/*
 * (C) Copyright 2006-2008 Nuxeo SAS (http://nuxeo.com/) and contributors.
 *
 * All rights reserved. This program and the accompanying materials
 * are made available under the terms of the GNU Lesser General Public License
 * (LGPL) version 2.1 which accompanies this distribution, and is available at
 * http://www.gnu.org/licenses/lgpl.html
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * Contributors:
 *     bstefanescu
 */
package org.nuxeo.ecm.automation.core.operations.document;

import java.util.Set;

import org.nuxeo.ecm.automation.OperationContext;
import org.nuxeo.ecm.automation.core.Constants;
import org.nuxeo.ecm.automation.core.annotations.Context;
import org.nuxeo.ecm.automation.core.annotations.Operation;
import org.nuxeo.ecm.automation.core.annotations.OperationMethod;
import org.nuxeo.ecm.automation.core.annotations.Param;
import org.nuxeo.ecm.automation.core.util.PrincipalHelper;
import org.nuxeo.ecm.core.api.DocumentModel;
import org.nuxeo.ecm.core.api.security.PermissionProvider;
import org.nuxeo.ecm.platform.usermanager.UserManager;

/**
 * Retrieve the users/groups who have the given permission on given document.
 *
 * @author <a href="mailto:bs@nuxeo.com">Bogdan Stefanescu</a>
 */
@Operation(id = GetDocumentUsersAndGroups.ID, category = Constants.CAT_DOCUMENT, label = "Get Users and Groups", description = ""
        + "Fetch the users and groups that have a given permission "
        + "on the input document and then set them in the context under the "
        + "given key variable name. The operation returns the input "
        + "document. You can later use the list of identifiers set by this "
        + "operation on the context from another operation. The 'key' "
        + "argument represents the variable name and the 'permission' argument "
        + "the permission to check. If the 'ignore groups' argument is false "
        + "then groups will be part of the result. If the 'resolve groups' "
        + "argument is true then groups are recusively resolved, adding "
        + "user members of these groups in place of them. Be <b>warned</b> "
        + "that this may be a very consuming operation. If the 'prefix "
        + "identifiers' argument is true, then user identifiers are "
        + "prefixed by 'user:' and groups identifiers are prefixed by 'group:'.")
public class GetDocumentUsersAndGroups {

    public static final String ID = "Document.GetUsersAndGroups";

    @Context
    protected PermissionProvider permissionProvider;

    @Context
    protected UserManager umgr;

    @Context
    protected OperationContext ctx;

    @Param(name = "permission")
    protected String permission;

    @Param(name = "key")
    protected String key;

    @Param(name = "ignore groups", required = false, values = "false")
    protected boolean ignoreGroups = false;

    @Param(name = "resolve groups", required = false, values = "false")
    protected boolean resolveGroups = false;

    @Param(name = "prefix identifiers", required = false, values = "false")
    protected boolean prefixIds = false;

    @OperationMethod
    public DocumentModel run(DocumentModel input) throws Exception {
        PrincipalHelper ph = new PrincipalHelper(umgr, permissionProvider);
        Set<String> result = ph.getUserAndGroupIdsForPermission(input,
                permission, ignoreGroups, resolveGroups, prefixIds);
        ctx.put(key, result);
        return input;
    }

}

@@ -1115,24 +1115,78 @@
 ipalHelper;%0A
+import org.nuxeo.ecm.automation.core.util.StringList;%0A
 import org.n
@@ -3667,15 +3667,31 @@
 ey, 
+new StringList(
 result)
+)
 ;%0A  

fix type of result when retrieving user/group ids