/**
 * Yona, 21st Century Project Hosting SW
 * <p>
 * Copyright Yona & Yobi Authors & NAVER Corp.
 * https://yona.io
 **/
package controllers;

import com.avaje.ebean.ExpressionList;
import com.avaje.ebean.Page;
import com.avaje.ebean.annotation.Transactional;
import com.fasterxml.jackson.databind.node.ObjectNode;
import com.feth.play.module.mail.Mailer;
import com.feth.play.module.mail.Mailer.Mail;
import com.feth.play.module.mail.Mailer.Mail.Body;
import com.feth.play.module.pa.PlayAuthenticate;
import controllers.annotation.AnonymousCheck;
import jxl.write.WriteException;
import models.*;
import models.enumeration.Operation;
import models.enumeration.UserState;
import models.support.LdapUser;
import org.apache.commons.lang3.ArrayUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.crypto.RandomNumberGenerator;
import org.apache.shiro.crypto.SecureRandomNumberGenerator;
import org.apache.shiro.crypto.hash.Sha256Hash;
import org.apache.shiro.util.ByteSource;
import org.joda.time.LocalDateTime;
import play.Configuration;
import play.Logger;
import play.Play;
import play.data.Form;
import play.i18n.Messages;
import play.libs.Json;
import play.mvc.BodyParser;
import play.mvc.Controller;
import play.mvc.Http;
import play.mvc.Http.Cookie;
import play.mvc.Result;
import utils.*;
import views.html.user.*;

import javax.naming.AuthenticationException;
import javax.naming.CommunicationException;
import javax.naming.NamingException;
import java.io.IOException;
import java.util.*;

import static com.feth.play.module.mail.Mailer.getEmailName;
import static models.NotificationMail.isAllowedEmailDomains;
import static play.data.Form.form;
import static play.libs.Json.toJson;
import static utils.HtmlUtil.defaultSanitize;
import static utils.LdapService.FALLBACK_TO_LOCAL_LOGIN;

public class UserApp extends Controller {
    public static final String SESSION_USERID = "userId";
    public static final String SESSION_LOGINID = "loginId";
    public static final String SESSION_USERNAME = "userName";
    public static final String SESSION_KEY = "key";
    public static final String TOKEN = "yobi.token";
    public static final String TOKEN_SEPARATOR = ":";
    public static final int TOKEN_LENGTH = 2;
    public static final int MAX_AGE = 30*24*60*60;
    public static final String DEFAULT_AVATAR_URL
            = routes.Assets.at("images/default-avatar-128.png").url();
    private static final int AVATAR_FILE_LIMIT_SIZE = 1024*1000*1; //1M
    public static final int MAX_FETCH_USERS = 10;  //Match value to Typeahead deafult value at yobi.ui.Typeaheds.js
    private static final int HASH_ITERATIONS = 1024;
    public static final int DAYS_AGO = 14;
    public static final int UNDEFINED = 0;
    public static final String DAYS_AGO_COOKIE = "daysAgo";
    public static final String DEFAULT_GROUP = "own";
    public static final String DEFAULT_SELECTED_TAB = "projects";
    public static final String TOKEN_USER = "TOKEN_USER";
    public static final String USER_TOKEN_HEADER = "Yona-Token";

    public static final boolean useSocialLoginOnly = play.Configuration.root()
            .getBoolean("application.use.social.login.only", false);
    public static final String FLASH_MESSAGE_KEY = "message";
    public static final String FLASH_ERROR_KEY = "error";
    private static boolean usingEmailVerification = play.Configuration.root()
            .getBoolean("application.use.email.verification", false);

    @AnonymousCheck
    public static Result users(String query) {
        String referer = StringUtils.defaultString(request().getHeader("referer"), "");
        if (!referer.endsWith("members") || !request().accepts("application/json")) {
            return status(Http.Status.NOT_ACCEPTABLE);
        }

        if(StringUtils.isEmpty(query)){
            return ok(toJson(new ArrayList<>()));
        }

        List<Map<String, String>> users = new ArrayList<>();
        ExpressionList<User> el = User.find.select("loginId, name").where()
            .ne("state", UserState.DELETED).disjunction();
        el.icontains("loginId", query);
        el.icontains("name", query);
        el.endJunction();

        int total = el.findRowCount();
        if (total > MAX_FETCH_USERS) {
            el.setMaxRows(MAX_FETCH_USERS);
            response().setHeader("Content-Range", "items " + MAX_FETCH_USERS + "/" + total);
        }

        for (User user : el.findList()) {
            StringBuilder sb = new StringBuilder();
            sb.append(String.format("<img class='mention_image' src='%s'>", user.avatarUrl()));
            sb.append(String.format("<b class='mention_name'>%s</b>", user.name));
            sb.append(String.format("<span class='mention_username'> @%s</span>", user.loginId));

            Map<String, String> userMap = new HashMap<>();
            userMap.put("info", sb.toString());
            userMap.put("loginId", user.loginId);
            users.add(userMap);
        }

        return ok(toJson(users));
    }

    public static void noCache(final Http.Response response) {
        // http://stackoverflow.com/questions/49547/making-sure-a-web-page-is-not-cached-across-all-browsers
        response.setHeader(Http.Response.CACHE_CONTROL, "no-cache, no-store, must-revalidate");  // HTTP 1.1
        response.setHeader(Http.Response.PRAGMA, "no-cache");  // HTTP 1.0.
        response.setHeader(Http.Response.EXPIRES, "0");  // Proxies.
    }

    public static Result loginForm() {
        noCache(response());
        if(!UserApp.currentUser().isAnonymous()) {
            return redirect(routes.Application.index());
        }

        String redirectUrl = request().getQueryString("redirectUrl");
        String loginFormUrl = routes.UserApp.loginForm().url();
        String referer = request().getHeader("Referer");
        if(StringUtils.isEmpty(redirectUrl) && !StringUtils.equals(loginFormUrl, referer)) {
            redirectUrl = request().getHeader("Referer");
        }

        //Assume oAtuh is passed but not linked with existed account
        if(PlayAuthenticate.isLoggedIn(session())){
            UserApp.linkWithExistedOrCreateLocalUser();
            return redirect(redirectUrl);
        } else {
            return ok(views.html.user.login.render("title.login", form(AuthInfo.class), redirectUrl));
        }
    }

    public static Result logout() {
        processLogout();
        flash(Constants.SUCCESS, "user.logout.success");
        String redirectUrl = request().getHeader("Referer");
        return redirect(redirectUrl);
    }

    public static Result login() {
        noCache(response());
        if(useSocialLoginOnly){
            flash(FLASH_ERROR_KEY,
                    Messages.get("app.warn.support.social.login.only"));
            return Application.index();
        }
        if (HttpUtil.isJSONPreferred(request())) {
            return loginByAjaxRequest();
        } else {
            return loginByFormRequest();
        }
    }

    /**
     * Process login in general case of request.
     *
     * Returns:
     * - If "signup.require.confirm = true" has enabled in application.conf,
     *   the user in state of locked(or unconfirmed) cannot be logged in.
     *   and page will be redirected to login form with message "user.locked".
     *
     * - If "signup.require.confirm" is disabled(as default),
     *   the user in state of locked can be logged in. (TODO: check this in feature specification).
     *
     * - If failed to authentication, redirect to login form with error message.
     *
     * Cookie for login will be created
     * if success to authenticate with request.
     *
     * If "rememberMe" included in request,
     * Cookie for "rememberMe" (which means "Stay logged in") will be create
     * separate from login cookie.
     *
     * @return
     */
    private static Result loginByFormRequest() {
        Form<AuthInfo> authInfoForm = form(AuthInfo.class).bindFromRequest();

        if(authInfoForm.hasErrors()) {
            flash(Constants.WARNING, "user.login.required");
            return badRequest(login.render("title.login", authInfoForm, null));
        }

        User sourceUser = User.findByLoginKey(authInfoForm.get().loginIdOrEmail);

        if (isUsingSignUpConfirm()) {
            if (User.findByLoginId(sourceUser.loginId).state == UserState.LOCKED) {
                flash(Constants.WARNING, "user.locked");
                return redirect(getLoginFormURLWithRedirectURL());
            }
        }

        if (User.findByLoginId(sourceUser.loginId).state == UserState.DELETED) {
            flash(Constants.WARNING, "user.deleted");
            return redirect(getLoginFormURLWithRedirectURL());
        }

        User authenticate = User.anonymous;
        if (LdapService.useLdap) {
            authenticate =  authenticateWithLdap(authInfoForm.get().loginIdOrEmail, authInfoForm.get().password);
        } else {
            authenticate = authenticateWithPlainPassword(sourceUser.loginId, authInfoForm.get().password);
        }

        if (!authenticate.isAnonymous()) {
            authenticate.refresh();
        }

        if(authenticate.isLocked()){
            flash(Constants.WARNING, "user.locked");
            return logout();
        }
        if (!authenticate.isAnonymous()) {
            addUserInfoToSession(authenticate);

            if (authInfoForm.get().rememberMe) {
                setupRememberMe(authenticate);
            }

            authenticate.lang = play.mvc.Http.Context.current().lang().code();
            authenticate.update();

            String redirectUrl = getRedirectURLFromParams();

            if(StringUtils.isEmpty(redirectUrl)){
                return redirect(routes.Application.index());
            } else {
                return redirect(encodedPath(redirectUrl));
            }
        }

        flash(Constants.WARNING, "user.login.invalid");
        return redirect(getLoginFormURLWithRedirectURL());
    }

    private static String encodedPath(String path){
        String[] paths = path.split("/");
        if(paths.length == 0){
            return "/";
        }
        String[] encodedPaths = new String[paths.length];
        for (int i=0; i< paths.length; i++) {
            encodedPaths[i] = HttpUtil.encodeUrlString(paths[i]);
        }
        return String.join("/", encodedPaths);
    }

    /**
     * Process login request by AJAX
     *
     * Almost same with loginByFormRequest
     * except part of handle with "redirectUrl" has excluded.
     *
     * Returns:
     * - In case of success: empty JSON string {}
     * - In case of failed: error message as JSON string in form of {"message":"cause"}.
     *
     * @return
     */
    private static Result loginByAjaxRequest() {
        Form<AuthInfo> authInfoForm = form(AuthInfo.class).bindFromRequest();

        if(authInfoForm.hasErrors()) {
            return badRequest(getObjectNodeWithMessage("user.login.required"));
        }

        User sourceUser = User.findByLoginKey(authInfoForm.get().loginIdOrEmail);

        if (isUsingSignUpConfirm()) {
            if (User.findByLoginId(sourceUser.loginId).state == UserState.LOCKED) {
                return forbidden(getObjectNodeWithMessage("user.locked"));
            }
        }

        if (User.findByLoginId(sourceUser.loginId).state == UserState.DELETED) {
            return notFound(getObjectNodeWithMessage("user.deleted"));
        }

        User user = User.anonymous;
        if (LdapService.useLdap) {
            user =  authenticateWithLdap(authInfoForm.get().loginIdOrEmail, authInfoForm.get().password);
        } else {
            user = authenticateWithPlainPassword(sourceUser.loginId, authInfoForm.get().password);
        }

        if(user.isLocked()){
            return forbidden(getObjectNodeWithMessage("user.locked"));
        }

        if (!user.isAnonymous()) {
            if (authInfoForm.get().rememberMe) {
                setupRememberMe(user);
            }

            user.refresh();
            user.lang = play.mvc.Http.Context.current().lang().code();
            user.update();
            addUserInfoToSession(user);

            return ok("{}");
        }

        return forbidden(getObjectNodeWithMessage("user.login.invalid"));
    }

    /**
     * Get value of "redirectUrl" from query
     * @return
     */
    private static String getRedirectURLFromParams(){
        Map<String, String[]> params = request().body().asFormUrlEncoded();
        return HttpUtil.getFirstValueFromQuery(params, "redirectUrl");
    }

    /**
     * Get login form URL string with "redirectUrl" parameter in query
     * @return
     */
    private static String getLoginFormURLWithRedirectURL(){
        String redirectUrl = getRedirectURLFromParams();
        String loginFormUrl = routes.UserApp.loginForm().url();
        loginFormUrl = loginFormUrl + "?redirectUrl=" + redirectUrl;

        return loginFormUrl;
    }

    /**
     * Returns ObjectNode which has "message" node filled with {@code message}
     * loginByAjaxRequest() uses this to return result as JSON string
     *
     * @param message
     * @return
     */
    private static ObjectNode getObjectNodeWithMessage(String message){
        ObjectNode result = Json.newObject();
        result.put("message", message);
        return result;
    }

    public static User authenticateWithHashedPassword(String loginId, String password) {
        return authenticate(loginId, password, true);
    }

    public static User authenticateWithPlainPassword(String loginId, String password) {
        return authenticate(loginId, password, false);
    }

    public static Result signupForm() {
        if(!UserApp.currentUser().isAnonymous()) {
            return redirect(routes.Application.index());
        }

        return ok(signup.render("title.signup", form(User.class)));
    }

    @Transactional
    public static Result newUser() {
        Form<User> newUserForm = form(User.class).bindFromRequest();
        validate(newUserForm);
        if (newUserForm.hasErrors()) {
            return badRequest(signup.render("title.signup", newUserForm));
        }

        if (!isAllowedEmailDomains(newUserForm.get().email)) {
            flash(Constants.INFO, "user.unacceptable.email.domain");
            play.Logger.warn("Signup rejected: " + newUserForm.get().name + " with " + newUserForm.get().email);
            return badRequest(signup.render("title.signup", newUserForm));
        }

        User user = createNewUser(newUserForm.get());
        if (isUsingEmailVerification()) {
            if (isAllowedEmailDomains(user.email)) {
                flash(Constants.INFO, "user.verification.mail.sent");
            } else {
                flash(Constants.INFO, "user.unacceptable.email.domain");
            }
        }
        if (user.state == UserState.LOCKED && isUsingSignUpConfirm()) {
            flash(Constants.INFO, "user.signup.requested");
        } else {
            addUserInfoToSession(user);
        }
        return redirect(routes.Application.index());
    }

    private static String newLoginIdWithoutDup(final String candidate, int num) {
        String newLoginIdSuggestion = candidate + "" + num;
        if(User.findByLoginId(newLoginIdSuggestion).isAnonymous()){
            return newLoginIdSuggestion;
        } else {
            num = num + 1;
            return newLoginIdWithoutDup(newLoginIdSuggestion, num);
        }
    }

    public static User createLocalUserWithOAuth(UserCredential userCredential){
        if(userCredential.email == null || "null".equalsIgnoreCase(userCredential.email)) {
            flash(FLASH_ERROR_KEY,
                    Messages.get("app.warn.cannot.access.email.information"));
            play.Logger.error("Cannot confirm email address of " + userCredential.id + ": " + userCredential.name);
            userCredential.delete();
            forceOAuthLogout();
            return User.anonymous;
        }

        if (!isAllowedEmailDomains(userCredential.email)) {
            flash(Constants.INFO, "user.unacceptable.email.domain");
            play.Logger.warn("Signup rejected: " + userCredential.name + " with " + userCredential.email);
            userCredential.delete();
            forceOAuthLogout();
            return User.anonymous;
        }
        CandidateUser candidateUser = new CandidateUser(userCredential.name, userCredential.email);
        User created = createUserDelegate(candidateUser);

        // checking is delegated to oAuth
        created.refresh();
        created.state = UserState.ACTIVE;
        created.update();

        //Also, update userCredential
        userCredential.loginId = created.loginId;
        userCredential.user = created;
        userCredential.update();

        return created;
    }

    private static void forceOAuthLogout() {
        session().put("pa.url.orig", routes.Application.oAuthLogout().url());
    }

    private static User createUserDelegate(CandidateUser candidateUser) {
        String loginIdCandidate = candidateUser.getLoginId();

        User user = new User();

        if (StringUtils.isBlank(loginIdCandidate) || LdapService.USE_EMAIL_BASE_LOGIN) {
            loginIdCandidate = candidateUser.getEmail().substring(0, candidateUser.getEmail().indexOf("@"));
            loginIdCandidate = generateLoginId(user, loginIdCandidate);
        }

        user.loginId = loginIdCandidate;
        user.name = candidateUser.getName();
        user.email = candidateUser.getEmail();

        if(StringUtils.isEmpty(candidateUser.getPassword())){
            user.password = (new SecureRandomNumberGenerator()).nextBytes().toBase64();  // random password because created with OAuth
        } else {
            user.password = candidateUser.getPassword();
        }

        user.isGuest = candidateUser.isGuest();
        return createNewUser(user);
    }

    public static Result verifyUser(String loginId, String verificationCode){
        if(!UserApp.currentUser().isAnonymous()) {
            return redirect(routes.Application.index());
        }
        UserVerification uv = UserVerification.findbyLoginIdAndVerificationCode(loginId, verificationCode);
        if(uv == null){
            return notFound("Invalid verification");
        }
        if (uv.isValidDate()) {
            User user = User.findByLoginId(loginId);
            user.state = UserState.ACTIVE;
            user.update();
            uv.invalidate();
            return ok(verified.render("", loginId));
        }
        return notFound("Invalid verification");
    }

    private static void sendMailAfterUserCreation(User created) {
        if (!isAllowedEmailDomains(created.email)) {
            flash(Constants.INFO, "user.unacceptable.email.domain");
            return;
        }
        Mail mail = new Mail(Messages.get("user.verification.signup.confirm")
                + ": " + getServeIndexPageUrl(),
                getNewAccountMailBody(created),
                new String[] { getEmailName(created.email, created.name) });
        Mailer mailer = Mailer.getCustomMailer(Configuration.root().getConfig("play-easymail"));
        mailer.sendMail(mail);
    }

    private static Body getNewAccountMailBody(User user){
        String passwordResetUrl = getServeIndexPageUrl() + routes.PasswordResetApp.lostPassword();
        StringBuilder html = new StringBuilder();
        StringBuilder plainText = new StringBuilder();

        if(isUsingEmailVerification()){
            setVerificationMessage(user, html, plainText);
        }
        setSignupInfomation(user, passwordResetUrl, html, plainText);
        return new Body(plainText.toString(), html.toString());
    }

    private static void setSignupInfomation(User user, String passwordResetUrl, StringBuilder html, StringBuilder plainText) {
        html.append("URL: <a href='").append(getServeIndexPageUrl()).append("'>")
                    .append(getServeIndexPageUrl()).append("</a><br/>\n")
                .append("ID: ").append(user.loginId).append("<br/>\n")
                .append("Email: ").append(user.email).append("<br/>\n<br/>\n")
                .append("Password reset: <a href='").append(passwordResetUrl).append("' target='_blank'>")
                .append(passwordResetUrl).append("</a><br/>\n");
        plainText.append("URL: ").append(getServeIndexPageUrl()).append("\n")
                .append("ID: ").append(user.loginId).append("\n")
                .append("Email: ").append(user.email).append("\n\n")
                .append("Password reset: ").append(passwordResetUrl).append("\n");
    }

    private static void setVerificationMessage(User user, StringBuilder html, StringBuilder plainText) {
        UserVerification verification = UserVerification.findbyUser(user);
        if(verification == null){
            verification = UserVerification.newVerification(user);
        }
        String verificationUrl = getServeIndexPageUrl()
                + routes.UserApp.verifyUser(user.loginId, verification.verificationCode).toString();
        html.append("<h1>").append(Messages.get("user.verification")).append("</h1>\n");
        html.append("<hr />\n");
        html.append("<p><a href='").append(verificationUrl).append("'>")
                .append(Messages.get("user.verification.link.click")).append("</a></p>\n");
        html.append("<br />\n");
        html.append("<br />\n");

        plainText.append(Messages.get("user.verification")).append("\n");
        plainText.append("--------------------------\n");
        plainText.append(verificationUrl).append("\n");
        plainText.append("\n");
        plainText.append("\n");
    }

    private static String getServeIndexPageUrl(){
        StringBuilder url = new StringBuilder();
        if(request().secure()){
            url.append("https://");
        } else {
            url.append("http://");
        }
        url.append(utils.Config.getHostport("localhost:9000"));

        return url.toString();
    }

    private static String generateLoginId(User user, String loginIdCandidate) {
        User sameLoginIdUser = User.findByLoginId(loginIdCandidate);
        if (sameLoginIdUser.isAnonymous()) {
            return loginIdCandidate;
        } else {
            sameLoginIdUser = User.findByLoginId(loginIdCandidate + "-yona");
            if (sameLoginIdUser.isAnonymous()) {
                return loginIdCandidate + "-yona";   // first dup, then use suffix "-yona"
            } else {
                return newLoginIdWithoutDup(loginIdCandidate, 2);
            }
        }
    }

    @Transactional
    public static Result resetUserPassword() {
        Form<User> userForm = form(User.class).bindFromRequest();

        if(userForm.hasErrors()) {
            return badRequest(ErrorViews.BadRequest.render("error.badrequest"));
        }

        User currentUser = currentUser();
        User user = userForm.get();

        if(!isValidPassword(currentUser, user.oldPassword)) {
            Form<User> currentUserForm = new Form<>(User.class);
            currentUserForm = currentUserForm.fill(currentUser);

            flash(Constants.WARNING, "user.wrongPassword.alert");
            return badRequest(edit.render(currentUserForm, currentUser));
        }

        resetPassword(currentUser, user.password);

        //go to login page
        processLogout();
        flash(Constants.WARNING, "user.loginWithNewPassword");
        return redirect(routes.UserApp.loginForm());

    }

    public static Result resetUserVisitedList() {
        RecentProject.deleteAll(currentUser());
        flash(Constants.INFO, "userinfo.reset.visited.project.list.done");
        return redirect(routes.UserApp.editUserInfoForm());
    }

    public static boolean isValidPassword(User currentUser, String password) {
        String hashedOldPassword = hashedPassword(password, currentUser.passwordSalt);
        return currentUser.password.equals(hashedOldPassword);
    }

    @Transactional
    public static void resetPassword(User user, String newPassword) {
        user.password = hashedPassword(newPassword, user.passwordSalt);
        user.save();
    }

    @Transactional
    public static User currentUser() {
        User user = getUserFromSession();
        if (!user.isAnonymous()) {
            return user;
        } else {
            user = User.findUserIfTokenExist(user);
        }
        if(!user.isAnonymous()) {
            return user;
        }
        return getUserFromContext();
    }

    private static User getUserFromSession() {
        String userId = session().get(SESSION_USERID);
        String userKey = session().get(SESSION_KEY);
        if (userId == null) {
            return User.anonymous;
        }
        if (!StringUtils.isNumeric(userId)) {
            return invalidSession();
        }
        User user = null;
        if ((userKey != null && Long.valueOf(userId) != null)){
            user = CacheStore.yonaUsers.getIfPresent(Long.valueOf(userId));
        }
        if (user == null || user.isLocked()) {
            return invalidSession();
        }
        return user;
    }

    private static User getUserFromContext() {
        Object cached = Http.Context.current().args.get(TOKEN_USER);
        if (cached instanceof User) {
            return (User) cached;
        }
        initTokenUser();
        User foundUser = (User) Http.Context.current().args.get(TOKEN_USER);

        if(foundUser.isLocked()) {
            processLogout();
            return User.anonymous;
        }

        return foundUser;
    }

    public static void initTokenUser() {
        User user = getUserFromToken();
        Http.Context.current().args.put(TOKEN_USER, user);
        if (!user.isAnonymous() && getUserFromSession().isAnonymous()) {
            addUserInfoToSession(user);
        }
    }

    private static User getUserFromToken() {
        Cookie cookie = request().cookies().get(TOKEN);
        if (cookie == null) {
            return User.anonymous;
        }
        String[] subject =  StringUtils.split(cookie.value(), TOKEN_SEPARATOR);
        if (ArrayUtils.getLength(subject) != TOKEN_LENGTH) {
            return invalidToken();
        }
        User user = authenticateWithHashedPassword(subject[0], subject[1]);
        if (user.isAnonymous()) {
            return invalidToken();
        }
        return user;
    }

    private static User invalidSession() {
        session().clear();
        return User.anonymous;
    }

    private static User invalidToken() {
        response().discardCookie(TOKEN);
        return User.anonymous;
    }

    @AnonymousCheck
    public static Result userFiles(){
        final int USER_FILES_COUNT_PER_PAGE = 50;
        String pageNumString = request().getQueryString("pageNum");
        String filter = request().getQueryString("filter");
        int pageNum = 1;

        if (StringUtils.isNotEmpty(pageNumString)){
            pageNum = Integer.parseInt(pageNumString);
        }

        Page<Attachment> page = Attachment.findByUser(currentUser(), USER_FILES_COUNT_PER_PAGE, pageNum, filter);
        return ok(userFiles.render("User Files", page));
    }

    @AnonymousCheck
    public static Result userInfo(String loginId, int daysAgo, String selected) {
        Organization org = Organization.findByName(loginId);
        if(org != null) {
            return redirect(routes.OrganizationApp.organization(org.name));
        }

        if (daysAgo == UNDEFINED) {
            Cookie cookie = request().cookie(DAYS_AGO_COOKIE);
            if (cookie != null && StringUtils.isNotEmpty(cookie.value())) {
                daysAgo = Integer.parseInt(cookie.value());
            } else {
                daysAgo = DAYS_AGO;
                response().setCookie(DAYS_AGO_COOKIE, daysAgo + "");
            }
        } else {
            if (daysAgo < 0) {
                daysAgo = 1;
            }
            response().setCookie(DAYS_AGO_COOKIE, daysAgo + "");
        }

        User user = User.findByLoginId(loginId);

        List<Issue> issues = new ArrayList<>();
        List<PullRequest> pullRequests = new ArrayList<>();
        List<Project> projects = new ArrayList<>();
        Map<Long, Boolean> projectAclMap = new HashMap<>();

        if (!Application.HIDE_PROJECT_LISTING || !UserApp.currentUser().isAnonymous()) {
            projects = collectProjects(user, projectAclMap);
            issues = getAclValidatedIssues(
                    Issue.findRecentlyIssuesByDaysAgo(user, daysAgo),
                    projectAclMap);
            pullRequests = getAclValidatedPullRequests(
                    PullRequest.findOpendPullRequestsByDaysAgo(user, daysAgo),
                    projectAclMap);

            sortByLastPushedDateAndName(projects);
        }

        if (user.isAnonymous()) {
            return notFound(ErrorViews.NotFound.render("user.notExists.name"));
        }
        return ok(view.render(user, projects, issues, pullRequests, daysAgo, selected));
    }

    private static void sortByLastPushedDateAndName(List<Project> projects) {
        Collections.sort(projects, new Comparator<Project>() {
            @Override
            public int compare(Project p1, Project p2) {
                int compareLastPushedDate;
                if (p1.lastPushedDate == null && p2.lastPushedDate == null) {
                    return p1.name.compareTo(p2.name);
                }

                if (p1.lastPushedDate == null) {
                    return 1;
                } else if (p2.lastPushedDate == null) {
                    return -1;
                }

                compareLastPushedDate = p2.lastPushedDate.compareTo(p1.lastPushedDate);
                if (compareLastPushedDate == 0) {
                    return p1.name.compareTo(p2.name);
                }
                return compareLastPushedDate;
            }
        });
    }

    private static List<PullRequest> getAclValidatedPullRequests(List<PullRequest> pullRequests, Map<Long, Boolean> projectAcl) {
        List<PullRequest> aclValidatedPullRequests = new ArrayList<>();
        for (PullRequest pullRequest : pullRequests) {
            if(projectAcl.getOrDefault(pullRequest.toProject.id, false)) {
                aclValidatedPullRequests.add(pullRequest);
            } else {
                if (AccessControl.isAllowed(UserApp.currentUser(), pullRequest.toProject.asResource(), Operation.READ)) {
                    aclValidatedPullRequests.add(pullRequest);
                    projectAcl.putIfAbsent(pullRequest.toProject.id, true);
                } else {
                    projectAcl.putIfAbsent(pullRequest.toProject.id, false);
                }
            }
        }
        return aclValidatedPullRequests;
    }

    private static List<Issue> getAclValidatedIssues(List<Issue> issues, Map<Long, Boolean> projectAcl) {
        List<Issue> aclValidatedIssues = new ArrayList<>();

        for (Issue issue : issues) {
            if(projectAcl.getOrDefault(issue.project.id, false)) {
                aclValidatedIssues.add(issue);
            } else {
                if (AccessControl.isAllowed(UserApp.currentUser(), issue.project.asResource(), Operation.READ)) {
                    aclValidatedIssues.add(issue);
                    projectAcl.putIfAbsent(issue.project.id, true);
                } else {
                    projectAcl.putIfAbsent(issue.project.id, false);
                }
            }
        }
        return aclValidatedIssues;
    }

    private static void sortIssues(List<Issue> issues) {
        Collections.sort(issues, new Comparator<Issue>() {
            @Override
            public int compare(Issue i1, Issue i2) {
                return i2.updatedDate.compareTo(i1.updatedDate);
            }
        });
    }

    private static void sortPullRequests(List<PullRequest> pullRequests) {
        Collections.sort(pullRequests, new Comparator<PullRequest>() {
            @Override
            public int compare(PullRequest p1, PullRequest p2) {
                return p2.updated.compareTo(p1.updated);
            }
        });
    }

    private static List<Project> collectProjects(User user, Map<Long, Boolean> projectAcl) {
        List<Project> projectCollection = new ArrayList<>();
        addProjectNotDupped(projectCollection, Project.findProjectsByMember(user.id), projectAcl);
        return projectCollection;
    }

    private static void addProjectNotDupped(List<Project> target, List<Project> foundProjects,
                                            Map<Long, Boolean> projectAcl) {
        for (Project project : foundProjects) {
            if (target.contains(project)) {
                continue;
            }

            if (projectAcl.containsKey(project.id)) {
                if (projectAcl.get(project.id)) {
                    target.add(project);
                }
            } else {
                if(AccessControl.isAllowed(UserApp.currentUser(), project.asResource(), Operation.READ)) {
                    target.add(project);
                    projectAcl.putIfAbsent(project.id, true);
                } else {
                    projectAcl.putIfAbsent(project.id, false);
                }
            }
        }
    }

    @AnonymousCheck(requiresLogin = true, displaysFlashMessage = true)
    public static Result editUserInfoForm() {
        User user = UserApp.currentUser();
        Form<User> userForm = new Form<>(User.class);
        userForm = userForm.fill(user);
        return ok(edit.render(userForm, user));
    }

    @AnonymousCheck(requiresLogin = true, displaysFlashMessage = true)
    public static Result editUserInfoByTabForm(String tabId) {
        User user = UserApp.currentUser();
        Form<User> userForm = new Form<>(User.class);
        userForm = userForm.fill(user);

        switch(UserInfoFormTabType.fromString(tabId)){
            case PASSWORD:
                return ok(edit_password.render(userForm, user));
            case NOTIFICATIONS:
                return ok(edit_notifications.render(userForm, user));
            case EMAILS:
                return ok(edit_emails.render(userForm, user));
            case TOKEN_RESET:
                user.token = null;
            case TOKEN:
                if( StringUtils.isEmpty(user.token)){
                    user.token = new Sha256Hash(LocalDateTime.now().toString()).toBase64();
                    user.save();
                }
                return ok(edit_token.render(userForm, user));
            case PROFILE:
                return ok(edit.render(userForm, user));
            default:
                return ok(edit.render(userForm, user));
        }
    }

    public static boolean isUsingEmailVerification() {
        return usingEmailVerification;
    }

    private enum UserInfoFormTabType {
        PROFILE("profile"),
        PASSWORD("password"),
        NOTIFICATIONS("notifications"),
        EMAILS("emails"),
        TOKEN("token"),
        TOKEN_RESET("token_reset");

        private String tabId;

        UserInfoFormTabType(String tabId) {
            this.tabId = tabId;
        }

        public String value(){
            return tabId;
        }

        public static UserInfoFormTabType fromString(String text)
            throws IllegalArgumentException {
            for(UserInfoFormTabType tab : UserInfoFormTabType.values()){
                if (tab.value().equalsIgnoreCase(text)) {
                    return tab;
                }
            }
            throw new IllegalArgumentException("Invalid tabId");
        }
    }

    @AnonymousCheck(requiresLogin = true, displaysFlashMessage = true)
    @Transactional
    public static Result editUserInfo() {
        Form<User> userForm = new Form<>(User.class).bindFromRequest("name", "email");
        String newEmail = userForm.data().get("email");
        String newName = defaultSanitize(userForm.data().get("name"));
        User user = UserApp.currentUser();

        if (StringUtils.isEmpty(newEmail)) {
            userForm.reject("email", "user.wrongEmail.alert");
        } else {
            if (!StringUtils.equals(user.email, newEmail) && User.isEmailExist(newEmail)) {
                userForm.reject("email", "user.email.duplicate");
            }
        }

        if (userForm.error("email") != null) {
            flash(Constants.WARNING, userForm.error("email").message());
            return badRequest(edit.render(userForm, user));
        }
        user.email = newEmail;
        user.name = HtmlUtil.defaultSanitize(newName);

        try {
            Long avatarId = Long.valueOf(userForm.data().get("avatarId"));
            if (avatarId != null) {
                Attachment attachment = Attachment.find.byId(avatarId);
                String primary = attachment.mimeType.split("/")[0].toLowerCase();

                if (attachment.size > AVATAR_FILE_LIMIT_SIZE){
                    userForm.reject("avatarId", "user.avatar.fileSizeAlert");
                }

                if (primary.equals("image")) {
                    Attachment.deleteAll(currentUser().avatarAsResource());
                    attachment.moveTo(currentUser().avatarAsResource());
                }
            }
        } catch (NumberFormatException ignored) {
        }

        Email.deleteOtherInvalidEmails(user.email);
        user.update();
        CacheStore.yonaUsers.put(user.id, user);
        return redirect(routes.UserApp.userInfo(user.loginId, DAYS_AGO, DEFAULT_SELECTED_TAB));
    }

    @Transactional
    public static Result leave(String userName, String projectName) {
        ProjectApp.deleteMember(userName, projectName, UserApp.currentUser().id);
        return redirect(routes.UserApp.userInfo(UserApp.currentUser().loginId, DAYS_AGO, DEFAULT_SELECTED_TAB));
    }

    /**
     * check the given {@code loginId} is being used by someone else's logindId or group name,
     * and whether {@code loginId} is a reserved word or not.
     *
     * @param name
     * @return
     * @see User#isLoginIdExist(String)
     * @see Organization#isNameExist(String)
     * @see ReservedWordsValidator#isReserved(String)
     */
    public static Result isUsed(String name) {
        ObjectNode result = Json.newObject();
        result.put("isExist", User.isLoginIdExist(name) || Organization.isNameExist(name));
        result.put("isReserved", ReservedWordsValidator.isReserved(name));
        return ok(result);
    }

    @BodyParser.Of(BodyParser.Json.class)
    public static Result isEmailExist(String email) {
        ObjectNode result = Json.newObject();
        result.put("isExist", User.isEmailExist(email));
        return ok(result);
    }

    /**
     * @param plainTextPassword plain text
     * @param passwordSalt hash salt
     * @return hashed password
     */
    public static String hashedPassword(String plainTextPassword, String passwordSalt) {
        if (plainTextPassword == null  || passwordSalt == null) {
            throw new IllegalArgumentException("Bad password or passwordSalt!");
        }
        return new Sha256Hash(plainTextPassword, ByteSource.Util.bytes(passwordSalt), HASH_ITERATIONS).toBase64();
    }

    @Transactional
    public static Result addEmail() {
        Form<Email> emailForm = form(Email.class).bindFromRequest();
        String newEmail = emailForm.data().get("email");

        if(emailForm.hasErrors()) {
            flash(Constants.WARNING, emailForm.error("email").message());
            return redirect(routes.UserApp.editUserInfoForm());
        }

        User currentUser = currentUser();
        if(currentUser == null || currentUser.isAnonymous()) {
            return forbidden(ErrorViews.NotFound.render());
        }

        if(User.isEmailExist(newEmail) || Email.exists(newEmail, true) || currentUser.has(newEmail)) {
            flash(Constants.WARNING, Messages.get("user.email.duplicate"));
            return redirect(routes.UserApp.editUserInfoForm());
        }

        Email email = new Email();
        User user = currentUser();
        email.user = user;
        email.email = newEmail;
        email.valid = false;

        user.addEmail(email);

        return redirect(routes.UserApp.editUserInfoForm());
    }

    @Transactional
    public static Result deleteEmail(Long id) {
        User currentUser = currentUser();
        Email email = Email.find.byId(id);

        if(currentUser == null || currentUser.isAnonymous() || email == null) {
            return forbidden(ErrorViews.NotFound.render());
        }

        if(!AccessControl.isAllowed(currentUser, email.user.asResource(), Operation.DELETE)) {
            return forbidden(ErrorViews.Forbidden.render(Messages.get("error.forbidden")));
        }

        email.delete();
        return redirect(routes.UserApp.editUserInfoForm());
    }

    @Transactional
    public static Result sendValidationEmail(Long id) {
        User currentUser = currentUser();
        Email email = Email.find.byId(id);

        if(currentUser == null || currentUser.isAnonymous() || email == null) {
            return forbidden(ErrorViews.NotFound.render());
        }

        if(!AccessControl.isAllowed(currentUser, email.user.asResource(), Operation.UPDATE)) {
            return forbidden(ErrorViews.Forbidden.render(Messages.get("error.forbidden")));
        }

        email.sendValidationEmail();

        flash(Constants.WARNING, "확인 메일을 전송했습니다.");
        return redirect(routes.UserApp.editUserInfoForm());
    }

    @Transactional
    public static Result confirmEmail(Long id, String token) {
        Email email = Email.find.byId(id);

        if(email == null) {
            return forbidden(ErrorViews.NotFound.render());
        }

        if(email.validate(token)) {
            addUserInfoToSession(email.user);
            return redirect(routes.UserApp.editUserInfoForm());
        } else {
            return forbidden(ErrorViews.NotFound.render());
        }
    }

    @Transactional
    public static Result setAsMainEmail(Long id) {
        User currentUser = currentUser();
        Email email = Email.find.byId(id);

        if(currentUser == null || currentUser.isAnonymous() || email == null) {
            return forbidden(ErrorViews.NotFound.render());
        }

        if(!AccessControl.isAllowed(currentUser, email.user.asResource(), Operation.UPDATE)) {
            return forbidden(ErrorViews.Forbidden.render(Messages.get("error.forbidden")));
        }

        String oldMainEmail = currentUser.email;
        currentUser.email = email.email;
        currentUser.removeEmail(email);
        currentUser.update();

        Email newSubEmail = new Email();
        newSubEmail.valid = true;
        newSubEmail.email = oldMainEmail;
        newSubEmail.user = currentUser;
        currentUser.addEmail(newSubEmail);

        return redirect(routes.UserApp.editUserInfoForm());
    }

    private static User authenticate(String loginId, String password, boolean hashed) {
        User user = User.findByLoginId(loginId);
        if (user.isAnonymous()) {
            return user;
        }
        String hashedPassword = hashed ? password : hashedPassword(password, user.passwordSalt);
        if (StringUtils.equals(user.password, hashedPassword)) {
            return user;
        }
        return User.anonymous;
    }

    public static User authenticateWithLdap(String loginIdOrEmail, String password) {
        LdapService ldapService = new LdapService();
        try {
            LdapUser ldapUser = ldapService.authenticate(loginIdOrEmail, password);
            play.Logger.debug("l: " + ldapUser);

            User localUserFoundByLdapLogin = User.findByEmail(ldapUser.getEmail());
            if (localUserFoundByLdapLogin.isAnonymous()) {
                return createNewUser(password, ldapUser);
            } else {
                if(!localUserFoundByLdapLogin.isSamePassword(password)) {
                    User.resetPassword(localUserFoundByLdapLogin.loginId, password);
                }

                localUserFoundByLdapLogin.refresh();
                localUserFoundByLdapLogin.name = ldapUser.getDisplayName();
                if(StringUtils.isNotBlank(ldapUser.getEnglishName())){
                    localUserFoundByLdapLogin.englishName = ldapUser.getEnglishName();
                }
                localUserFoundByLdapLogin.isGuest = ldapUser.isGuestUser();
                localUserFoundByLdapLogin.update();
                return localUserFoundByLdapLogin;
            }
        } catch (CommunicationException e) {
            play.Logger.error("Cannot connect to ldap server \n" + e.getMessage());
            e.printStackTrace();
            if(FALLBACK_TO_LOCAL_LOGIN){
                play.Logger.warn("fallback to local login: " + loginIdOrEmail);
                return authenticateWithPlainPassword(loginIdOrEmail, password);
            }
            return User.anonymous;
        } catch (AuthenticationException e) {
            flash(Constants.WARNING, Messages.get("user.login.invalid"));
            play.Logger.warn("login failed \n" + e.getMessage());
            if(FALLBACK_TO_LOCAL_LOGIN){
                play.Logger.warn("fallback to local login: " + loginIdOrEmail);
                return authenticateWithPlainPassword(loginIdOrEmail, password);
            }
            return User.anonymous;
        } catch (NamingException e) {
            play.Logger.error("Cannot connect to ldap server \n" + e.getMessage());
            e.printStackTrace();
            return User.anonymous;
        }
    }

    private static User createNewUser(String password, LdapUser ldapUser) {
        CandidateUser candidateUser = new CandidateUser(
                ldapUser.getDisplayName(),
                ldapUser.getEmail(),
                ldapUser.getUserLoginId(),
                password,
                ldapUser.isGuestUser()
        );
        User created = createUserDelegate(candidateUser);
        if (created.state == UserState.LOCKED) {
            flash(Constants.INFO, "user.signup.requested");
            return User.anonymous;
        }
        return created;
    }

    public static boolean isUsingSignUpConfirm(){
        Configuration config = play.Play.application().configuration();
        Boolean useSignUpConfirm = config.getBoolean("signup.require.admin.confirm");
        if(useSignUpConfirm == null) {
            useSignUpConfirm = config.getBoolean("signup.require.confirm", false); // for compatibility under v1.1
        }
        return useSignUpConfirm;
    }

    public static void setupRememberMe(User user) {
        response().setCookie(TOKEN, user.loginId + ":" + user.password, MAX_AGE);
        Logger.debug("remember me enabled");
    }

    private static void processLogout() {
        session().clear();
        response().discardCookie(TOKEN);
    }

    private static void validate(Form<User> newUserForm) {
        if (newUserForm.field("loginId").value().trim().isEmpty()) {
            newUserForm.reject("loginId", "user.wrongloginId.alert");
        }

        if (newUserForm.field("loginId").value().contains(" ")) {
            newUserForm.reject("loginId", "user.wrongloginId.alert");
        }

        if (newUserForm.field("password").value().trim().isEmpty()) {
            newUserForm.reject("password", "user.wrongPassword.alert");
        }

        if (User.isLoginIdExist(newUserForm.field("loginId").value())
            || Organization.isNameExist(newUserForm.field("loginId").value())) {
            newUserForm.reject("loginId", "user.loginId.duplicate");
        }

        if (User.isEmailExist(newUserForm.field("email").value())) {
            newUserForm.reject("email", "user.email.duplicate");
        }
    }

    public static User createNewUser(User user) {
        RandomNumberGenerator rng = new SecureRandomNumberGenerator();
        user.passwordSalt = rng.nextBytes().toBase64();
        user.password = hashedPassword(user.password, user.passwordSalt);
        if (isUsingSignUpConfirm() || isUsingEmailVerification()) {
            user.state = UserState.LOCKED;
        } else {
            user.state = UserState.ACTIVE;
        }
        User.create(user);
        Email.deleteOtherInvalidEmails(user.email);
        if (isUsingEmailVerification()) {
            UserVerification.newVerification(user);
            sendMailAfterUserCreation(user);
        }
        return user;
    }

    public static void addUserInfoToSession(User user) {
        if(user.isLocked()){
            return;
        }
        String key = new Sha256Hash(new Date().toString(), ByteSource.Util.bytes(user.passwordSalt), 1024)
                .toBase64();
        CacheStore.yonaUsers.put(user.id, user);
        session(SESSION_USERID, String.valueOf(user.id));
        session(SESSION_LOGINID, user.loginId);
        session(SESSION_USERNAME, user.name);
        session(SESSION_KEY, key);
    }

    public static boolean linkWithExistedOrCreateLocalUser() {
        final UserCredential oAuthUser = UserCredential.findByAuthUserIdentity(PlayAuthenticate
                .getUser(Http.Context.current().session()));
        User user = null;
        if (oAuthUser.loginId == null) {
            user = User.findByEmail(oAuthUser.email);
        } else {
            user = User.findByLoginId(oAuthUser.loginId);
        }

        if(PlayAuthenticate.isLoggedIn(session()) && user.isAnonymous()){
            return !createLocalUserWithOAuth(oAuthUser).isAnonymous();
        } else {
            if (oAuthUser.loginId == null) {
                oAuthUser.loginId = user.loginId;
                oAuthUser.user = user;
                oAuthUser.update();
            }
            UserApp.addUserInfoToSession(user);
        }
        return true;
    }

    public static void updatePreferredLanguage() {
        Http.Request request = Http.Context.current().request();
        User user = UserApp.currentUser();

        if (user.isAnonymous()) {
            return;
        }

        if (request.acceptLanguages().isEmpty() &&
                request.cookie(Play.langCookieName()) == null) {
            return;
        }

        String code = StringUtils.left(Http.Context.current().lang().code(), 255);

        if (!code.equals(user.lang)) {
            synchronized (user) {
                user.refresh();
                user.lang = code;
                user.update();
            }
        }
    }

    public static Result resetUserPasswordBySiteManager(String loginId){
        if (!request().getQueryString("action").equals("resetPassword")) {
            ObjectNode json = Json.newObject();
            json.put("isSuccess", false);
            json.put("reason", "BAD_REQUEST");
            return badRequest(json);
        }
        String newPassword = PasswordReset.generateResetHash(loginId).substring(0,6);
        User targetUser = User.findByLoginId(loginId);
        if(!targetUser.isAnonymous() && UserApp.currentUser().isSiteManager()){
            User.resetPassword(loginId, newPassword);

            ObjectNode json = Json.newObject();
            json.put("loginId", targetUser.loginId);
            json.put("name", targetUser.name);
            json.put("newPassword", newPassword);
            json.put("isSuccess", true);
            return ok(json);
        } else {
            ObjectNode json = Json.newObject();
            json.put("isSuccess", false);
            json.put("reason", "FORBIDDEN");
            return forbidden(json);
        }
    }

    public static boolean isSiteAdminLoggedInSession(){
        if(SiteAdmin.SITEADMIN_DEFAULT_LOGINID.equals(session().get(SESSION_LOGINID))){
            return true;
        } else {
            return false;
        }
    }

    @AnonymousCheck
    public static Result setDefaultLoginPage() throws IOException, WriteException {
        UserSetting userSetting = UserSetting.findByUser(UserApp.currentUser().id);
        userSetting.loginDefaultPage = request().getQueryString("path");
        userSetting.save();

        ObjectNode json = Json.newObject();
        json.put("defaultLoginPage", userSetting.loginDefaultPage);
        return ok(json);
    }

    public static Result usermenuTabContentList(){
        return ok(views.html.common.usermenu_tab_content_list.render());
    }
}