package be.mentoringsystems.merke.presentation.rest;

import be.mentoringsystems.merke.model.QueryParams;
import be.mentoringsystems.merke.model.db.Login;
import be.mentoringsystems.merke.model.dto.ApiDTO;
import be.mentoringsystems.merke.model.dto.LoginDTO;
import be.mentoringsystems.merke.model.dto.PagedListDTO;
import be.mentoringsystems.merke.model.dto.View;
import be.mentoringsystems.merke.security.JWSHelper;
import be.mentoringsystems.merke.service.LoginService;
import com.fasterxml.jackson.annotation.JsonView;
import java.util.UUID;
import javax.servlet.http.HttpServletRequest;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.validation.BindingResult;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseStatus;
import org.springframework.web.bind.annotation.RestController;

/**
 *
 * @author anthonyarents
 */
@RestController
@RequestMapping("/logins")
public class LoginController {

    @Autowired
    private LoginService loginService;

    @RequestMapping(value = "/authenticate", method = RequestMethod.POST)
    public ApiDTO authenticate(@RequestParam(required = false) final String username, @RequestParam(required = false) final String password, final HttpServletRequest hsr) {
        final ApiDTO dto = ApiDTO.error();

        String session = JWSHelper.getJwsSubject(hsr);
        Login login = null;
        if (session == null) {
            login = loginService.getCurrentLogin();
        } else {
            login = loginService.getByUsername(session);
        }
        if (login == null) {
            login = loginService.getByUsernameAndPassword(username, password);
        }

        if (login != null) {
            String jws = JWSHelper.generateJwsWithSubject(login.getUsername());
            login.setJwt(jws);
            dto.setData(login);
            dto.setSuccess(Boolean.TRUE);
        }

        return dto;
    }

    @PreAuthorize("hasRole('ROLE_ADMIN')")
    @RequestMapping(value = "/{id}", method = RequestMethod.DELETE)
    @ResponseStatus(HttpStatus.OK)
    public ApiDTO deleteById(@PathVariable final UUID id) {
        loginService.delete(id);
        return new ApiDTO();
    }

    @PreAuthorize("hasRole('ROLE_ADMIN')")
    @JsonView(View.Login.class)
    @RequestMapping(value = "/{id}", method = RequestMethod.PUT)
    @ResponseStatus(HttpStatus.OK)
    public ApiDTO updateById(@PathVariable final UUID id, @RequestBody @Validated final LoginDTO dto, final BindingResult bindingResult) {
        if (bindingResult.hasErrors()) {
            return ApiDTO.error();
        }
        dto.setId(id);
        final Login result = loginService.save(dto);
        return new ApiDTO(result);
    }

    @PreAuthorize("@methodSecurity.hasLoginAccess(#id)")
    @JsonView(View.Login.class)
    @RequestMapping(value = "/gdprCheck", method = RequestMethod.POST)
    @ResponseStatus(HttpStatus.OK)
    public ApiDTO gdprCheck(@RequestParam final UUID id) {
        Login login = loginService.getCurrentLogin();
        if (login != null && login.getId().equals(id)) {
            login.setGdprCheck(true);
            loginService.save(login);
            return new ApiDTO();
        } else {
            return ApiDTO.error();
        }
    }

    @PreAuthorize("@methodSecurity.hasLoginAccess(#id)")
    @JsonView(View.Login.class)
    @RequestMapping(value = "/updatepicture", method = RequestMethod.POST)
    @ResponseStatus(HttpStatus.OK)
    public ApiDTO updatepicture(@RequestParam final UUID id, @RequestParam final UUID pictureId) {
        Login login = loginService.getCurrentLogin();
        if (login.getId().equals(id)) {
            login.setPictureId(pictureId);
            loginService.save(login);
        } else {
            LoginDTO dto = new LoginDTO();
            dto.setId(id);
            dto.setPictureId(pictureId);
            login = loginService.save(dto);
        }
        return new ApiDTO(login);
    }

    @JsonView(View.Login.class)
    @PreAuthorize("hasRole('ROLE_ADMIN')")
    @RequestMapping(value = "", method = RequestMethod.POST)
    @ResponseStatus(HttpStatus.CREATED)
    public ApiDTO createNew(@RequestBody @Validated final LoginDTO dto, final BindingResult bindingResult) {
        if (bindingResult.hasErrors()) {
            return ApiDTO.error();
        }
        final Login result = loginService.save(dto);
        return new ApiDTO(result);
    }

    @JsonView(View.Login.class)
    @PreAuthorize("hasRole('ROLE_ADMIN')")
    @RequestMapping(value = "/{id}", method = RequestMethod.GET)
    public ApiDTO getById(@PathVariable final UUID id) {
        final Login result = loginService.getById(id);
        return new ApiDTO(result);
    }

    @JsonView(View.Login.class)
    @PreAuthorize("hasRole('ROLE_ADMIN')")
    @RequestMapping(value = "", method = RequestMethod.GET)
    public PagedListDTO getAll(final QueryParams queryParams) {
        return loginService.getAllDTO(queryParams);
    }
}