package com.yahoo.vespa.hosted.controller.security;

import com.google.inject.Inject;
import com.yahoo.config.provision.ApplicationId;
import com.yahoo.config.provision.TenantName;
import com.yahoo.vespa.hosted.controller.Application;
import com.yahoo.vespa.hosted.controller.api.integration.organization.Marketplace;
import com.yahoo.vespa.hosted.controller.api.integration.user.UserId;
import com.yahoo.vespa.hosted.controller.api.integration.user.UserManagement;
import com.yahoo.vespa.hosted.controller.api.integration.user.UserRoles;
import com.yahoo.vespa.hosted.controller.api.role.ApplicationRole;
import com.yahoo.vespa.hosted.controller.api.role.Role;
import com.yahoo.vespa.hosted.controller.api.role.Roles;
import com.yahoo.vespa.hosted.controller.api.role.TenantRole;
import com.yahoo.vespa.hosted.controller.tenant.CloudTenant;
import com.yahoo.vespa.hosted.controller.tenant.Tenant;

import java.util.Collections;
import java.util.List;

/**
 * @author jonmv
 */
public class CloudAccessControl implements AccessControl {

    private final Marketplace marketplace;
    private final UserManagement userManagement;
    private final Roles roles;
    private final UserRoles userRoles;

    @Inject
    public CloudAccessControl(Marketplace marketplace, UserManagement userManagement, Roles roles) {
        this.marketplace = marketplace;
        this.userManagement = userManagement;
        this.roles = roles;
        this.userRoles = new UserRoles(roles);
    }

    @Override
    public CloudTenant createTenant(TenantSpec tenantSpec, Credentials credentials, List<Tenant> existing) {
        CloudTenantSpec spec = (CloudTenantSpec) tenantSpec;
        CloudTenant tenant = new CloudTenant(spec.tenant(), marketplace.resolveCustomer(spec.getRegistrationToken()));

        Role ownerRole = roles.tenantOwner(spec.tenant());
        userManagement.createRole(ownerRole);
        userManagement.addUsers(ownerRole, List.of(new UserId(credentials.user().getName())));

        return tenant;
    }

    @Override
    public Tenant updateTenant(TenantSpec tenantSpec, Credentials credentials, List<Tenant> existing, List<Application> applications) {
        throw new UnsupportedOperationException("Update is not supported here, as it would entail changing the tenant name.");
    }

    @Override
    public void deleteTenant(TenantName tenant, Credentials credentials) {
        // Probably terminate customer subscription?

        for (TenantRole role : userRoles.tenantRoles(tenant))
            userManagement.deleteRole(role);
    }

    @Override
    public void createApplication(ApplicationId application, Credentials credentials) {
        Role ownerRole = roles.applicationAdmin(application.tenant(), application.application());
        userManagement.createRole(ownerRole);
        userManagement.addUsers(ownerRole, List.of(new UserId(credentials.user().getName())));
    }

    @Override
    public void deleteApplication(ApplicationId id, Credentials credentials) {
        for (ApplicationRole role : userRoles.applicationRoles(id.tenant(), id.application()))
            userManagement.deleteRole(role);
    }

    @Override
    public List<Tenant> accessibleTenants(List<Tenant> tenants, Credentials credentials) {
        // TODO: Get credential things (token with roles or something) and check what it's good for.
        // TODO  ... or ignore this here, and compute it somewhere else.
        return Collections.emptyList();
    }

}

@@ -1787,34 +1787,38 @@
         
-Role ownerRole = r
+for (Role role : userR
 oles.ten
@@ -1824,13 +1824,13 @@
 nant
-Owner
+Roles
 (spe
@@ -1840,18 +1840,22 @@
 enant())
-;%0A
+)%0A    
         
@@ -1872,38 +1872,33 @@
 ment.createRole(
-ownerR
+r
 ole);%0A        us
@@ -1915,33 +1915,56 @@
 nt.addUsers(
-ownerRole
+roles.tenantOwner(spec.tenant())
 , List.of(ne
@@ -2639,27 +2639,18 @@
 ationId 
-application
+id
 , Creden
@@ -2682,81 +2682,67 @@
     
-Role ownerRole = roles.applicationAdmin(application.tenant(), application
+for (Role role : userRoles.applicationRoles(id.tenant(), id
 .app
@@ -2752,26 +2752,27 @@
 ation())
-;%0A
+)%0A 
         
 userMana
@@ -2755,32 +2755,35 @@
 on()))%0A         
+   
 userManagement.c
@@ -2792,22 +2792,17 @@
 ateRole(
-ownerR
+r
 ole);%0A  
@@ -2835,17 +2835,61 @@
 ers(
-ownerRole
+roles.applicationAdmin(id.tenant(), id.application())
 , Li

Create all tenant and application roles on creation