/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *     http://www.apache.org/licenses/LICENSE-2.0
    *
    * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  package org.acegisecurity.concurrent;
  
  import org.acegisecurity.AcegiMessageSource;
  import org.acegisecurity.Authentication;
  import org.acegisecurity.AuthenticationException;
  
  import org.springframework.beans.factory.InitializingBean;
  
  import org.springframework.context.MessageSource;
  import org.springframework.context.MessageSourceAware;
  import org.springframework.context.support.MessageSourceAccessor;
  
  import org.springframework.util.Assert;
  
  
  /**
   * Base implementation of {@link ConcurrentSessionControllerImpl} which prohibits simultaneous logins.<p>By default
   * uses {@link SessionRegistryImpl}, although any <code>SessionRegistry</code> may be used.</p>
   *
   * @author Ben Alex
   * @version $Id: ConcurrentSessionControllerImpl.java 2279 2007-12-02 03:00:26Z benalex $
   */
  public class ConcurrentSessionControllerImpl implements ConcurrentSessionController, InitializingBean,
      MessageSourceAware {
      //~ Instance fields ================================================================================================
  
      protected MessageSourceAccessor messages = AcegiMessageSource.getAccessor();
      private SessionRegistry sessionRegistry;
      private boolean exceptionIfMaximumExceeded = false;
      private int maximumSessions = 1;
  
      //~ Methods ========================================================================================================
  
      public void afterPropertiesSet() throws Exception {
          Assert.notNull(sessionRegistry, "SessionRegistry required");
          Assert.isTrue(maximumSessions != 0,
              "MaximumLogins must be either -1 to allow unlimited logins, or a positive integer to specify a maximum");
          Assert.notNull(this.messages, "A message source must be set");
      }
  
      /**
       * Allows subclasses to customise behaviour when too many sessions are detected.
       *
       * @param sessionId the session ID of the present request
       * @param sessions either <code>null</code> or all unexpired sessions associated with the principal
       * @param allowableSessions DOCUMENT ME!
       * @param registry an instance of the <code>SessionRegistry</code> for subclass use
       *
       * @throws ConcurrentLoginException DOCUMENT ME!
       */
      protected void allowableSessionsExceeded(String sessionId, SessionInformation[] sessions, int allowableSessions,
          SessionRegistry registry) {
          if (exceptionIfMaximumExceeded || (sessions == null)) {
              throw new ConcurrentLoginException(messages.getMessage("ConcurrentSessionControllerImpl.exceededAllowed",
                      new Object[] {new Integer(allowableSessions)},
                      "Maximum sessions of {0} for this principal exceeded"));
          }
  
          // Determine least recently used session, and mark it for invalidation
          SessionInformation leastRecentlyUsed = null;
  
          for (int i = 0; i < sessions.length; i++) {
              if ((leastRecentlyUsed == null)
                      || sessions[i].getLastRequest().before(leastRecentlyUsed.getLastRequest())) {
                  leastRecentlyUsed = sessions[i];
              }
          }
  
          leastRecentlyUsed.expireNow();
      }
  
      public void checkAuthenticationAllowed(Authentication request)
          throws AuthenticationException {
          Assert.notNull(request, "Authentication request cannot be null (violation of interface contract)");
  
          Object principal = SessionRegistryUtils.obtainPrincipalFromAuthentication(request);
          String sessionId = SessionRegistryUtils.obtainSessionIdFromAuthentication(request);
  
          SessionInformation[] sessions = sessionRegistry.getAllSessions(principal, false);
  
          int sessionCount = 0;
  
          if (sessions != null) {
              sessionCount = sessions.length;
         }
 
         int allowableSessions = getMaximumSessionsForThisUser(request);
         Assert.isTrue(allowableSessions != 0, "getMaximumSessionsForThisUser() must return either -1 to allow "
                 + "unlimited logins, or a positive integer to specify a maximum");
 
         if (sessionCount < allowableSessions) {
             // They haven't got too many login sessions running at present
             return;
         } else if (allowableSessions == -1) {
             // We permit unlimited logins
             return;
         } else if (sessionCount == allowableSessions) {
             // Only permit it though if this request is associated with one of the sessions
             for (int i = 0; i < sessionCount; i++) {
                 if (sessions[i].getSessionId().equals(sessionId)) {
                     return;
                 }
             }
         }
 
         allowableSessionsExceeded(sessionId, sessions, allowableSessions, sessionRegistry);
     }
 
     /**
      * Method intended for use by subclasses to override the maximum number of sessions that are permitted for
      * a particular authentication. The default implementation simply returns the <code>maximumSessions</code> value
      * for the bean.
      *
      * @param authentication to determine the maximum sessions for
      *
      * @return either -1 meaning unlimited, or a positive integer to limit (never zero)
      */
     protected int getMaximumSessionsForThisUser(Authentication authentication) {
         return maximumSessions;
     }
 
     public void registerSuccessfulAuthentication(Authentication authentication) {
         Assert.notNull(authentication, "Authentication cannot be null (violation of interface contract)");
 
         Object principal = SessionRegistryUtils.obtainPrincipalFromAuthentication(authentication);
         String sessionId = SessionRegistryUtils.obtainSessionIdFromAuthentication(authentication);
 
         sessionRegistry.registerNewSession(sessionId, principal);
     }
 
     public void setExceptionIfMaximumExceeded(boolean exceptionIfMaximumExceeded) {
         this.exceptionIfMaximumExceeded = exceptionIfMaximumExceeded;
     }
 
     public void setMaximumSessions(int maximumSessions) {
         this.maximumSessions = maximumSessions;
     }
 
     public void setMessageSource(MessageSource messageSource) {
         this.messages = new MessageSourceAccessor(messageSource);
     }
 
     public void setSessionRegistry(SessionRegistry sessionRegistry) {
         this.sessionRegistry = sessionRegistry;
     }
 }