package de.ivu.elect.business.security.control;

import java.io.Serializable;
import java.util.Collection;

import de.ivu.elect.business.konfiguration.entity.MandantKonfigurationWerte;
import de.ivu.elect.business.mandant.entity.Mandant;
import de.ivu.elect.business.security.UseCasePermission;
import de.ivu.elect.business.security.entity.ElectPricipalContext;
import de.ivu.elect.business.security.entity.TfaStatus;
import de.ivu.elect.business.security.entity.TwoFactorAuthenticationStatus;

public class TfaPrincipalStatus implements Serializable {
  private static final long serialVersionUID = 1L;

  public TfaStatus bestimmeTfaStatus(Mandant mandant, Collection<UseCasePermission> permissions, boolean isAdmin, ElectPricipalContext electPricipalContext) {
    TwoFactorAuthenticationStatus twoFactorAuthenticationStatus = electPricipalContext.getKonfigurationLoader()
      .resolveEnumValue(mandant, MandantKonfigurationWerte.TWO_FACTOR_AUTHENTICATION_STATUS,
        TwoFactorAuthenticationStatus.class);

    if (twoFactorAuthenticationStatus != null && twoFactorAuthenticationStatus.isAktiv()) {
      if (permissions.contains(UseCasePermission.TFA_LOGIN_NICHT_NOTWENDIG) && (!isAdminMussImmerTfa() || !isAdmin) /*Admin muss immer TFA*/) {
        return TfaStatus.DEAKTIVIERT;
      }
      return TfaStatus.NICHT_BESTANDEN;
    }
    return TfaStatus.DEAKTIVIERT;
  }

  protected boolean isAdminMussImmerTfa() {
    return true;
  }

}
