package controllers.api;

import be.objectify.deadbolt.java.actions.SubjectPresent;
import com.google.inject.Inject;
import io.rampant.orchard.markdown.MarkdownService;
import io.rampant.orchard.mongo.dao.ThreadDAO;
import io.rampant.orchard.mongo.dao.UserDAO;
import io.rampant.orchard.util.StringUtils;
import models.Topic;
import org.joda.time.DateTime;
import play.data.Form;
import play.libs.Json;
import play.mvc.Controller;
import play.mvc.Result;

/**
 * @author jonathan
 */
@SubjectPresent(content = "xhr")
public class TopicAPI extends Controller {
	ThreadDAO topics;
	UserDAO users;
	MarkdownService markdown;
	StringUtils stringUtils;

	@Inject
	public TopicAPI(ThreadDAO threadDAO, UserDAO userDAO, MarkdownService markdownService, StringUtils sUtil) {
		topics = threadDAO;
		users = userDAO;
		markdown = markdownService;
		stringUtils = sUtil;
	}

	private Topic fill(Topic t) {
		t.slug = stringUtils.slugify(t.title);
		t.contentHtml = markdown.parse(t.contentSource);
		return t;
	}

	public Result list() {
		return ok(Json.toJson(topics.find().asList()));
	}

	public Result get(String id) {
		Topic t = topics.get(id);
		if( t == null || t.deleted ) {
			return notFound();
		}
		return ok(Json.toJson(t));
	}

	public Result getBySlug(String slug) {
		Topic t = topics.findBySlug(slug);
		if( t == null || t.deleted ) {
			return notFound();
		}
		return ok(Json.toJson(t));
	}

	public Result create() {
		Form<Topic> form = Form.form(Topic.class).bindFromRequest();
		if( form.hasErrors() || form.hasGlobalErrors() ) {
			return badRequest(form.errorsAsJson());
		}

		Topic t = fill(form.get());
		t.author = users.current();
		t.createdOn = DateTime.now();
		topics.save(t);
		return ok(Json.toJson(t));
	}

	public Result update(String topicId) {
		Form<Topic> form = Form.form(Topic.class).bindFromRequest();
		if( !form.field("id").valueOr(topicId).equalsIgnoreCase(topicId) ) {
			form.reject("id", "Form id differs from URI id.");
		}
		if( form.hasErrors() ) {
			return badRequest(form.errorsAsJson());
		}
		Topic t = fill(form.get());

		// TODO: User is admin check.
		if( !t.author.getId().equalsIgnoreCase(users.current().getId()) ) {
			return unauthorized("You do not have permission to edit this topic.");
		}

		t.modifiedBy = users.current();
		t.modifiedOn = DateTime.now();
		topics.save(t);
		return ok(Json.toJson(t));
	}

	public Result close(String topicId) {
		Topic t = topics.get(topicId);
		if( !t.author.getId().equalsIgnoreCase(users.current().getId()) ) {
			return unauthorized("You do not have permission to close this topic.");
		}
		t.closed = true;
		topics.save(t);
		return ok(Json.toJson(t));
	}

	public Result destroy(String topicId) {
		Topic t = topics.get(topicId);
		if( !t.author.getId().equalsIgnoreCase(users.current().getId()) ) {
			return unauthorized("You do not have permission to delete this topic.");
		}
		t.deleted = true;
		topics.save(t);
		return ok(Json.toJson(t));
	}

}

@@ -1388,32 +1388,61 @@
 toJson(t));%0A%09%7D%0A%0A
+%09//@Restrict(@Group(%22POST%22))%0A
 %09public Result c
@@ -1447,24 +1447,24 @@
  create() %7B%0A
-
 %09%09Form%3CTopic
@@ -1750,32 +1750,101 @@
 toJson(t));%0A%09%7D%0A%0A
+%09/**%0A%09 * TODO: Add admin/creator check as deadbolt restriction?%0A%09 */%0A
 %09public Result u
@@ -2170,44 +2170,46 @@
 %0A%0A%09%09
-// TODO: User is admin check.%0A%09%09if( 
+if( !users.current().isAdmin() &&%0A%09%09%09%09
 !t.a
@@ -2534,32 +2534,62 @@
 (topicId);%0A%09%09if(
+ !users.current().isAdmin() &&
  !t.author.getId
@@ -2860,21 +2860,51 @@
 picId);%0A
-
 %09%09if(
+ !users.current().isAdmin() &&
  !t.auth

Add admin check to posting/editing topics