import groovy.json.JsonOutput
import groovy.transform.Field

import java.sql.Timestamp

import org.slf4j.Logger
import org.slf4j.LoggerFactory

import groovy.json.JsonSlurper

import org.moqui.context.ExecutionContext
import org.moqui.entity.EntityCondition
import org.moqui.entity.EntityFind
import org.moqui.entity.EntityList
import org.moqui.entity.EntityValue

import org.moqui.keycloak.KeycloakToolFactory

import org.keycloak.OAuth2Constants
import org.keycloak.admin.client.Keycloak
import org.keycloak.admin.client.KeycloakBuilder
import org.keycloak.admin.client.resource.ClientResource
import org.keycloak.admin.client.resource.GroupsResource
import org.keycloak.admin.client.resource.RealmResource
import org.keycloak.admin.client.resource.RoleMappingResource
import org.keycloak.admin.client.resource.RoleScopeResource
import org.keycloak.admin.client.resource.RoleResource
import org.keycloak.admin.client.resource.RolesResource
import org.keycloak.admin.client.resource.ServerInfoResource
import org.keycloak.admin.client.resource.UserResource
import org.keycloak.admin.client.resource.UsersResource
import org.keycloak.representations.idm.ClientMappingsRepresentation
import org.keycloak.representations.idm.CredentialRepresentation
import org.keycloak.representations.idm.GroupRepresentation
import org.keycloak.representations.idm.MappingsRepresentation
import org.keycloak.representations.idm.RoleRepresentation
import org.keycloak.representations.idm.UserRepresentation
import org.keycloak.util.JsonSerialization

@Field Logger logger = LoggerFactory.getLogger('KeycloakServices')

Long timestampToKeycloak(Timestamp timestamp) {
    return timestamp.getTime()
}

String keycloakToJson(Object o) {
    return JsonSerialization.writeValueAsString(o)
}

void cleanupKeycloak() {
    Map<String, Object> sharedMap = ec.getContextRoot()
    Keycloak keycloak = sharedMap['keycloak']
    if (keycloak != null) {
        keycloak.close()
    }
    Iterator<String> keyIt = sharedMap.keySet().iterator()
    while (keyIt.hasNext()) {
        String key = keyIt.next()
        if (key == 'keycloak' || key.startsWith('keycloak:')) {
            keyIt.remove()
        }
    }
}

Keycloak getKeycloak() {
    Map<String, Object> sharedMap = ec.getContextRoot()
    KeycloakToolFactory keycloakToolFactory = ec.getFactory().getToolFactory('Keycloak')
    Keycloak keycloak = sharedMap['keycloak']
    if (keycloak == null) {
        keycloak = keycloakToolFactory.getInstance()
        sharedMap['keycloak'] = keycloak
    }
    return keycloak
}

RealmResource getKeycloakRealm() {
    Map<String, Object> sharedMap = ec.getContextRoot()
    RealmResource keycloakRealm = sharedMap['keycloak:realm']
    if (!realm) {
        Keycloak keycloak = getKeycloak()
        KeycloakToolFactory keycloakToolFactory = ec.getFactory().getToolFactory('Keycloak')
        keycloakRealm = keycloak.realm(keycloakToolFactory.getRealmName())
        sharedMap['keycloak:realm'] = keycloakRealm
    }
    return keycloakRealm
}

String getKeycloakClientId() {
    Map<String, Object> sharedMap = ec.getContextRoot()
    String keycloakClientId = sharedMap['keycloak:clientId']
    if (!keycloakClientId) {
        RealmResource keycloakRealm = getKeycloakRealm()
        KeycloakToolFactory keycloakToolFactory = ec.getFactory().getToolFactory('Keycloak')
        keycloakClientId = keycloakRealm.clients().findByClientId(keycloakToolFactory.getClientId()).get(0).getId()
        sharedMap['keycloak:clientId'] = keycloakClientId
    }
    return keycloakClientId
}

ClientResource getKeycloakClient() {
    Map<String, Object> sharedMap = ec.getContextRoot()
    ClientResource keycloakClient = sharedMap['keycloak:client']
    if (!keycloakClient) {
        String keycloakClientId = getKeycloakClientId()
        RealmResource realm = getKeycloakRealm()
        keycloakClient = realm.clients().get(keycloakClientId)
        sharedMap['keycloak:client'] = keycloakClient
    }
    return keycloakClient
}

Map<String, Object> syncUserAccount() {
    String userId = context.userId
    String newPassword = context.newPassword

    try {
        EntityValue userAccount = ec.getEntity().find('UserAccount').condition('userId', userId).one()
        if (!userAccount.username) {
            ec.message.addMessage("Skipping userAccount with empty username: ${userId})")
            return
        }
        RealmResource realmResource = getKeycloakRealm()
        UsersResource usersResource = realmResource.users()

        if (userAccount.externalUserId == null) {
            logger.info("Searching for existing user: ${userAccount.username}")
            List<UserRepresentation> existingByUsername = usersResource.search(userAccount.username, true)
            logger.info("Found: ${existingByUsername}")
            if (!existingByUsername.isEmpty()) {
                // FIXME: disable eeca
                boolean reenableEeca = ec.artifactExecutionFacade.disableEntityEca()
                try {
                    userAccount.externalUserId = existingByUsername[0].getId()
                    userAccount.store()
                } finally {
                    if (reenableEeca) ec.artifactExecutionFacade.enableEntityEca()
                }
            }
        }
        if (userAccount.externalUserId == null) {
            UserRepresentation newKeycloakUser = new UserRepresentation()
            newKeycloakUser.setUsername(userAccount.username)
            newKeycloakUser.setEnabled(false)
            newKeycloakUser.setEmail(userAccount.emailAddress)
            Object response = usersResource.create(newKeycloakUser)
            logger.info("create response: ${keycloakToJson(response)}")
            logger.info("status=${response.status}")
            if (response.status == 201) {
                List<UserRepresentation> newlyCreatedUserList = usersResource.search(userAccount.username)
                if (newlyCreatedUserList.size() == 1) {
                    // FIXME: disable eeca
                    boolean reenableEeca = ec.artifactExecutionFacade.disableEntityEca()
                    try {
                        userAccount.externalUserId = newlyCreatedUserList[0].getId()
                        userAccount.store()
                    } finally {
                        if (reenableEeca) ec.artifactExecutionFacade.enableEntityEca()
                    }
                }
            }
            if (userAccount.externalUserId == null) {
                ec.message.addError("Couldn't create keycloak user for: ${userAccount.username})")
                return
            }
        }
        String keycloakUserId = userAccount.externalUserId
        logger.info("Would update: keycloak(${keycloakUserId})")
        updateUser(keycloakUserId, userId)

        if (newPassword != null) {
            UserResource userResource = usersResource.get(keycloakUserId)
            List<CredentialRepresentation> credentials = userResource.credentials()
            for (CredentialRepresentation credential: credentials) {
                logger.info("keycloak(${keycloakUserId}) credential=${keycloakToJson(credential)}")
            }
            CredentialRepresentation newPasswordRepr = new CredentialRepresentation()
            newPasswordRepr.setType(CredentialRepresentation.PASSWORD)
            newPasswordRepr.setValue(newPassword)
            newPasswordRepr.setTemporary(false)
            userResource.resetPassword(newPasswordRepr)
        }

    } finally {
        cleanupKeycloak()
    }
}

Map<String, Object> updatePasswordInternal() {
    String userId = context.userId
    String newPassword = context.newPassword
    logger.info("updatePasswordInternal: userId:${userId} newPassword:${newPassword}")

    try {
        EntityValue userAccount = ec.getEntity().find('UserAccount').condition('userId', userId).one()
        String keycloakUserId = userAccount.externalUserId
        RealmResource realmResource = getKeycloakRealm()
        UsersResource usersResource = realmResource.users()
        UserResource userResource = usersResource.get(keycloakUserId)
        List<CredentialRepresentation> credentials = userResource.credentials()
        for (CredentialRepresentation credential: credentials) {
            logger.info("keycloak(${keycloakUserId}) credential=${keycloakToJson(credential)}")
        }
        CredentialRepresentation newPasswordRepr = new CredentialRepresentation()
        newPasswordRepr.setType(CredentialRepresentation.PASSWORD)
        newPasswordRepr.setValue(newPassword)
        newPasswordRepr.setTemporary(false)
        userResource.resetPassword(newPasswordRepr)

    } finally {
        cleanupKeycloak()
    }
}

// This does not add in the composite child roles
RoleResource syncUserGroup(String userGroupId) {
    EntityValue userGroup = ec.getEntity().find('UserGroup').condition('userGroupId', userGroupId).one()
    return configureClientRoleResource('UserGroup:' + userGroupId, userGroup.description, null, null)
}


Map<String, Object> syncUserGroup() {
    String userGroupId = context.userGroupId

    try {
        EntityValue userGroup = ec.getEntity().find('UserGroup').condition('userGroupId', userGroupId).one()
        String keycloakRoleName = 'UserGroup:' + userGroupId
        Set<RoleRepresentation> wantedRoles = new HashSet<RoleRepresentation>()

        List<EntityValue> userGroupPermissionList = ec.entity.find('UserGroupPermission')
            .condition('userGroupId', userGroupId)
            .useCache(false)
            .disableAuthz()
            .list()
            .filterByDate('fromDate', 'thruDate', now)

        wantedRoles.addAll(userGroupPermissionList*.userPermissionId.collect { userPermissionId -> syncUserPermission(userPermissionId).toRepresentation() })

        configureClientRoleResource(keycloakRoleName, userGroup.description, wantedRoles, null)
    } finally {
        cleanupKeycloak()
    }

    return [:]
}

RoleRepresentation getClientRoleRepresentation(String roleName) {
    Map<String, Object> sharedMap = ec.getContextRoot()
    if (sharedMap['keycloak:clientRole[' + roleName + ']']) {
        return sharedMap['keycloak:clientRole[' + roleName + ']'].toRepresentation()
    }
    ClientResource clientResource = getKeycloakClient()
    RolesResource rolesResource = clientResource.roles()
    RoleResource roleResource = rolesResource.get(roleName)
    if (roleResource == null) {
        rolesResource.create(new RoleRepresentation(roleName, null, false))
        roleResource = rolesResource.get(roleName)
    }
    return roleResource.toRepresentation()
}

RoleResource configureClientRoleResource(String roleName, String description, Set<RoleRepresentation> wantedRoles, Closure updater) {
    String keycloakClientId = getKeycloakClientId()
    Map<String, Object> sharedMap = ec.getContextRoot()
    if (sharedMap['keycloak:clientRole[' + roleName + ']']) {
        return sharedMap['keycloak:clientRole[' + roleName + ']']
    }
    logger.info("configureClientRoleResource: ${roleName}: ${description}")
    ClientResource clientResource = getKeycloakClient()
    RolesResource rolesResource = clientResource.roles()
    RoleResource roleResource = rolesResource.get(roleName)
    try {
        roleResource.toRepresentation()
    } catch (javax.ws.rs.NotFoundException e) {
        roleResource = null
    }
    //RoleRepresentation roleRepresentation = rolesResource.list(roleName, false)?[0]

    boolean updated = false
    //if (roleRepresentation == null) {
    if (roleResource == null) {
        rolesResource.create(new RoleRepresentation(roleName, description, false))
        roleResource = rolesResource.get(roleName)
        //roleRepresentation = rolesResource.list(roleName, false).get(0)
    }
    RoleRepresentation roleRepresentation = roleResource.toRepresentation()
    if (roleRepresentation.getDescription() != description) {
        roleRepresentation.setDescription(description)
        updated = true
    }
    if (updater) {
        updated |= updater(roleRepresentation)
    }
    if (updated) {
        logger.info("Sending update: ${roleRepresentation}")
        roleResource.update(roleRepresentation)
    }

    if (wantedRoles != null) {
        Set<RoleRepresentation> existingRoles = roleResource.getClientRoleComposites(keycloakClientId)
        Set<RoleRepresentation> toAdd = new HashSet<RoleRepresentation>(wantedRoles)
        toAdd.removeAll(existingRoles)
        Set<RoleRepresentation> toRemove = new HashSet<RoleRepresentation>(existingRoles)
        toRemove.removeAll(wantedRoles)
        if (!toRemove.isEmpty()) {
            roleResource.deleteComposites(toRemove as List)
        }
        if (!wantedRoles.isEmpty()) {
            roleResource.addComposites(wantedRoles as List)
        }
    }
    sharedMap['keycloak:clientRole[' + roleName + ']'] = roleResource
    return roleResource
}

RoleResource syncUserPermission(String userPermissionId) {
    EntityValue userPermission = ec.getEntity().find('UserPermission').condition('userPermissionId', userPermissionId).one()
    return configureClientRoleResource('UserPermission:' + userPermissionId, userPermission.description, null, null)
}

Map<String, Object> syncUserPermission() {
    String userPermissionId = context.userPermissionId

    try {
        syncUserPermission(userPermissionId)
    } finally {
        cleanupKeycloak()
    }

    return [:]
}

RoleResource syncRoleType(String roleTypeId) {
    EntityValue roleType = ec.getEntity().find('RoleType').condition('roleTypeId', roleTypeId).one()
    return configureClientRoleResource('RoleType:' + roleTypeId, roleType.description, null, null)
}

Map<String, Object> syncRoleType() {
    String roleTypeId = context.roleTypeId

    try {
        syncRoleType(roleTypeId)
    } finally {
        cleanupKeycloak()
    }

    return [:]
}

RoleResource syncPartyClassification(String partyClassificationId) {
    EntityValue partyClassification = ec.getEntity().find('PartyClassification').condition('partyClassificationId', partyClassificationId).one()
    return configureClientRoleResource('PartyClassification:' + partyClassificationId, partyClassification.description, null, null)
}

Map<String, Object> syncPartyClassification() {
    String partyClassificationId = context.partyClassificationId

    try {
        syncPartyClassification(partyClassificationId)
    } finally {
        cleanupKeycloak()
    }

    return [:]
}

Map<String, RoleRepresentation> getClientRoles(RealmResource realm, ClientResource clientResource, Collection<String> roleList) {
    //logger.info('keycloak client: ' + keycloakToJson(clientResource))

    logger.info("roleList(${roleList.size()})=${roleList}")
    Map<String, RoleRepresentation> result = [:]

    for (String role: roleList) {
        result[role] = null
    }
    RolesResource rolesResource = clientResource.roles()
    for (RoleRepresentation roleRep: rolesResource.list()) {
        String name = roleRep.getName()
        if (result.containsKey(name)) {
            result[name] = roleRep
        }
    }

    for (Map.Entry<String, RoleRepresentation> resultEntry: result.entrySet()) {
        logger.info("got role mapping: (${resultEntry.getKey()})=(${resultEntry.getValue()})")
    }
    for (Map.Entry<String, RoleRepresentation> resultEntry: result.entrySet()) {
        String name = resultEntry.getKey()
        if (resultEntry.getValue() == null) {
            rolesResource.create(new RoleRepresentation(name, "", false))
            resultEntry.setValue(rolesResource.get(name).toRepresentation())
        }
    }

    return result
}

//    return getKeycloakGroup(realm, "moqui:userGroup:${userGroup.userGroupId}", sync)
//}

void updateUser(String keycloakUserId, String userId) {

    RealmResource realmResource = getKeycloakRealm()
    String keycloakClientId = getKeycloakClientId()
    ClientResource clientResource = getKeycloakClient()

    UsersResource usersResource = realmResource.users()
    UserResource userResource = usersResource.get(keycloakUserId)

    Timestamp now = ec.user.nowTimestamp

    EntityValue userAccount = ec.entity.find('UserAccount').condition('userId', userId).useCache(false).disableAuthz().one()
    String partyId = userAccount.partyId
    EntityValue person = ec.entity.find('Person').condition('partyId', partyId).useCache(false).disableAuthz().one()




    Set<RoleRepresentation> wantedClientRoles = new HashSet<RoleRepresentation>()

    List<EntityValue> userGroupMemberList = ec.entity.find('UserGroupMember')
        .condition('userId', userId)
        .useCache(false)
        .disableAuthz()
        .list()
        .filterByDate('fromDate', 'thruDate', now)
    Set<String> userGroupIds = new HashSet<String>(userGroupMemberList*.userGroupId)
    logger.info("userGroupIds: ${userGroupIds}")
    userGroupIds.add('ALL_USERS')
    wantedClientRoles.addAll(userGroupIds.collect { userGroupId -> syncUserGroup(userGroupId).toRepresentation() })

    UserRepresentation userRep = userResource.toRepresentation()
    Map<String, List<String>> attributes = new HashMap(userRep.getAttributes() ?: [:])

    attributes['moqui:now'] = [now.toString()]


    logger.info("user[$userId]} attributes: " + attributes)
    userRep.setAttributes(attributes)
    if (person) {
        userRep.setFirstName(person.firstName)
        userRep.setLastName(person.lastName)
    }

    List<RoleRepresentation> toRemove = []
    RoleMappingResource roleMappingResource = userResource.roles()
    ClientMappingsRepresentation clientMappingsRespresentation = roleMappingResource.getAll().getClientMappings()?[keycloakClientId]
    for (RoleRepresentation existingRoleRep: clientMappingsRespresentation?.getMappings()) {
        if (!wantedClientRoles.remove(existingRoleRep.getName())) {
            toRemove.add(existingRoleRep)
        }
    }
    List<RoleRepresentation> toAdd = wantedClientRoles as List
    logger.info("roles to remove: ${toRemove}")
    logger.info("roles to add: ${toAdd}")
    RoleScopeResource clientRoleScopeResource = roleMappingResource.clientLevel(keycloakClientId)
    clientRoleScopeResource.remove(toRemove)
    clientRoleScopeResource.add(toAdd)
    userRep.setEnabled("N".equals(userAccount.disabled))

    userResource.update(userRep)
}