package jnpf.flowable.util.filepermission;

import jnpf.flowable.model.filepermission.FilePermissionPolicy.Action;
import jnpf.flowable.model.filepermission.FilePermissionPolicy.Effect;
import jnpf.flowable.model.filepermission.FilePermissionPolicy.Rule;
import java.util.*;

/**
 * 纯规则裁决。调用方必须先按真实实例、执行轮次、人员关系解析适用规则。
 * 不可直接将请求中的规则、版本、人员或布尔权限传入作为可信授权。
 */
public final class FilePermissionEvaluator {
    private FilePermissionEvaluator() { }

    public static final class Result {
        public final long version;
        public final Map<Action, Boolean> actions;
        /** 原因保留到规则 ID；不返回其他参与人的身份。 */
        public final Map<Action, String> reasons;

        private Result(long version, Map<Action, Boolean> actions, Map<Action, String> reasons) {
            this.version = version;
            this.actions = Collections.unmodifiableMap(actions);
            this.reasons = Collections.unmodifiableMap(reasons);
        }
    }

    public static Result evaluate(String formId, String field, long version, boolean transitioning,
            Map<Action, Boolean> nativeUpperBound, Map<Action, Boolean> inherited,
            Collection<Rule> applicableRules) {
        Objects.requireNonNull(formId, "formId");
        Objects.requireNonNull(field, "field");
        Objects.requireNonNull(nativeUpperBound, "nativeUpperBound");
        Objects.requireNonNull(inherited, "inherited");
        Objects.requireNonNull(applicableRules, "applicableRules");
        if (version < 0) throw new IllegalArgumentException("权限版本无效");
        Map<Action, Boolean> actions = new EnumMap<>(Action.class);
        Map<Action, String> reasons = new EnumMap<>(Action.class);
        for (Action action : Action.values()) {
            boolean allow = Boolean.TRUE.equals(inherited.get(action));
            String deniedBy = null;
            for (Rule rule : applicableRules) {
                if (!formId.equals(rule.formId) || !field.equals(rule.field)) continue;
                Effect effect = rule.actions.get(action);
                if (effect == Effect.DENY) {
                    // 顺序不影响裁决和返回原因，便于缓存/审计一致性。
                    if (deniedBy == null || rule.id.compareTo(deniedBy) < 0) deniedBy = rule.id;
                } else if (effect == Effect.ALLOW) allow = true;
            }
            String reason = transitioning ? "TRANSITIONING" : !Boolean.TRUE.equals(nativeUpperBound.get(action))
                    ? "NATIVE_PERMISSION" : deniedBy != null ? "RULE:" + deniedBy : !allow ? "INHERITED_DENY" : null;
            actions.put(action, reason == null);
            if (reason != null) reasons.put(action, reason);
        }
        return new Result(version, actions, reasons);
    }
}