/**
 * Copyright (C) 2001 Yasna.com. All rights reserved.
 *
 * ===================================================================
 * The Apache Software License, Version 1.1
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. The end-user documentation included with the redistribution,
 *    if any, must include the following acknowledgment:
 *       "This product includes software developed by
 *        Yasna.com (http://www.yasna.com)."
 *    Alternately, this acknowledgment may appear in the software itself,
 *    if and wherever such third-party acknowledgments normally appear.
 *
 * 4. The names "Yazd" and "Yasna.com" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please
 *    contact yazd@yasna.com.
 *
 * 5. Products derived from this software may not be called "Yazd",
 *    nor may "Yazd" appear in their name, without prior written
 *    permission of Yasna.com.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED.  IN NO EVENT SHALL YASNA.COM OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
 * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * ====================================================================
 *
 * This software consists of voluntary contributions made by many
 * individuals on behalf of Yasna.com. For more information
 * on Yasna.com, please see <http://www.yasna.com>.
 */

/**
 * Copyright (C) 2000 CoolServlets.com. All rights reserved.
 *
 * ===================================================================
 * The Apache Software License, Version 1.1
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. The end-user documentation included with the redistribution,
 *    if any, must include the following acknowledgment:
 *       "This product includes software developed by
 *        CoolServlets.com (http://www.coolservlets.com)."
 *    Alternately, this acknowledgment may appear in the software itself,
 *    if and wherever such third-party acknowledgments normally appear.
 *
 * 4. The names "Jive" and "CoolServlets.com" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please
 *    contact webmaster@coolservlets.com.
 *
 * 5. Products derived from this software may not be called "Jive",
 *    nor may "Jive" appear in their name, without prior written
 *    permission of CoolServlets.com.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED.  IN NO EVENT SHALL COOLSERVLETS.COM OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
 * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * ====================================================================
 *
 * This software consists of voluntary contributions made by many
 * individuals on behalf of CoolServlets.com. For more information
 * on CoolServlets.com, please see <http://www.coolservlets.com>.
 */

package com.Yasna.forum.database;

import com.Yasna.forum.*;
import com.Yasna.util.*;

import java.util.*;
import java.text.*;
import java.sql.*;
import java.security.*;

/**
 * Database implementation of the User interface. Additionally, it filters all
 * HTML tags from fields before returning them for security purposes.<p>
 *
 * Use of the Jive user system is optional. There a number of different ways
 * to create your own user system or to integrate into an existing user
 * system:<ul>
 *   <li> Edit the source of this class and modify the database queries to match
 *     your user system.
 *   <li> Implement a set of custom classes and tell the ForumFactory to load
 *     them. In this case, it is still recommended to use the Jive user API
 *     since that will mean much less reimplementation work in the other
 *     classes.</ul>
 *
 * If you can follow the Jive API for your own user data, but need access
 * within Jive to extended user properties, such as addresses or other
 * personal data, and easy solution is to adapt the user properties facility
 * to load and access this data.
 */
public class DbUser implements User, Cacheable {

    /** DATABASE QUERIES **/
    private static final String LOAD_PROPERTIES =
        "SELECT name, propValue FROM yazdUserProp WHERE userID=?";
    private static final String DELETE_PROPERTIES =
        "DELETE FROM yazdUserProp WHERE userID=?";
    private static final String INSERT_PROPERTY =
        "INSERT INTO yazdUserProp(userID,name,propValue) VALUES(?,?,?)";
    private static final String LOAD_USER_BY_USERNAME =
        "SELECT * FROM yazdUser WHERE username=?";
    private static final String LOAD_USER_BY_ID =
        "SELECT * FROM yazdUser WHERE userID=?";
    private static final String INSERT_USER =
        "INSERT INTO yazdUser(userID,username,passwordHash,email,emailVisible," +
        "nameVisible) VALUES(?,?,?,?,?,?)";
    private static final String SAVE_USER =
        "UPDATE yazdUser SET passwordHash=?,email=?,emailVisible=?,name=?," +
        "nameVisible=? WHERE userID=?";
    private static final String DELETE_PERMISSIONS =
        "DELETE FROM yazdUserPerm WHERE userID=?";
    private static final String INSERT_PERMISSION =
        "INSERT INTO yazdUserPerm(userID,forumID,permission) VALUES(?,?,?)";

    /**
     * user id of -2 means no user id has been set yet. -1 is reserved for
     * "anonymous user" and 0 is reserved for "all users".
     */
    private int id = -2;
    private String username;
    private String passwordHash;
    private String name = "";
    private boolean nameVisible = true;
    private String email;
    private boolean emailVisible = true;
    private Properties properties;
    private Object propertyLock = new Object();

    /**
     * Create a new DbUser with all required fields.
     *
     * @param username the username for the user.
     * @param password a password for the user.
     * @param email the email address for the user.
     */
    protected DbUser(String username, String password, String email) {
        this.id = DbSequenceManager.nextID("User");
        this.username = username;
        //Compute hash of password.
        this.passwordHash = StringUtils.hash(password);
        this.email = email;
        properties = new Properties();
        insertIntoDb();
    }

    /**
     * Load a DbUser object specified by userID.
     *
     * @param userID the userID of the user to load.
     */
    protected DbUser(int userID) throws UserNotFoundException {
        this.id = userID;
        loadFromDb();
        loadProperties();
    }

    /**
     * Load a DbUser object specified by username.
     *
     * @param username the username of the user to load.
     */
    protected DbUser(String username) throws UserNotFoundException {
        this.username = username;
        loadFromDb();
        loadProperties();
    }

    //FROM THE USER INTERFACE//

    public int getID() {
        return id;
    }

    public boolean isAnonymous() {
        return (id==-1);
    }

    public String getUsername() {
        return StringUtils.escapeHTMLTags(username);
    }

    public String getName() {
        return StringUtils.escapeHTMLTags(name);
    }

    public void setName(String name) throws UnauthorizedException {
        this.name = name;
        saveToDb();
    }

    public boolean isNameVisible() {
        return nameVisible;
    }

    public void setNameVisible(boolean visible) throws UnauthorizedException {
        this.nameVisible = visible;
        saveToDb();
    }

    public void setPassword(String password) throws UnauthorizedException {
        //Compute hash of password.
        this.passwordHash = StringUtils.hash(password);
        saveToDb();
    }

    public String getPasswordHash() throws UnauthorizedException {
        return passwordHash;
    }

    public void setPasswordHash(String passwordHash) {
        this.passwordHash = passwordHash;
        saveToDb();
    }

    public String getEmail() {
        return StringUtils.escapeHTMLTags(email);
    }

    public void setEmail(String email) throws UnauthorizedException {
        this.email = email;
        saveToDb();
    }

    public boolean isEmailVisible() {
        return emailVisible;
    }

    public void setEmailVisible(boolean visible) throws UnauthorizedException {
        this.emailVisible = visible;
        saveToDb();
    }