/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *     http://www.apache.org/licenses/LICENSE-2.0
    *
    * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  package org.acegisecurity.ui;
  
  import org.acegisecurity.AccessDeniedException;
  import org.acegisecurity.AcegiSecurityException;
  import org.acegisecurity.AuthenticationException;
  import org.acegisecurity.AuthenticationTrustResolver;
  import org.acegisecurity.AuthenticationTrustResolverImpl;
  import org.acegisecurity.InsufficientAuthenticationException;
  
  import org.acegisecurity.context.SecurityContextHolder;
  
  import org.acegisecurity.ui.savedrequest.SavedRequest;
  
  import org.acegisecurity.util.PortResolver;
  import org.acegisecurity.util.PortResolverImpl;
  
  import org.apache.commons.logging.Log;
  import org.apache.commons.logging.LogFactory;
  
  import org.springframework.beans.factory.InitializingBean;
  import org.springframework.context.ApplicationContext;
  
  import org.springframework.util.Assert;
  
  import java.io.IOException;
  import java.util.Map;
  
  import javax.servlet.Filter;
  import javax.servlet.FilterChain;
  import javax.servlet.FilterConfig;
  import javax.servlet.ServletException;
  import javax.servlet.ServletRequest;
  import javax.servlet.ServletResponse;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  
  /**
   * Handles any <code>AccessDeniedException</code> and <code>AuthenticationException</code> thrown within the
   * filter chain.
   * <p>
   * This filter is necessary because it provides the bridge between Java exceptions and HTTP responses.
   * It is solely concerned with maintaining the user interface. This filter does not do any actual security enforcement.
   * </p>
   * <p>
   * If an {@link AuthenticationException} is detected, the filter will launch the <code>authenticationEntryPoint</code>.
   * This allows common handling of authentication failures originating from any subclass of
   * {@link org.acegisecurity.intercept.AbstractSecurityInterceptor}.
   * </p>
   * <p>
   * If an {@link AccessDeniedException} is detected, the filter will determine whether or not the user is an anonymous
   * user. If they are an anonymous user, the <code>authenticationEntryPoint</code> will be launched. If they are not
   * an anonymous user, the filter will delegate to the {@link org.acegisecurity.ui.AccessDeniedHandler}.
   * By default the filter will use {@link org.acegisecurity.ui.AccessDeniedHandlerImpl}.
   * </p>
   * <p>
   * To use this filter, it is necessary to specify the following properties:
   * </p>
   * <ul>
   * <li><code>authenticationEntryPoint</code> indicates the handler that
   * should commence the authentication process if an
   * <code>AuthenticationException</code> is detected. Note that this may also
   * switch the current protocol from http to https for an SSL login.</li>
   * <li><code>portResolver</code> is used to determine the "real" port that a
   * request was received on.</li>
   * </ul>
   * <P>
   * <B>Do not use this class directly.</B> Instead configure
   * <code>web.xml</code> to use the {@link
   * org.acegisecurity.util.FilterToBeanProxy}.
   * </p>
   *
   * @author Ben Alex
   * @author colin sampaleanu
   * @version $Id: ExceptionTranslationFilter.java 2134 2007-09-19 16:41:06Z luke_t $
   */
  public class ExceptionTranslationFilter implements Filter, InitializingBean {
  
      //~ Static fields/initializers =====================================================================================
  
  	private static final Log logger = LogFactory.getLog(ExceptionTranslationFilter.class);
  
  	//~ Instance fields ================================================================================================
  
      private AccessDeniedHandler accessDeniedHandler = new AccessDeniedHandlerImpl();
 	private AuthenticationEntryPoint authenticationEntryPoint;
 	private AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl();
 	private PortResolver portResolver = new PortResolverImpl();
 	private boolean createSessionAllowed = true;
 
 	//~ Methods ========================================================================================================
 
 	public void afterPropertiesSet() throws Exception {
 		Assert.notNull(authenticationEntryPoint, "authenticationEntryPoint must be specified");
 		Assert.notNull(portResolver, "portResolver must be specified");
 		Assert.notNull(authenticationTrustResolver, "authenticationTrustResolver must be specified");
 	}
 
 	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
 			ServletException {
 		if (!(request instanceof HttpServletRequest)) {
 			throw new ServletException("HttpServletRequest required");
 		}
 
 		if (!(response instanceof HttpServletResponse)) {
 			throw new ServletException("HttpServletResponse required");
 		}
 
 		try {
 			chain.doFilter(request, response);
 
 			if (logger.isDebugEnabled()) {
 				logger.debug("Chain processed normally");
 			}
 		}
 		catch (AuthenticationException ex) {
 			handleException(request, response, chain, ex);
 		}
 		catch (AccessDeniedException ex) {
 			handleException(request, response, chain, ex);
 		}
 		catch (ServletException ex) {
 			if (ex.getRootCause() instanceof AuthenticationException
 					|| ex.getRootCause() instanceof AccessDeniedException) {
 				handleException(request, response, chain, (AcegiSecurityException) ex.getRootCause());
 			}
 			else {
 				throw ex;
 			}
 		}
 		catch (IOException ex) {
 			throw ex;
 		}
 	}
 
 	public AuthenticationEntryPoint getAuthenticationEntryPoint() {
 		return authenticationEntryPoint;
 	}
 
 	public AuthenticationTrustResolver getAuthenticationTrustResolver() {
 		return authenticationTrustResolver;
 	}
 
 	public PortResolver getPortResolver() {
 		return portResolver;
 	}
 
 	private void handleException(ServletRequest request, ServletResponse response, FilterChain chain,
 			AcegiSecurityException exception) throws IOException, ServletException {
 		if (exception instanceof AuthenticationException) {
 			if (logger.isDebugEnabled()) {
 				logger.debug("Authentication exception occurred; redirecting to authentication entry point", exception);
 			}
 
 			sendStartAuthentication(request, response, chain, (AuthenticationException) exception);
 		}
 		else if (exception instanceof AccessDeniedException) {
 			if (authenticationTrustResolver.isAnonymous(SecurityContextHolder.getContext().getAuthentication())) {
 				if (logger.isDebugEnabled()) {
 					logger.debug("Access is denied (user is anonymous); redirecting to authentication entry point",
 							exception);
 				}
 
 				sendStartAuthentication(request, response, chain, new InsufficientAuthenticationException(
 						"Full authentication is required to access this resource"));
 			}
 			else {
 				if (logger.isDebugEnabled()) {
 					logger.debug("Access is denied (user is not anonymous); delegating to AccessDeniedHandler",
 							exception);
 				}
 
 				accessDeniedHandler.handle(request, response, (AccessDeniedException) exception);
 			}
 		}
 	}
 
 	/**
 	 * If <code>true</code>, indicates that <code>SecurityEnforcementFilter</code> is permitted to store the target
 	 * URL and exception information in the <code>HttpSession</code> (the default).
      * In situations where you do not wish to unnecessarily create <code>HttpSession</code>s - because the user agent
      * will know the failed URL, such as with BASIC or Digest authentication - you may wish to
 	 * set this property to <code>false</code>. Remember to also set the
 	 * {@link org.acegisecurity.context.HttpSessionContextIntegrationFilter#allowSessionCreation}
 	 * to <code>false</code> if you set this property to <code>false</code>.
 	 *
 	 * @return <code>true</code> if the <code>HttpSession</code> will be
 	 * used to store information about the failed request, <code>false</code>
 	 * if the <code>HttpSession</code> will not be used
 	 */
 	public boolean isCreateSessionAllowed() {
 		return createSessionAllowed;
 	}
 
 	protected void sendStartAuthentication(ServletRequest request, ServletResponse response, FilterChain chain,
 			AuthenticationException reason) throws ServletException, IOException {
 		HttpServletRequest httpRequest = (HttpServletRequest) request;
 
 		SavedRequest savedRequest = new SavedRequest(httpRequest, portResolver);
 
 		if (logger.isDebugEnabled()) {
 			logger.debug("Authentication entry point being called; SavedRequest added to Session: " + savedRequest);
 		}
 
 		if (createSessionAllowed) {
 			// Store the HTTP request itself. Used by AbstractProcessingFilter
 			// for redirection after successful authentication (SEC-29)
 			httpRequest.getSession().setAttribute(AbstractProcessingFilter.ACEGI_SAVED_REQUEST_KEY, savedRequest);
 		}
 
 		// SEC-112: Clear the SecurityContextHolder's Authentication, as the
 		// existing Authentication is no longer considered valid
 		SecurityContextHolder.getContext().setAuthentication(null);
 
 		authenticationEntryPoint.commence(httpRequest, (HttpServletResponse) response, reason);
 	}
 
 	public void setAccessDeniedHandler(AccessDeniedHandler accessDeniedHandler) {
 		Assert.notNull(accessDeniedHandler, "AccessDeniedHandler required");
 		this.accessDeniedHandler = accessDeniedHandler;
 	}
 
 	public void setAuthenticationEntryPoint(AuthenticationEntryPoint authenticationEntryPoint) {
 		this.authenticationEntryPoint = authenticationEntryPoint;
 	}
 
 	public void setAuthenticationTrustResolver(AuthenticationTrustResolver authenticationTrustResolver) {
 		this.authenticationTrustResolver = authenticationTrustResolver;
 	}
 
 	public void setCreateSessionAllowed(boolean createSessionAllowed) {
 		this.createSessionAllowed = createSessionAllowed;
 	}
 
 	public void setPortResolver(PortResolver portResolver) {
 		this.portResolver = portResolver;
 	}
 
     public void init(FilterConfig filterConfig) throws ServletException {
     }
 
     public void destroy() {
     }    
 }