// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements.  See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership.  The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.acl;

import java.util.ArrayList;
import java.util.List;

import javax.inject.Inject;

import org.apache.log4j.Logger;

import org.apache.cloudstack.iam.api.AclGroup;
import org.apache.cloudstack.iam.api.AclPolicy;
import org.apache.cloudstack.iam.api.AclPolicyPermission;
import org.apache.cloudstack.iam.api.IAMService;

import com.cloud.user.Account;
import com.cloud.utils.component.AdapterBase;

public class RoleBasedEntityQuerySelector extends AdapterBase implements QuerySelector {

    private static final Logger s_logger = Logger.getLogger(RoleBasedEntityQuerySelector.class.getName());

    @Inject
    IAMService _iamService;

    @Override
    public List<Long> getAuthorizedDomains(Account caller, String action) {
        long accountId = caller.getAccountId();
        // Get the static Policies of the Caller
        List<AclPolicy> policies = _iamService.listAclPolicies(accountId);
        // for each policy, find granted permission with Domain scope
        List<Long> domainIds = new ArrayList<Long>();
        for (AclPolicy policy : policies) {
            List<AclPolicyPermission> pp = _iamService.listPolicyPermissionsByScope(policy.getId(), action, PermissionScope.DOMAIN.toString());
            if (pp != null) {
                for (AclPolicyPermission p : pp) {
                    if (p.getScopeId() != null) {
                        domainIds.add(p.getScopeId());
                    }
                }
            }
        }
        return domainIds;
    }

    @Override
    public List<Long> getAuthorizedAccounts(Account caller, String action) {
        long accountId = caller.getAccountId();
        // Get the static Policies of the Caller
        List<AclPolicy> policies = _iamService.listAclPolicies(accountId);
        // for each policy, find granted permission with Account scope
        List<Long> accountIds = new ArrayList<Long>();
        for (AclPolicy policy : policies) {
            List<AclPolicyPermission> pp = _iamService.listPolicyPermissionsByScope(policy.getId(), action, PermissionScope.ACCOUNT.toString());
            if (pp != null) {
                for (AclPolicyPermission p : pp) {
                    if (p.getScopeId() != null) {
                        accountIds.add(p.getScopeId());
                    }
                }
            }
        }
        return accountIds;
    }

    @Override
    public List<Long> getAuthorizedResources(Account caller, String action) {
        long accountId = caller.getAccountId();
        // Get the static Policies of the Caller
        List<AclPolicy> policies = _iamService.listAclPolicies(accountId);

        // add the policies that grant recursive access
        List<AclGroup> groups = _iamService.listAclGroups(caller.getId());
        for (AclGroup group : groups) {
            // for each group find the grand parent groups.
            List<AclGroup> parentGroups = _iamService.listParentAclGroups(group.getId());
            for (AclGroup parentGroup : parentGroups) {
                policies.addAll(_iamService.listRecursiveAclPoliciesByGroup(parentGroup.getId()));
            }
        }

        // for each policy, find granted permission with Resource scope
        List<Long> entityIds = new ArrayList<Long>();
        for (AclPolicy policy : policies) {
            List<AclPolicyPermission> pp = _iamService.listPolicyPermissionsByScope(policy.getId(), action, PermissionScope.RESOURCE.toString());
            if (pp != null) {
                for (AclPolicyPermission p : pp) {
                    if (p.getScopeId() != null) {
                        entityIds.add(p.getScopeId());
                    }
                }
            }
        }
        return entityIds;
    }

    @Override
    public boolean isGrantedAll(Account caller, String action) {
        long accountId = caller.getAccountId();
        // Get the static Policies of the Caller
        List<AclPolicy> policies = _iamService.listAclPolicies(accountId);
        // for each policy, find granted permission with ALL scope
        for (AclPolicy policy : policies) {
            List<AclPolicyPermission> pp = _iamService.listPolicyPermissionsByScope(policy.getId(), action, PermissionScope.ALL.toString());
            if (pp != null && pp.size() > 0) {
                return true;
            }
        }
        return false;
    }

    @Override
    public List<String> listAclGroupsByAccount(long accountId) {
        List<AclGroup> groups = _iamService.listAclGroups(accountId);
        List<String> groupNames = new ArrayList<String>();
        for (AclGroup grp : groups) {
            groupNames.add(grp.getName());
        }
        return groupNames;
    }

}

@@ -2161,32 +2161,198 @@
 Id() != null) %7B%0A
+                        if (p.getScopeId().longValue() == -1) %7B%0A                            domainIds.add(caller.getDomainId());%0A                        %7D else %7B%0A    
                 
@@ -2382,32 +2382,58 @@
 .getScopeId());%0A
+                        %7D%0A
                 
@@ -3214,32 +3214,193 @@
 Id() != null) %7B%0A
+                        if (p.getScopeId().longValue() == -1) %7B%0A                            accountIds.add(caller.getId());%0A                        %7D else %7B%0A    
                 
@@ -3431,32 +3431,58 @@
 .getScopeId());%0A
+                        %7D%0A
                 

Handle scopeId=-1 properly, which indicates current caller domain or account.