/*
 * Copyright (c) 2011 Google Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
 * in compliance with the License. You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software distributed under the License
 * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
 * or implied. See the License for the specific language governing permissions and limitations under
 * the License.
 */

package com.google.api.client.extensions.servlet.auth;

import com.google.api.client.extensions.auth.helpers.Credential;
import com.google.api.client.extensions.auth.helpers.ThreeLeggedFlow;
import com.google.api.client.http.HttpResponseException;
import com.google.api.client.http.HttpTransport;
import com.google.api.client.json.JsonFactory;

import java.io.IOException;

import javax.jdo.PersistenceManager;
import javax.jdo.PersistenceManagerFactory;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * Servlet that can be used to invoke and manage a {@link ThreeLeggedFlow} object in the App Engine
 * container. Developers should subclass this to provide the necessary information for their
 * specific use case.
 *
 * @author moshenko@google.com (Jacob Moshenko)
 * @since 1.4
 */
public abstract class AbstractFlowUserServlet extends HttpServlet {

  private static final long serialVersionUID = 1L;

  private final HttpTransport httpTransport;
  private final JsonFactory jsonFactory;

  /**
   * Reserved request context identifier used to store the credential instance in an authorized
   * servlet.
   */
  private static final String AUTH_CREDENTIAL =
      "com.google.api.client.extensions.servlet.auth.credential";

  public AbstractFlowUserServlet() {
    httpTransport = newHttpTransportInstance();
    jsonFactory = newJsonFactoryInstance();
  }

  @Override
  protected void service(HttpServletRequest req, HttpServletResponse resp)
      throws IOException, ServletException {
    PersistenceManager pm = getPersistenceManagerFactory().getPersistenceManager();

    String userId = getUserId();

    ThreeLeggedFlow oauthFlow = newFlow(userId);
    oauthFlow.setJsonFactory(getJsonFactory());
    oauthFlow.setHttpTransport(getHttpTransport());

    try {
      Credential cred = oauthFlow.loadCredential(pm);

      if (cred != null && cred.isInvalid()) {
        pm.deletePersistent(cred);
        cred = null;
      }

      if (cred != null) {
        req.setAttribute(AUTH_CREDENTIAL, cred);
        try {
          // Invoke the user code
          super.service(req, resp);
        } catch (HttpResponseException e) {
          // Normally the response stream is preserved for processing by the user. There is no more
          // user code between this catch block and the servlet container, so we will consume the
          // response stream, which has the side effect of sending the content through any logging
          // mechanisms installed on the response object.
          e.getResponse().ignore();

          // Determine if we failed due to auth, or just failed
          if (cred.isInvalid()) {
            pm.deletePersistent(cred);
            startAuthFlow(resp, pm, oauthFlow);
          } else {
            throw e;
          }
        }
      } else {
        startAuthFlow(resp, pm, oauthFlow);
      }
    } finally {
      pm.close();
    }
  }

  /**
   * Start the auth flow. Don't run any code after this method that will change the response object.
   */
  private void startAuthFlow(
      HttpServletResponse resp, PersistenceManager pm, ThreeLeggedFlow oauthFlow)
      throws IOException {
    pm.makePersistent(oauthFlow);
    String authorizationUrl = oauthFlow.getAuthorizationUrl();
    resp.sendRedirect(authorizationUrl);
  }

  /**
   * Provided for backward compatibility only. User should feel free to override this with their own
   * implementation and call {@link #getCredential(HttpServletRequest)}. This bridge implementation
   * will be removed in 1.6.
   */
  @Override
  protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
    Credential cred = getCredential(req);
    doGetWithCredentials(req, resp, cred);
  }

  /**
   * Fetch a credential associated with this request.
   *
   * @param req Request object to use as context for fetching the credential.
   * @return Credential object for this request and user.
   *
   * @since 1.5
   */
  protected Credential getCredential(HttpServletRequest req) {
    Credential cred = (Credential) req.getAttribute(AUTH_CREDENTIAL);
    return cred;
  }

  /**
   * Return the {@link JsonFactory} instance for this servlet.
   */
  protected final JsonFactory getJsonFactory() {
    return jsonFactory;
  }

  /**
   * Return the {@link HttpTransport} instance for this servlet.
   */
  protected final HttpTransport getHttpTransport() {
    return httpTransport;
  }

  /**
   * Obtain a PersistenceManagerFactory for working with the datastore.
   *
   * @return PersistenceManagerFactory instance.
   */
  protected abstract PersistenceManagerFactory getPersistenceManagerFactory();

  /**
   * Create a flow object which will be used to obtain credentials.
   *
   * @param userId User id to be passed to the constructor of the flow object
   * @return Flow object used to obtain credentials
   */
  protected abstract ThreeLeggedFlow newFlow(String userId) throws IOException;

  /**
   * Create a new {@link HttpTransport} instance. Implementations can create any type of applicable
   * transport and should be as simple as:
   *
   * <pre>
  new NetHttpTransport();
   * </pre>
   *
   * @return {@link HttpTransport} instance for your particular environment
   */
  protected abstract HttpTransport newHttpTransportInstance();

  /**
   * Create a new {@link JsonFactory} instance. Implementations can create any type of applicable
   * json factory and should be as simple as:
   *
   * <pre>
  new JacksonFactory();
   * </pre>
   *
   * @return {@link JsonFactory} instance for your particular environment
   */
  protected abstract JsonFactory newJsonFactoryInstance();

  /**
   * @return Get a string representation of a userId that can be used to associate credentials and
   *         flows with a specific user.
   */
  protected abstract String getUserId();

  /**
   * Entry point for user code.
   *
   * @param req Request object passed to the servlet when invoked.
   * @param resp Response object passed to the servlet when invoked.
   * @param credential Credential which can be used to build a request factory for authenticated
   *        calls.
   * @throws IOException
   *
   * @deprecated Will be removed in 1.6
   */
  @Deprecated
  protected void doGetWithCredentials(
      HttpServletRequest req, HttpServletResponse resp, Credential credential) throws IOException {
    // Intentionally blank
  }
}

@@ -4007,446 +4007,8 @@
  %7D%0A%0A
-  /**%0A   * Provided for backward compatibility only. User should feel free to override this with their own%0A   * implementation and call %7B@link #getCredential(HttpServletRequest)%7D. This bridge implementation%0A   * will be removed in 1.6.%0A   */%0A  @Override%0A  protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException %7B%0A    Credential cred = getCredential(req);%0A    doGetWithCredentials(req, resp, cred);%0A  %7D%0A%0A
   /*
@@ -6111,563 +6111,7 @@
 d();
-%0A%0A  /**%0A   * Entry point for user code.%0A   *%0A   * @param req Request object passed to the servlet when invoked.%0A   * @param resp Response object passed to the servlet when invoked.%0A   * @param credential Credential which can be used to build a request factory for authenticated%0A   *        calls.%0A   * @throws IOException%0A   *%0A   * @deprecated Will be removed in 1.6%0A   */%0A  @Deprecated%0A  protected void doGetWithCredentials(%0A      HttpServletRequest req, HttpServletResponse resp, Credential credential) throws IOException %7B%0A    // Intentionally blank%0A  %7D
 %0A%7D%0A

remove deprecated AbstractFlowUserServlet.doGet and doGetWithCredentials http://codereview.appspot.com/4880042/