raven/server/AyaNova/Controllers/PickListController.cs

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Routing;
using Microsoft.Extensions.Logging;
using Microsoft.AspNetCore.Authorization;
using Microsoft.EntityFrameworkCore;
using AyaNova.Models;
using AyaNova.Api.ControllerHelpers;
using AyaNova.Biz;
using AyaNova.PickList;
using System.Threading.Tasks;
using System.Linq;

namespace AyaNova.Api.Controllers
{

    [ApiController]
    [Asp.Versioning.ApiVersion("8.0")]
    [Route("api/v{version:apiVersion}/pick-list")]
    [Produces("application/json")]
    [Authorize]
    public class PickListController : ControllerBase
    {
        private readonly AyContext ct;
        private readonly ILogger<PickListController> log;
        private readonly ApiServerState serverState;



        /// <summary>
        /// ctor
        /// </summary>
        /// <param name="dbcontext"></param>
        /// <param name="logger"></param>
        /// <param name="apiServerState"></param>
        public PickListController(AyContext dbcontext, ILogger<PickListController> logger, ApiServerState apiServerState)
        {
            ct = dbcontext;
            log = logger;
            serverState = apiServerState;
        }



        /// <summary>
        /// Get picklist of all Active objects of type specified and filtered by query specified
        /// NOTE: Query is valid only if:
        /// it is an empty string indicating not filtered just selected
        /// if not an empty string, it has at most two space separated strings and one of them is a special TAG specific query that starts with two consecutive periods 
        /// i.e. "some" is valid (single query on all templated fields) 
        /// "..zon some" is valid (all tags like zon and all template fields like some)
        /// "zon some" is NOT valid (missing TAGS indicator), "..zone some re" is NOT valid (too many strings)
        /// Note that this list is capped automatically to return no more than 100 results
        /// </summary>
        /// <param name="pickListParams">Parameters for pick list see api docs for details </param>
        /// <returns>Filtered list</returns>
        [HttpPost("list")]
        public async Task<IActionResult> PostList([FromBody] PickListOptions pickListParams)
        {
            if (serverState.IsClosed)
                return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));

            if (!ModelState.IsValid)
                return BadRequest(new ApiErrorResponse(ModelState));

            //NOTE: these sequence of calls are a little different than other objects due to the nature of rights and stuff with picklists being different

            var PickList = PickListFactory.GetAyaPickList(pickListParams.AyaType);

            //was the name not found as a pick list?
            if (PickList == null)
                return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));

            //RIGHTS - NOTE: uniquely to other routes this one checks the actual picklist defined roles itself
            if (!Authorized.HasAnyRole(HttpContext.Items, PickList.AllowedRoles))
                return StatusCode(403, new ApiNotAuthorizedResponse());


            //case 4712: customer contacts get only the pick lists of the service request screen, limited to their own records
            var contactVariant = await ContactPickListVariantAsync(pickListParams.AyaType, pickListParams.ListVariant);
            if (contactVariant == CONTACT_DENIED)
                return StatusCode(403, new ApiNotAuthorizedResponse());
            if (contactVariant != null)
                pickListParams.ListVariant = contactVariant;

            //Instantiate the business object handler
            PickListBiz biz = PickListBiz.GetBiz(ct, HttpContext);




            //handle HeadOffice only restricted variants
            if (pickListParams.ListVariant == "ho")
            {
                //add a variant for the current user's head office id in place of ho
                var UserId = UserIdFromContext.Id(HttpContext.Items);
                var UType = UserTypeFromContext.Type(HttpContext.Items);
                if (UType != UserType.HeadOffice)
                    return StatusCode(403, new ApiNotAuthorizedResponse());
                var HoId = await ct.User.AsNoTracking().Where(x => x.Id == UserId).Select(x => x.HeadOfficeId).SingleOrDefaultAsync();
                if (HoId == null || HoId == 0)
                    return StatusCode(403, new ApiNotAuthorizedResponse());
                pickListParams.ListVariant = $"{HoId},{(int)AyaType.HeadOffice}";

            }

            var o = await biz.GetPickListAsync(PickList, pickListParams.Query, pickListParams.Inactive, pickListParams.PreselectedIds.ToArray(), pickListParams.ListVariant, log, pickListParams.Template);
            if (o == null)
                return BadRequest(new ApiErrorResponse(biz.Errors));
            else
                return Ok(ApiOkResponse.Response(o));
        }



        /// <summary>
        /// Get a single item's name display in PickList templated format
        /// </summary>
        /// <param name="pickListSingleParams"></param>
        /// <returns>One display string or an empty string if not found or invalid</returns>
        [HttpPost("single")]
        public async Task<IActionResult> PostSingle([FromBody] PickListSingleOptions pickListSingleParams)
        {
            if (serverState.IsClosed)
                return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));

            if (!ModelState.IsValid)
                return BadRequest(new ApiErrorResponse(ModelState));

            if (!Authorized.HasSelectRole(HttpContext.Items, pickListSingleParams.AyaType))
                return StatusCode(403, new ApiNotAuthorizedResponse());

            //case 4712: a customer contact gets names only of its own customers, their units, and unit models
            if (!await ContactMayNameRecordAsync(pickListSingleParams.AyaType, pickListSingleParams.Id))
                return StatusCode(403, new ApiNotAuthorizedResponse());

            //Instantiate the business object handler
            PickListBiz biz = PickListBiz.GetBiz(ct, HttpContext);

            var o = await biz.GetTemplatedNameAsync(pickListSingleParams.AyaType, pickListSingleParams.Id, pickListSingleParams.ListVariant, log, pickListSingleParams.Template);
            if (o == null)
                return BadRequest(new ApiErrorResponse(biz.Errors));
            else
                return Ok(ApiOkResponse.Response(o));
        }


        /// <summary>
        /// Get PickListTemplate
        /// </summary>
        /// <param name="ayaType"></param>
        /// <returns>The current effective template, either a customized one or the default</returns>
        [HttpGet("template/{ayaType}")]
        public async Task<IActionResult> GetPickListTemplate([FromRoute] AyaType ayaType)
        {
            if (serverState.IsClosed)
                return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));

            //Instantiate the business object handler
            PickListBiz biz = PickListBiz.GetBiz(ct, HttpContext);

            if (!Authorized.HasReadFullRole(HttpContext.Items, biz.BizType))
                return StatusCode(403, new ApiNotAuthorizedResponse());

            if (!ModelState.IsValid)
                return BadRequest(new ApiErrorResponse(ModelState));

            var o = await biz.GetAsync(ayaType);
            if (o == null)
                return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));

            return Ok(ApiOkResponse.Response(o));
        }



        /// <summary>
        /// List of all PickList templates
        /// </summary>        
        /// <returns>List of strings</returns>
        [HttpGet("template/list")]
        public ActionResult GetTemplateList()
        {
            if (!serverState.IsOpen)
                return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));

            //Instantiate the business object handler
            PickListBiz biz = PickListBiz.GetBiz(ct, HttpContext);

            long TranslationId = UserTranslationIdFromContext.Id(HttpContext.Items);
            var o = biz.GetListOfAllPickListTypes(TranslationId);
            if (o == null)
                return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));

            return Ok(ApiOkResponse.Response(o));

        }




        /// <summary>
        /// POST (replace) Pick List template
        /// (note: in this case the Id is the AyaType numerical value as there is only one template per type)
        /// </summary>       
        /// <param name="template"></param>
        /// <returns></returns>
       // [HttpPost("Template/{ayaType}")]
        [HttpPost("template")]
        public async Task<IActionResult> ReplacePickListTemplate([FromBody] PickListTemplate template)
        {
            if (!serverState.IsOpen)
                return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));

            if (!ModelState.IsValid)
                return BadRequest(new ApiErrorResponse(ModelState));

            //Instantiate the business object handler       
            PickListBiz biz = PickListBiz.GetBiz(ct, HttpContext);

            // var o = await biz.GetAsync(ayaType, false);
            // if (o == null)
            //     return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));

            if (!Authorized.HasModifyRole(HttpContext.Items, biz.BizType))
                return StatusCode(403, new ApiNotAuthorizedResponse());

            try
            {
                if (!await biz.ReplaceAsync(template))
                    return BadRequest(new ApiErrorResponse(biz.Errors));
            }
            catch (DbUpdateConcurrencyException)
            {

                return StatusCode(409, new ApiErrorResponse(ApiErrorCode.CONCURRENCY_CONFLICT));
            }
            return NoContent();
        }


        /// <summary>
        /// Delete customized template
        /// (revert to default)
        /// </summary>
        /// <param name="ayaType"></param>
        /// <returns>Ok</returns>
        [HttpDelete("template/{ayaType}")]
        public async Task<IActionResult> DeletePickListTemplate([FromRoute] AyaType ayaType)
        {
            if (!serverState.IsOpen)
                return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));

            if (!ModelState.IsValid)
                return BadRequest(new ApiErrorResponse(ModelState));

            //Instantiate the business object handler
            PickListBiz biz = PickListBiz.GetBiz(ct, HttpContext);


            if (!Authorized.HasDeleteRole(HttpContext.Items, biz.BizType))
                return StatusCode(403, new ApiNotAuthorizedResponse());

            if (!await biz.DeleteAsync(ayaType))
                return BadRequest(new ApiErrorResponse(biz.Errors));

            return NoContent();
        }


        /// <summary>
        /// List of all fields for pick list AyaType specified
        /// </summary>        
        /// <returns>List of fields available for template</returns>
        [HttpGet("template/listfields/{ayaType}")]
        public ActionResult GetPickListFields([FromRoute] AyaType ayaType)
        {
            if (!serverState.IsOpen)
                return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));

            var PickList = PickListFactory.GetAyaPickList(ayaType);
            //type might not be supported
            if (PickList == null)
            {
                return BadRequest(new ApiErrorResponse(ApiErrorCode.NOT_FOUND, null, $"PickList for type  \"{ayaType.ToString()}\" not supported"));
            }
            return Ok(ApiOkResponse.Response(PickList.ColumnDefinitions));
        }


        //case 4712: marker for a pick list a customer contact may not use
        private const string CONTACT_DENIED = "\u0000contact-denied";

        //case 4712: for a customer contact, the variant that limits a pick list to its own records:
        //null when the caller is not a contact (request used as is), CONTACT_DENIED for any list the
        //customer screens do not use or a customer the contact does not own
        private async Task<string> ContactPickListVariantAsync(AyaType aType, string requestedVariant)
        {
            var userType = UserTypeFromContext.Type(HttpContext.Items);
            if (userType != UserType.Customer && userType != UserType.HeadOffice)
                return null;
            var userId = UserIdFromContext.Id(HttpContext.Items);
            var u = await ct.User.AsNoTracking().Where(x => x.Id == userId).Select(x => new { x.CustomerId, x.HeadOfficeId }).SingleOrDefaultAsync();
            long ownCustomerId = u?.CustomerId ?? 0;
            long ownHeadOfficeId = u?.HeadOfficeId ?? 0;
            switch (aType)
            {
                case AyaType.Customer:
                    if (userType == UserType.Customer)
                        return ownCustomerId == 0 ? CONTACT_DENIED : $"{ownCustomerId},{(int)AyaType.Customer}";
                    return ownHeadOfficeId == 0 ? CONTACT_DENIED : $"{ownHeadOfficeId},{(int)AyaType.HeadOffice}";
                case AyaType.Unit:
                    if (userType == UserType.Customer)
                        return ownCustomerId == 0 ? CONTACT_DENIED : $"customerid:{ownCustomerId}";
                    //head office contact: units of the customer chosen on the form, which must be one of its customers;
                    //none until a customer is chosen
                    var v = (requestedVariant ?? string.Empty).Split(':');
                    long requestedCustomerId = 0;
                    if (v.Length == 2 && v[0].Trim() == "customerid")
                        long.TryParse(v[1].Trim(), System.Globalization.NumberStyles.Integer, System.Globalization.CultureInfo.InvariantCulture, out requestedCustomerId);
                    if (requestedCustomerId == 0)
                        return "customerid:-1";
                    return await UserBiz.CustomerContactOwnsCustomerAsync(ct, userId, requestedCustomerId) ? $"customerid:{requestedCustomerId}" : CONTACT_DENIED;
                case AyaType.UnitModel:
                    return requestedVariant;//unit models are not customer data
                default:
                    return CONTACT_DENIED;
            }
        }

        //case 4712: may the caller see this record's pick list name (always true for staff)
        private async Task<bool> ContactMayNameRecordAsync(AyaType aType, long id)
        {
            var userType = UserTypeFromContext.Type(HttpContext.Items);
            if (userType != UserType.Customer && userType != UserType.HeadOffice)
                return true;
            var userId = UserIdFromContext.Id(HttpContext.Items);
            switch (aType)
            {
                case AyaType.Customer:
                    return id == 0 || await UserBiz.CustomerContactOwnsCustomerAsync(ct, userId, id);
                case AyaType.Unit:
                    if (id == 0)
                        return true;
                    var unitCustomerId = await ct.Unit.AsNoTracking().Where(x => x.Id == id).Select(x => (long?)x.CustomerId).FirstOrDefaultAsync();
                    return unitCustomerId != null && await UserBiz.CustomerContactOwnsCustomerAsync(ct, userId, (long)unitCustomerId);
                case AyaType.UnitModel:
                    return true;
                default:
                    return false;
            }
        }

    }//eoc
}//ens