/*  Copyright (c) 2000, 2002 by Oracle Corporation. All Rights Reserved. */

package oracle.portal.provider.v1.http; 

import oracle.portal.provider.v1.PortletSecurityManager; 
import oracle.portal.provider.v1.Portlet; 
import oracle.portal.provider.v1.Provider; 
import oracle.portal.provider.v1.ProviderUser; 
import oracle.portal.provider.v1.ProviderSession; 
import oracle.portal.provider.v1.PortletReference; 

/**
 * <p><b> URLSecurityManager </b> determines if the user has
 * right permissions for viewing the portlet. It allows the user
 * if the portlet he/she is trying to view is publicly accessible
 * i.e., with &lt;accessControl>public.&lt;accessControl>. Else a check for
 * authorization is made. Otherwise, permission will be given only if he/she
 * is having valid credentials.
 * <p>
 *
 * @see PortletSecurityManager 
 */
public class URLSecurityManager implements PortletSecurityManager 
{ 
    
    //Value of <authorizType> from XML File.
    private String mAuthorizType = null; 
    
    //Debug Level
    private int debugLevel = 0; 
    
    /*
     * set method for <authorizType> tag in provider.xml
     * @param at contains, value of authorizType from XML file
     */
    public void setAuthorizType(String at) 
    { 
        mAuthorizType = at; 
    } 
    
    /*
     * get method for <authorizType> tag in provider.xml
     */
    public String getAuthorizType() 
    { 
        return mAuthorizType; 
    } 
    
    /**
     *  Verifies whether the user is authorized to use this Portlet. That is
     *  does this user have the necessary privileges to create, get, copy, and
     *  destroy instances of this Portlet.
     *
     *  @param  p the portlet which we want to authorize access to.
     *  @param  user the current user we are being asked to authorize.
     *  @return true is this user is authorized to access this portlet.
     */
    public boolean hasAccess(Portlet p, ProviderUser user) 
    { 
        boolean returnValue = true; 
        Provider provider = p.getProvider(); 
        
        //Read debug level from zone.properties.
        debugLevel = UrlServicesUtils.readDebugLevel(provider); 
        UrlServicesUtils.logMessage(provider,"Entering URLSecurityManager hasAccess(Portlet,ProviderUser) *****************",debugLevel, UrlServicesUtils.BASIC_LOGGING); 
        if (getAuthorizType().equals(UrlServicesUtils.REGISTERED_AUTHTYPE)) 
        { 
            ServletProviderUser sProviderUser = (ServletProviderUser)user; 
            String accessControl = ((URLPortlet)p).getAccessControl(); 
            UrlServicesUtils.logMessage(provider, "hasAccess : Access Control = "+ 
            accessControl, debugLevel); 
            Boolean isUserRegistered = Boolean.TRUE;
            ProviderSession session = sProviderUser.getSession(); 
            if (session != null && 
                session.getAttribute(UrlServicesUtils.REGISTERED_FLAG) != null) 
            { 
                isUserRegistered= 
                (Boolean)session.getAttribute(UrlServicesUtils.REGISTERED_FLAG); 
            } 
            UrlServicesUtils.logMessage(p.getProvider(), 
            "URLSecurityManager:hasAccess(Portlet).Register user servlet session value :"+ 
            isUserRegistered,debugLevel); 
            
            // Check for registered_user boolean value
            // If user is a registered user then we can display all portlets
            // and we have no need check for portlet access control flag
            // But if user is non register user
            // Show only those portlets which have access control of public set
            if (isUserRegistered.booleanValue() == false) 
            { 
                if (accessControl.equals(UrlServicesUtils.PUBLIC_PORTLET)) 
                { 
                    UrlServicesUtils.logMessage(p.getProvider(), 
                    
                    "URLSecurityManager:hasAccess(Portlet). non-registered user & public access control. Returning true", 
                    debugLevel); 
                    returnValue = true; 
                } 
                else  
                { 
                    UrlServicesUtils.logMessage(p.getProvider(), 
                    "URLSecurityManager:hasAccess(Portlet). non-registered user & registered access control. Returning false.", 
                    debugLevel); 
                    returnValue = false; 
                } 
            } 
            else  
            { 
                UrlServicesUtils.logMessage(p.getProvider(), 
                "URLSecurityManager:hasAccess(Portlet). registered user. Returning true.", 
                debugLevel); 
                returnValue = true; 
            } 
        } // End of check for whether registered user or not
        UrlServicesUtils.logMessage(p.getProvider(), 
        "URLSecurityManager:hasAccess(Portlet). Auhtorize Type Is non registered, Returning " + returnValue,debugLevel); 
        return returnValue; 
    } 
    
    /**
     *  Verifies whether the user is authorized to use this particular portlet
     *  instance.  Generally, this check will only be made of the default instance
     *  as it is assumed you cannot be denied access to the default while having
     *  access to the customized instance, and in turn must always have access
     *  to your customized version if you have access to the default. However,
     *  if asked to authorize a particular instance the PortletNotFoundException
     *  should be thrown if that instance doesn't exist (even if the default does).
     *
     *  @param  ref portlet reference that identifies the instant
     *  @param  user the current user we are being asked to authorize.
     *  @return true is this user is authorized to access this portlet instance.
     */
    public boolean hasAccess(PortletReference pref, ProviderUser user) 
    { 
        boolean returnValue = true; 
        Provider provider = pref.getProvider(); 
        
        //Read debug level from zone.properties.
        debugLevel = UrlServicesUtils.readDebugLevel(provider); 
        UrlServicesUtils.logMessage(provider,"Entering URLSecurityManager hasAccess(PortletReference,ProviderUser) *****************",debugLevel, UrlServicesUtils.BASIC_LOGGING); 
        returnValue = hasAccess(pref.getPortlet(),user); 
        UrlServicesUtils.logMessage(provider,"URLSecurityManager:hasAccess(PortletReference: Return Value being returned" + returnValue,debugLevel); 
        return returnValue; 
    } 
} 