const AllowAccess = "allow"

const DenyAccess = "deny"

var (
    // ErrRequestDenied is returned when an access request can not be satisfied by any policy.
    ErrRequestDenied = &errorWithContext{
        error:  errors.New("Request was denied by default"),
        code:   http.StatusForbidden,
        status: http.StatusText(http.StatusForbidden),
        reason: "The request was denied because no matching policy was found.",
    }

    // ErrRequestForcefullyDenied is returned when an access request is explicitly denied by a policy.
    ErrRequestForcefullyDenied = &errorWithContext{
        error:  errors.New("Request was forcefully denied"),
        code:   http.StatusForbidden,
        status: http.StatusText(http.StatusForbidden),
        reason: "The request was denied because a policy denied request.",
    }

    // ErrNotFound is returned when a resource can not be found.
    ErrNotFound = &errorWithContext{
        error:  errors.New("Resource could not be found"),
        code:   http.StatusNotFound,
        status: http.StatusText(http.StatusNotFound),
    }
)

var ConditionFactories = map[string]func() Condition{
    new(StringEqualCondition).GetName(): func() Condition {
        return new(StringEqualCondition)
    },
    new(CIDRCondition).GetName(): func() Condition {
        return new(CIDRCondition)
    },
    new(EqualsSubjectCondition).GetName(): func() Condition {
        return new(EqualsSubjectCondition)
    },
    new(StringPairsEqualCondition).GetName(): func() Condition {
        return new(StringPairsEqualCondition)
    },
    new(StringMatchCondition).GetName(): func() Condition {
        return new(StringMatchCondition)
    },
    new(ResourceContainsCondition).GetName(): func() Condition {
        return new(ResourceContainsCondition)
    },
}

var DefaultAuditLogger = &AuditLoggerNoOp{}

var DefaultMatcher = NewRegexpMatcher(512)

var TestManagerPolicies = []*DefaultPolicy{
    {
        ID:          uuid.New(),
        Description: "description",
        Subjects:    []string{"user", "anonymous"},
        Effect:      AllowAccess,
        Resources:   []string{"article", "user"},
        Actions:     []string{"create", "update"},
        Conditions:  Conditions{},
    },
    {
        ID:          uuid.New(),
        Description: "description",
        Subjects:    []string{},
        Effect:      AllowAccess,
        Resources:   []string{"<article|user>"},
        Actions:     []string{"view"},
        Conditions:  Conditions{},
    },
    {
        ID:          uuid.New(),
        Description: "description",
        Subjects:    []string{},
        Effect:      AllowAccess,
        Resources:   []string{},
        Actions:     []string{"view"},
        Conditions:  Conditions{},
    },
    {
        ID:          uuid.New(),
        Description: "description",
        Subjects:    []string{},
        Effect:      AllowAccess,
        Resources:   []string{},
        Actions:     []string{},
        Conditions:  Conditions{},
    },
    {
        ID:          uuid.New(),
        Description: "description",
        Subjects:    []string{},
        Effect:      AllowAccess,
        Resources:   []string{"foo"},
        Actions:     []string{},
        Conditions:  Conditions{},
    },
    {
        ID:          uuid.New(),
        Description: "description",
        Subjects:    []string{"foo"},
        Effect:      AllowAccess,
        Resources:   []string{"foo"},
        Actions:     []string{},
        Conditions:  Conditions{},
    },
    {
        ID:          uuid.New(),
        Description: "description",
        Subjects:    []string{"foo"},
        Effect:      AllowAccess,
        Resources:   []string{},
        Actions:     []string{},
        Conditions:  Conditions{},
    },
    {
        ID:          uuid.New(),
        Description: "description",
        Effect:      AllowAccess,
        Conditions:  Conditions{},
    },
    {
        ID:          uuid.New(),
        Description: "description",
        Subjects:    []string{"<peter|max>"},
        Effect:      DenyAccess,
        Resources:   []string{"article", "user"},
        Actions:     []string{"view"},
        Conditions: Conditions{
            "owner": &EqualsSubjectCondition{},
        },
    },
    {
        ID:          uuid.New(),
        Description: "description",
        Subjects:    []string{"<user|max|anonymous>", "peter"},
        Effect:      DenyAccess,
        Resources:   []string{".*"},
        Actions:     []string{"disable"},
        Conditions: Conditions{
            "ip": &CIDRCondition{
                CIDR: "1234",
            },
            "owner": &EqualsSubjectCondition{},
        },
    },
    {
        ID:          uuid.New(),
        Description: "description",
        Subjects:    []string{"<.*>"},
        Effect:      AllowAccess,
        Resources:   []string{"<article|user>"},
        Actions:     []string{"view"},
        Conditions: Conditions{
            "ip": &CIDRCondition{
                CIDR: "1234",
            },
            "owner": &EqualsSubjectCondition{},
        },
    },
    {
        ID:          uuid.New(),
        Description: "description",
        Subjects:    []string{"<us[er]+>"},
        Effect:      AllowAccess,
        Resources:   []string{"<article|user>"},
        Actions:     []string{"view"},
        Conditions: Conditions{
            "ip": &CIDRCondition{
                CIDR: "1234",
            },
            "owner": &EqualsSubjectCondition{},
        },
    },

    {
        ID:          uuid.New(),
        Description: "A failed policy",
        Subjects:    []string{"supplier"},
        Effect:      AllowAccess,
        Resources:   []string{"product:<.*>"},
        Actions:     []string{"update"},
        Conditions:  Conditions{},
    },
    {
        ID:          uuid.New(),
        Description: "Another failed policy",
        Subjects:    []string{"buyer"},
        Effect:      AllowAccess,
        Resources:   []string{"products:attributeGroup:<.*>"},
        Actions:     []string{"create"},
        Conditions:  Conditions{},
    },
}

type AuditLogger interface {
    LogRejectedAccessRequest(request *Request, pool Policies, deciders Policies)
    LogGrantedAccessRequest(request *Request, pool Policies, deciders Policies)
}

type AuditLoggerInfo struct {
    Logger *log.Logger
}

type AuditLoggerNoOp struct{}

type BooleanCondition struct {
    BooleanValue bool `json:"value"`
}

type CIDRCondition struct {
    CIDR string `json:"cidr"`
}

type Condition interface {
    // GetName returns the condition's name.
    GetName() string

    // Fulfills returns true if the request is fulfilled by the condition.
    Fulfills(interface{}, *Request) bool
}

type Conditions map[string]Condition

type Context map[string]interface{}

type DefaultPolicy struct {
    ID          string     `json:"id" gorethink:"id"`
    Description string     `json:"description" gorethink:"description"`
    Subjects    []string   `json:"subjects" gorethink:"subjects"`
    Effect      string     `json:"effect" gorethink:"effect"`
    Resources   []string   `json:"resources" gorethink:"resources"`
    Actions     []string   `json:"actions" gorethink:"actions"`
    Conditions  Conditions `json:"conditions" gorethink:"conditions"`
    Meta        []byte     `json:"meta" gorethink:"meta"`
}

type EqualsSubjectCondition struct{}

type Ladon struct {
    Manager     Manager
    Matcher     matcher
    AuditLogger AuditLogger
}

type Manager interface {

    // Create persists the policy.
    Create(policy Policy) error

    // Update updates an existing policy.
    Update(policy Policy) error

    // Get retrieves a policy.
    Get(id string) (Policy, error)

    // Delete removes a policy.
    Delete(id string) error

    // GetAll retrieves all policies.
    GetAll(limit, offset int64) (Policies, error)

    // FindRequestCandidates returns candidates that could match the request object. It either returns
    // a set that exactly matches the request, or a superset of it. If an error occurs, it returns nil and
    // the error.
    FindRequestCandidates(r *Request) (Policies, error)

    // FindPoliciesForSubject returns policies that could match the subject. It either returns
    // a set of policies that applies to the subject, or a superset of it.
    // If an error occurs, it returns nil and the error.
    FindPoliciesForSubject(subject string) (Policies, error)

    // FindPoliciesForResource returns policies that could match the resource. It either returns
    // a set of policies that apply to the resource, or a superset of it.
    // If an error occurs, it returns nil and the error.
    FindPoliciesForResource(resource string) (Policies, error)
}

type ManagerMigrator interface {
    Create(policy Policy) (err error)
    Migrate() (err error)
    GetManager() Manager
}

type Policies []Policy

type Policy interface {
    // GetID returns the policies id.
    GetID() string

    // GetDescription returns the policies description.
    GetDescription() string

    // GetSubjects returns the policies subjects.
    GetSubjects() []string

    // AllowAccess returns true if the policy effect is allow, otherwise false.
    AllowAccess() bool

    // GetEffect returns the policies effect which might be 'allow' or 'deny'.
    GetEffect() string

    // GetResources returns the policies resources.
    GetResources() []string

    // GetActions returns the policies actions.
    GetActions() []string

    // GetConditions returns the policies conditions.
    GetConditions() Conditions

    // GetMeta returns the policies arbitrary metadata set by the user.
    GetMeta() []byte

    // GetStartDelimiter returns the delimiter which identifies the beginning of a regular expression.
    GetStartDelimiter() byte

    // GetEndDelimiter returns the delimiter which identifies the end of a regular expression.
    GetEndDelimiter() byte
}

type RegexpMatcher struct {
    *lru.Cache

    C   map[string]*regexp.Regexp
}

type Request struct {
    // Resource is the resource that access is requested to.
    Resource string `json:"resource"`

    // Action is the action that is requested on the resource.
    Action string `json:"action"`

    // Subejct is the subject that is requesting access.
    Subject string `json:"subject"`

    // Context is the request's environmental context.
    Context Context `json:"context"`
}

type ResourceContainsCondition struct{}

type StringEqualCondition struct {
    Equals string `json:"equals"`
}

type StringMatchCondition struct {
    Matches string `json:"matches"`
}

type StringPairsEqualCondition struct{}

type Warden interface {
    // IsAllowed returns nil if subject s can perform action a on resource r with context c or an error otherwise.
    //  if err := guard.IsAllowed(&Request{Resource: "article/1234", Action: "update", Subject: "peter"}); err != nil {
    //    return errors.New("Not allowed")
    //  }
    IsAllowed(r *Request) error
}