package jenkins.security;
/** Permits {@link ACL} decisions to be overridden by extensions outside the control of either an {@link AccessControlled} or an {@link AuthorizationStrategy}. */
public abstract class ACLDecorator implements ExtensionPoint {
    /**
     * May be used to override {@link ACL#hasPermission(Authentication, Permission)} decisions.
     * @param object the object of a permission check
     * @param a some authentication (not {@link ACL#SYSTEM}, which is always granted everything)
     * @param permission some permission
     * @return true to grant the permission, false to deny it, or null to allow another extension and finally the base logic to apply
     */
    public abstract Boolean hasPermission(@Nonnull AccessControlled object, @Nonnull Authentication a, @Nonnull Permission permission);
    public abstract Boolean hasCreatePermission(@Nonnull AccessControlled object, @Nonnull Authentication a, @Nonnull ItemGroup c, @Nonnull TopLevelItemDescriptor d);
}

public static boolean hasPermission(@Nonnull AccessControlled object, @Nonnull Authentication a, @Nonnull Permission p) {
    if (a == SYSTEM) {
        return true;
    }
    for (ACLDecorator d : ExtensionList.lookup(ACLDecorator.class)) {
        Boolean b = d.hasPermission(object, a, p);
        if (b != null) {
            return b;
        }
    }
    return object.getACL().hasPermission(a, p);
}
/** @deprecated use {@link #hasPermission(AccessControlled, Authentication, Permission)} instead */
public final boolean hasPermission(@Nonnull Permission p) {
    // no backlink to AccessControlled, cannot retrofit
    return hasPermission(Jenkins.getAuthentication(), p);
}
// similarly for checkPermission, hasCreatePermission, checkCreatePermission

@Override
public boolean hasPermission(Permission p) {
    return ACL.hasPermission(this, Jenkins.getAuthentication(), p);
}

@Extension
public static MakeBranchProjectsReadOnly extends ACLDecorator {
    @Override
    public Boolean hasPermission(@Nonnull AccessControlled object, @Nonnull Authentication a, @Nonnull Permission permission) {
        if (object instanceof WorkflowJob &&
                (permission == Item.CONFIGURE || permission == Item.DELETE) &&
                ((WorkflowJob) object).getProperty(BranchJobProperty.class) != null) {
            return false;
        }
        return null;
    }
}

@Extension
public static MakeComputedFolderChildrenReadOnly extends ACLDecorator {
    @Override
    public Boolean hasPermission(@Nonnull AccessControlled object, @Nonnull Authentication a, @Nonnull Permission permission) {
        if (object instanceof TopLevelItem &&
                (permission == Item.CONFIGURE || permission == Item.DELETE) &&
                ((Item) object).getParent() instanceof ComputedFolder) {
            return false;
        }
        return null;
    }
}