/*
 * Copyright (c) 2004-2017, by Alex Leigh.
 * All rights reserved.
 *
 * THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE
 * The copyright notice above does not evidence any
 * actual or intended publication of such source code.
 */

package lc.mecha.cred;

import java.io.Serializable;

/**
 * This class identifies a security principal. The principal is primarily used to check rights against
 * an authorization store (such as the <code>AuthorizationEndpoint</code>) as well as to identify users
 * and agents for the purposes of auditing operations. All users have a principal but not all principals
 * are users.
 * <p>
 * The Principal is intended to store a durable id, which for most authentication systems is not
 * the username. For example with Microsoft Active Directory, this is the SID which resembles but is not a UUID.
 * <p>
 * The purpose of using a durable ID is so that grants and other permissions will not inappropriately be conferred
 * to other users if, for example, usernames change or are accounts are created with previously deleted
 * usernames.
 * <p>
 * The existence of a Principal should not be inferred to mean that the represented Principal actually
 * exists in an authentication store, or that it is valid for any particular authorization. Principals
 * can be evaluated for validity through the <code>AuthenticationProvider</code> API.
 *
 * @author Alex Leigh
 */
public class Principal implements Serializable {
    private static final long serialVersionUID = 1L;
    public static final String DOMAIN_SEP = "@";
    private final String domain;
    private final String durableId;

    public Principal(final String domain, final String durableId) {
        this.domain = domain;
        this.durableId = durableId;
    }

    public Principal(String portableId) {
        String txt[] = portableId.split(DOMAIN_SEP, 2);
        this.domain = txt[1];
        this.durableId = txt[0];
    }

    /**
     * Return a durable, portable string.
     *
     * @return
     */
    public String getPortableString() {
        return this.durableId + DOMAIN_SEP + this.domain;
    }

    /**
     * Return the ESP domain associated with this principal. This string corresponds to whatever is setup
     * in the authentication binder in the engine. By convention this will be a DNS domain, but there is no
     * actual technical requirement for this. Example: "company.com".
     *
     * @return
     */
    public String getDomain() {
        return domain;
    }

    /**
     * Return the durable ID for the principal. This is the ID used in the authentication store implementation
     * (e.g. ActiveDirectory). The ID may or may not be a username; it will be the most durable ID available from
     * the authentication implementation (for AD, this is SID). Ideally the durable ID will survive username changes.
     * <p>
     * Note that this ID does not contain the authentication store name, domain, etc. For a global ID, call
     * <code>getPortableString()</code> instead.
     */
    public String getDurableId() {
        return durableId;
    }

    @Override
    public String toString() {
        return "Principal{" +
                "domain='" + domain + '\'' +
                ", durableId='" + durableId + '\'' +
                '}';
    }
}
