/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *  http://www.apache.org/licenses/LICENSE-2.0
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
package org.apache.gravitino.server.web.filter.authorization;

import java.lang.reflect.Parameter;
import java.util.Arrays;
import java.util.Map;
import java.util.Optional;
import org.apache.commons.lang3.StringUtils;
import org.apache.gravitino.Entity;
import org.apache.gravitino.NameIdentifier;
import org.apache.gravitino.authorization.Privilege;
import org.apache.gravitino.server.authorization.annotations.ExpressionCondition;
import org.apache.gravitino.server.authorization.expression.AuthorizationExpressionEvaluator;
import org.apache.gravitino.server.web.filter.ParameterUtil;

/**
 * Authorization executor for load table operations.
 *
 * <p>This executor uses secondaryExpression and secondaryExpressionCondition from the annotation to
 * determine authorization: if the condition is met (e.g., client requests MODIFY_TABLE privilege),
 * the secondaryExpression is used for stricter authorization, otherwise the default expression is
 * used (e.g., SELECT_TABLE).
 *
 * <p><b>Security Limitation:</b> This is a trust-based model. The client declares intended
 * privileges, and the server trusts this declaration without validation. A malicious or modified
 * client could request only SELECT_TABLE privileges to bypass MODIFY_TABLE authorization checks.
 * Legacy clients without the `privileges` parameter will use default authorization.
 */
public class LoadTableAuthorizationExecutor extends CommonAuthorizerExecutor {
  public LoadTableAuthorizationExecutor(
      Parameter[] parameters,
      Object[] args,
      String expression,
      Map<Entity.EntityType, NameIdentifier> metadataContext,
      Map<String, Object> pathParams,
      Optional<String> entityType,
      String secondaryExpression,
      ExpressionCondition secondaryExpressionCondition) {
    super(expression, metadataContext, pathParams, entityType);

    if (!shouldCheckModifyTablePrivilege(secondaryExpression, secondaryExpressionCondition)) {
      return;
    }

    String privileges = (String) ParameterUtil.extractFromParameters(parameters, args);
    if (containsModifyTablePrivilege(privileges)) {
      this.expression = secondaryExpression;
      this.authorizationExpressionEvaluator =
          new AuthorizationExpressionEvaluator(secondaryExpression);
    }
  }

  private static boolean shouldCheckModifyTablePrivilege(
      String secondaryExpression, ExpressionCondition secondaryExpressionCondition) {
    return StringUtils.isNotBlank(secondaryExpression)
        && secondaryExpressionCondition == ExpressionCondition.REQUIRED_MODIFY_PRIVILEGES;
  }

  private static boolean containsModifyTablePrivilege(String privileges) {
    if (StringUtils.isBlank(privileges)) {
      return false;
    }

    return Arrays.stream(privileges.split(","))
        .map(String::trim)
        .filter(StringUtils::isNotBlank)
        .map(Privilege.Name::valueOf)
        .anyMatch(Privilege.Name.MODIFY_TABLE::equals);
  }
}
