathFilters = filterChain.getValue();
 
             // merge the global filters and the path specific filters
             List<FilterConfig<? extends Filter>> filterConfigs = new ArrayList<>(globalFilters.size() + pathFilters.length);
             filterConfigs.addAll(globalFilters);
             filterConfigs.addAll(Arrays.asList(pathFilters));
 
             for (FilterConfig<? extends Filter> filterConfig : filterConfigs) {
 
                 Key<? extends Filter> key = filterConfig.getKey();
                 String config = filterConfig.getConfigValue();
 
                 // initialize key in filterToPathToConfig, if it doesn't exist
                 if (filterToPathToConfig.get(key) == null) {
                     // Fix for SHIRO-621: REST filter bypassing matched path
                     filterToPathToConfig.put((key), new LinkedHashMap<String, String>());
                 }
                 // now set the value
                 filterToPathToConfig.get(key).put(path, config);
 
                 // Config error if someone configured a non PathMatchingFilter with a config value
                 if (StringUtils.hasText(config)
                         && !PathMatchingFilter.class.isAssignableFrom(key.getTypeLiteral().getRawType())) {
                     throw new ConfigurationException(
                             "Config information requires a PathMatchingFilter - can't apply to "
                                     + key.getTypeLiteral().getRawType());
                 }
 
                 // store the key in keysForPath
                 keysForPath.add(key);
             }
 
             // map the current path to all of its Keys
             resultConfigMap.put(path, keysForPath.toArray(new Key[keysForPath.size()]));
         }
 
         // now we find only the PathMatchingFilter and configure bindings
         // non PathMatchingFilter, can be loaded with the default provider via the class name
         for (Key<? extends Filter> key : filterToPathToConfig.keySet()) {
             if (PathMatchingFilter.class.isAssignableFrom(key.getTypeLiteral().getRawType())) {
                 bindPathMatchingFilter(castToPathMatching(key), filterToPathToConfig.get(key));
             } else {
                 bind(key);
             }
         }
 
         return resultConfigMap;
     }
 
 
     private <T extends PathMatchingFilter> void bindPathMatchingFilter(Key<T> filterKey, Map<String, String> configs) {
         bind(filterKey).toProvider(new PathMatchingFilterProvider<T>(filterKey, configs)).asEagerSingleton();
     }
 
     @SuppressWarnings({"unchecked"})
     private Key<? extends PathMatchingFilter> castToPathMatching(Key<? extends Filter> key) {
         return (Key<? extends PathMatchingFilter>) key;
     }
 
     protected abstract void configureShiroWeb();
 
     @SuppressWarnings({"unchecked"})
     @Override
     protected final void bindSecurityManager(AnnotatedBindingBuilder<? super SecurityManager> bind) {
         // SHIRO-435
         bind.to(WebSecurityManager.class);
     }
 
     /**
      * Binds the security manager.  Override this method in order to provide your own security manager binding.
      * <p/>
      * By default, a {@link org.apache.shiro.web.mgt.DefaultWebSecurityManager} is bound as an eager singleton.
      *
      * @param bind
      */
     protected void bindWebSecurityManager(AnnotatedBindingBuilder<? super WebSecurityManager> bind) {
         try {
             bind.toConstructor(DefaultWebSecurityManager.class.getConstructor(Collection.class)).asEagerSingleton();
         } catch (NoSuchMethodException e) {
             throw new ConfigurationException("This really shouldn't happen.  Either something has changed in Shiro, "
                     + "or there's a bug in ShiroModule.", e);
         }
     }
 
     /**
      * Binds the session manager.  Override this method in order to provide your own session manager binding.
      * <p/>
      * By default, a {@link org.apache.shiro.web.session.mgt.DefaultWebSessionManager} is bound as an eager singleton.
      *
      * @param bind
      */
     @Override
     protected void bindSessionManager(AnnotatedBindingBuilder<SessionManager> bind) {
         bind.to(ServletContainerSessionManager.class).asEagerSingleton();
     }
 
     @Override
     protected final void bindEnvironment(AnnotatedBindingBuilder<Environment> bind) {
         // SHIRO-435
         bind.to(WebEnvironment.class);
     }
 
     protected void bindWebEnvironment(AnnotatedBindingBuilder<? super WebEnvironment> bind) {
         bind.to(WebGuiceEnvironment.class).asEagerSingleton();
     }
 
     @SuppressWarnings("unchecked")
     protected final void addFilterChain(String pattern, Key<? extends Filter> key) {
         // check for legacy API
         if (key instanceof FilterConfigKey) {
             addLegacyFilterChain(pattern, (FilterConfigKey) key);
         } else {
             addFilterChain(pattern, new FilterConfig<Filter>((Key<Filter>) key, ""));
         }
     }
 
     /**
      * Maps 'n' number of <code>filterConfig</code>s to a specific path pattern.<BR/>
      * For example, a path of '/my_private_resource/**' to 'filterConfig(AUTHC)' would require
      * any resource under the path '/my_private_resource' would be processed through the {@link FormAuthenticationFilter}.
      *
      * @param pattern       URL patter to be mapped to a FilterConfig, e.g. '/my_private-path/**'
      * @param filterConfigs FilterConfiguration representing the Filter
      *                      and config to be used when processing resources on <code>pattern</code>.
      * @since 1.4
      */
     @SafeVarargs
     protected final void addFilterChain(String pattern, FilterConfig<? extends Filter>... filterConfigs) {
         filterChains.put(pattern, filterConfigs);
     }
 
     /**
      * Builds a FilterConfig from a Filer and configuration String
      *
      * @param baseKey The Key of the Filter class to be used.
      * @param <T>     A Servlet Filter class.
      * @return A FilterConfig used to map a String path to this configuration.
      * @since 1.4
      */
     protected static <T extends Filter> FilterConfig<T> filterConfig(Key<T> baseKey, String configValue) {
         return new FilterConfig<T>(baseKey, configValue);
     }
 
     /**
      * Builds a FilterConfig from a Filer and configuration String
      *
      * @param baseKey The Key of the Filter class to be used.
      * @param <T>     A Servlet Filter class.
      * @return A FilterConfig used to map a String path to this configuration.
      * @since 1.4
      */
     protected static <T extends Filter> FilterConfig<T> filterConfig(Key<T> baseKey) {
         return filterConfig(baseKey, "");
     }
 
     /**
      * Builds a FilterConfig from a Filer and configuration String
      *
      * @param typeLiteral The TypeLiteral of the filter key to be used.
      * @param configValue the configuration used.
      * @param <T>         A Servlet Filter class.
      * @return A FilterConfig used to map a String path to this configuration.
      * @since 1.4
      */
     protected static <T extends Filter> FilterConfig<T> filterConfig(TypeLiteral<T> typeLiteral, String configValue) {
         return filterConfig(Key.get(typeLiteral), configValue);
     }
 
     /**
      * Builds a FilterConfig from a Filer and configuration String
      *
      * @param type        The filter to be used.
      * @param configValue the configuration used.
      * @param <T>         A Servlet Filter class.
      * @return A FilterConfig used to map a String path to this configuration.
      * @since 1.4
      */
     protected static <T extends Filter> FilterConfig<T> filterConfig(Class<T> type, String configValue) {
         return filterConfig(Key.get(type), configValue);
     }
 
 
     /**
      * Filter configuration which pairs a Filter class with its configuration used on a path.
      *
      * @param <T> The Servlet Filter class.
      * @since 1.4
      */
     public static final class FilterConfig<T extends Filter> {
         private Key<T> key;
         private String configValue;
 
         private FilterConfig(Key<T> key, String configValue) {
             super();
             this.key = key;
             this.configValue = configValue;
         }
 
         public Key<T> getKey() {
             return key;
         }
 
         public String getConfigValue() {
             return configValue;
         }
     }
 
 
     // legacy methods
 
 
     static boolean isGuiceVersion3() {
         try {
             Class.forName("com.google.inject.multibindings.MapKey");
             return false;
         } catch (ClassNotFoundException e) {
             return true;
         }
     }
 
     @SuppressWarnings("unchecked")
     private void addLegacyFilterChain(String pattern, FilterConfigKey filterConfigKey) {
         FilterConfig<Filter> filterConfig = new FilterConfig<>(filterConfigKey.getKey(), filterConfigKey.getConfigValue());
         addFilterChain(pattern, filterConfig);
     }
 
     /**
      * Adds a filter chain to the shiro configuration.
      * <p/>
      * NOTE: If the provided key is for a subclass of {@link org.apache.shiro.web.filter.PathMatchingFilter},
      * it will be registered with a proper provider.
      *
      * @param pattern
      * @param keys
      */
     @Deprecated
     @SuppressWarnings("unchecked")
     protected final void addFilterChain(String pattern, Key<? extends Filter>... keys) {
 
         // We need to extract the keys and FilterConfigKey and convert to the new format.
 
         FilterConfig[] filterConfigs = new FilterConfig[keys.length];
         for (int ii = 0; ii < keys.length; ii++) {
             Key<? extends Filter> key = keys[ii];
             // If this is a path matching filter, we need to remember the config
             if (key instanceof FilterConfigKey) {
                 // legacy config
                 FilterConfigKey legacyKey = (FilterConfigKey) key;
                 filterConfigs[ii] = new FilterConfig(legacyKey.getKey(), legacyKey.getConfigValue());
             } else {
                 // Some other type of Filter key, no config
                 filterConfigs[ii] = new FilterConfig(key, "");
             }
         }
 
         filterChains.put(pattern, filterConfigs);
     }
 
     @Deprecated
     protected static <T extends PathMatchingFilter> Key<T> config(Key<T> baseKey, String configValue) {
 
         if (!isGuiceVersion3()) {
             throw new ConfigurationException(
                     "Method ShiroWebModule.config(Key<? extends PathMatchingFilter>,"
                     + " String configValue), is not supported when using Guice 4+");
         }
 
         return new FilterConfigKey<T>(baseKey, configValue);
     }
 
     @Deprecated
     protected static <T extends PathMatchingFilter> Key<T> config(TypeLiteral<T> typeLiteral, String configValue) {
         return config(Key.get(typeLiteral), configValue);
     }
 
     @Deprecated
     protected static <T extends PathMatchingFilter> Key<T> config(Class<T> type, String configValue) {
         return config(Key.get(type), configValue);
     }
 
     @Deprecated
     private static final class FilterConfigKey<T extends PathMatchingFilter> extends Key<T> {
         private Key<T> key;
         private String configValue;
 
         private FilterConfigKey(Key<T> key, String configValue) {
             super();
             this.key = key;
             this.configValue = configValue;
         }
 
         public Key<T> getKey() {
             return key;
         }
 
         public String getConfigValue() {
             return configValue;
         }
     }
 
 }