/*
 * JOnAS: Java(TM) Open Application Server
 * Copyright (C) 1999 Bull S.A.
 * Contact: jonas-team@objectweb.org
 * 
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or any later version.
 * 
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 * 
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
 * USA
 *
 * --------------------------------------------------------------------------
 * $Id$
 * --------------------------------------------------------------------------
 */

package org.objectweb.jonas.security;

import java.util.Hashtable;
import java.security.Guard;
import java.security.Principal;
import org.objectweb.security.context.SecurityContext;
import org.objectweb.security.context.SecurityCurrent;
import org.objectweb.jonas.common.Log;
import org.objectweb.util.monolog.api.Logger;
import org.objectweb.util.monolog.api.BasicLevel;

/**
 * @author Jeff Mesnil
 * Contributor(s): 
 */

public class MethodGuard implements Guard, java.io.Serializable {

    static private Logger logger = null;
    
    // list of method signatures identifying the methods to guard.
    private Hashtable methods = new Hashtable();

    private String containerName = null;

    public MethodGuard (String containerName) {
 	this.containerName = containerName;
        if(logger == null)
            logger = Log.getLogger(Log.JONAS_SECURITY_PREFIX);
    }

    public void add(String methodSignature, String[] roles) {
	logger.log(BasicLevel.DEBUG, "entering for "+methodSignature);
	methods.put(methodSignature, roles);
    }
    
    public void checkGuard(Object methodSignature) throws SecurityException {
	logger.log(BasicLevel.DEBUG, "entering");
	boolean isAuthorized = false;
	String[] roles = (String[])methods.get(methodSignature);

	//if no roles, everyone can access the method
	if (roles.length == 0) {
	    logger.log(BasicLevel.DEBUG, "access to method not protected");
	    return;
	}

	// verify if principal has at least one of the roles
	SecurityCurrent current = SecurityCurrent.getCurrent();
	SecurityContext ctx = current.getSecurityContext();
	if (ctx == null) {
            logger.log(BasicLevel.ERROR, "no security context exists");
	    throw new SecurityException("no security context exists");
	}
	Principal principal = ctx.getCallerPrincipal();
	RoleMechanism roleMechanism =  RoleMechanism.getInstance();
	isAuthorized = roleMechanism.isCallerInRoles(principal, roles);
	if (!isAuthorized) {
	    logger.log(BasicLevel.DEBUG, "not authorized to access Method");
	    throw new SecurityException("caller not authorized to access the method");
	}
	logger.log(BasicLevel.DEBUG, "authorized to access Method");
	return;
    }

    public String toString() {
 	return "MethodGuard of container : "+ containerName;
    }
}
