use std::str::FromStr;
use crate::Error;
use crate::constants::*;
use crate::parsing::*;

grammar(domain_rid: Option<&[u32]>);

extern {
    type Error = Error;
}

pub SecurityDescriptor: crate::SecurityDescriptor = {
    "O:" <owner: Sid> "G:" <group: Sid> <dacl: DAcl> <sacl: SAcl> =>
    crate::SecurityDescriptor::new(Some(owner), Some(group), Some(dacl), Some(sacl))
}

// (Type;Flags;Access;ObjectType;InheritedObjectType;SID[;ExtraData])

// there is no way to parse SACL and DACL flags separately. So, we set both,
// the DACL and SACL flags, and delete the unwanted flags afterwards
pub Acl: crate::Acl = { <dacl: DAcl> => dacl, <sacl: SAcl> => sacl, }

pub DAcl: crate::Acl = {
    "D:" <flags: AclFlags> <ace_list: AceList> => crate::Acl::new(
        crate::AclRevision::ACL_REVISION,
        crate::AclType::DACL,
        flags & !(crate::ControlFlags::SystemAclProtected | crate::ControlFlags::SystemAclAutoInheritRequired | crate::ControlFlags::SystemAclAutoInherited),
        ace_list
    ),
}

pub SAcl: crate::Acl = {
    "S:" <flags: AclFlags> <ace_list: AceList> => crate::Acl::new(
        crate::AclRevision::ACL_REVISION,
        crate::AclType::SACL,
        flags & !(crate::ControlFlags::DiscretionaryAclProtected | crate::ControlFlags::DiscretionaryAclAutoInheritRequired | crate::ControlFlags::DiscretionaryAclAutoInherited),
        ace_list
    )
}

// "PAR" and "PAI" conflict with "PA", so we create distinct tokens for these flags
pub AclFlags: crate::ControlFlags = {
    //<s:SingleAclFlag> => s,
    //<a:AclFlags> <s:SingleAclFlag> => a | s
    "P" =>      crate::ControlFlags::SystemAclProtected |
                crate::ControlFlags::DiscretionaryAclProtected,

    "PAR"   =>  crate::ControlFlags::SystemAclProtected |
                crate::ControlFlags::DiscretionaryAclProtected |
                crate::ControlFlags::SystemAclAutoInheritRequired |
                crate::ControlFlags::DiscretionaryAclAutoInheritRequired,

    "PAI"   =>  crate::ControlFlags::SystemAclProtected |
                crate::ControlFlags::DiscretionaryAclProtected |
                crate::ControlFlags::SystemAclAutoInherited |
                crate::ControlFlags::DiscretionaryAclAutoInherited,
    
    "PAIAR" =>  crate::ControlFlags::SystemAclProtected |
                crate::ControlFlags::DiscretionaryAclProtected |
                crate::ControlFlags::SystemAclAutoInherited |
                crate::ControlFlags::DiscretionaryAclAutoInherited |
                crate::ControlFlags::SystemAclAutoInheritRequired |
                crate::ControlFlags::DiscretionaryAclAutoInheritRequired,
    
    "PARAI" =>  crate::ControlFlags::SystemAclProtected |
                crate::ControlFlags::DiscretionaryAclProtected |
                crate::ControlFlags::SystemAclAutoInherited |
                crate::ControlFlags::DiscretionaryAclAutoInherited |
                crate::ControlFlags::SystemAclAutoInheritRequired |
                crate::ControlFlags::DiscretionaryAclAutoInheritRequired,

    "AR" =>     crate::ControlFlags::SystemAclAutoInheritRequired |
                crate::ControlFlags::DiscretionaryAclAutoInheritRequired,
    "AI" =>     crate::ControlFlags::SystemAclAutoInherited |
                crate::ControlFlags::DiscretionaryAclAutoInherited,
}

SingleAclFlag: crate::ControlFlags = {
    "P" => crate::ControlFlags::SystemAclProtected | crate::ControlFlags::DiscretionaryAclProtected,
    "AR" => crate::ControlFlags::SystemAclAutoInheritRequired | crate::ControlFlags::DiscretionaryAclAutoInheritRequired,
    "AI" => crate::ControlFlags::SystemAclAutoInherited | crate::ControlFlags::DiscretionaryAclAutoInherited,
}

pub AceList: Vec<crate::Ace> = {
    <ace:Ace> => vec![ace],
    <l:AceList> <ace:Ace> => {
        let mut l = l;
        l.push(ace);
        l
    }
}

pub Ace: crate::Ace = {
    "(A;" <a: AceSid> ")" => crate::Ace::access_allowed(a.0, a.1, a.2),
    "(D;" <a: AceSid> ")" => crate::Ace::access_denied(a.0, a.1, a.2),
    "(OA;" <a: AceSidObject> ")" => crate::Ace::access_allowed_object(a.0, a.1, Some(a.2), Some(a.3), a.4),
    "(OD;" <a: AceSidObject> ")" => crate::Ace::access_denied_object(a.0, a.1, Some(a.2), Some(a.3), a.4),
    //"(XA;" <a: AceSidAppdata> ")" => crate::Ace::access_allowed_callback(a.0, a.1, a.2, a.3),
    //"(XD;" <a: AceSidAppdata> ")" => crate::Ace::access_denied_callback(a.0, a.1, a.2, a.3),
    //"(ZA;" <a: AceSidObjectAppdata> ")" => crate::Ace::access_allowed_object_callback(a.0, a.1, a.2, a.3, a.4, a.5),
    //"(ZD;" <a: AceSidObjectAppdata> ")" => crate::Ace::access_denied_object_callback(a.0, a.1, a.2, a.3, a.4, a.5),
    "(AU;" <a: AceSid> ")" => crate::Ace::audit(a.0, a.1, a.2),
    //"(OU;" <a: AceSidObjectAppdata> ")" => crate::Ace::audit_object(a.0, a.1, a.2, a.3, a.4, a.5),
    //"(XU;" <a: AceSidAppdata> ")" => crate::Ace::audit_callback(a.0, a.1, a.2, a.3),
    "(ML;" <a: AceSid> ")" => crate::Ace::mandatory_label(a.0, a.1, a.2),
    //"(ZU;" <a: AceSidObjectAppdata> ")" => crate::Ace::audit_callback_object(a.0, a.1, a.2, a.3, a.4, a.5),
    //"(RA;" <a: AceSidObjectAppdata> ")" => crate::Ace::resource_attribute(a.0, a.1, a.2, a.3, a.4, a.5),
    "(SP;" <a: AceSid> ")" => crate::Ace::scoped_policy_id(a.0, a.1, a.2),
}

AceSid: (crate::AceHeaderFlags, crate::AccessMask, crate::Sid) = {
    <flags:AceHeaderFlags> ";" <mask: AccessMask> ";;;" <sid: Sid> => (flags, mask, sid)
}

AceSidObject: (crate::AceHeaderFlags, crate::AccessMask, crate::Guid, crate::Guid, crate::Sid) = {
    <flags:AceHeaderFlags> ";" <mask: AccessMask> ";" <obj:Guid> ";" <inherited:Guid> ";" <sid: Sid> => (flags, mask, obj, inherited, sid)
}

pub Sid: crate::Sid = {
    "AA" => crate::Sid::new_builtin(579),
    "AC" => APPLICATION_PACKAGE_AUTHORITY.new_sid(&[2, 1]),
    "AN" => SECURITY_NT_AUTHORITY.new_sid(&[7]),
    "AO" => crate::Sid::new_builtin(548),
    "AP" =>? domain_rid.new_domain_sid(525),
    "AS" => AUTHENTICATION_AUTHORITY.new_sid(&[1]),
    "AU" => SECURITY_NT_AUTHORITY.new_sid(&[11]),
    "BA" => crate::Sid::new_builtin(544),
    "BG" => crate::Sid::new_builtin(546),
    "BO" => crate::Sid::new_builtin(551),
    "BU" => crate::Sid::new_builtin(545),
    "CA" =>? domain_rid.new_domain_sid(517),
    "CD" => crate::Sid::new_builtin(574),
    "CG" => SECURITY_CREATOR_SID_AUTHORITY.new_sid(&[1]),
    "CN" =>? domain_rid.new_domain_sid(522),
    "CO" => SECURITY_CREATOR_SID_AUTHORITY.new_sid(&[0]),
    "CY" => crate::Sid::new_builtin(569),
    "DA" =>? domain_rid.new_domain_sid(512),
    "DC" =>? domain_rid.new_domain_sid(515),
    "DD" =>? domain_rid.new_domain_sid(516),
    "DG" =>? domain_rid.new_domain_sid(514),
    "DU" =>? domain_rid.new_domain_sid(513),
    "EA" =>? domain_rid.new_domain_sid(519),
    "ED" => SECURITY_NT_AUTHORITY.new_sid(&[9]),
    "EK" =>? domain_rid.new_domain_sid(527),
    "ER" => crate::Sid::new_builtin(573),
    "ES" => crate::Sid::new_builtin(576),
    "HA" => crate::Sid::new_builtin(578),
    "HI" => MANDATORY_LABEL_AUTHORITY.new_sid(&[12288]),
    "IS" => crate::Sid::new_builtin(568),
    "IU" => SECURITY_NT_AUTHORITY.new_sid(&[4]),
    "KA" =>? domain_rid.new_domain_sid(526),
    "LA" =>? domain_rid.new_domain_sid(500),
    "LG" =>? domain_rid.new_domain_sid(501),
    "LS" => SECURITY_NT_AUTHORITY.new_sid(&[19]),
    "LU" => crate::Sid::new_builtin(559),
    "LW" => MANDATORY_LABEL_AUTHORITY.new_sid(&[4096]),
    "ME" => MANDATORY_LABEL_AUTHORITY.new_sid(&[8192]),
    "MP" => MANDATORY_LABEL_AUTHORITY.new_sid(&[8448]),
    "MS" => crate::Sid::new_builtin(577),
    "MU" => crate::Sid::new_builtin(558),
    "NO" => crate::Sid::new_builtin(556),
    "NS" => SECURITY_NT_AUTHORITY.new_sid(&[20]),
    "NU" => SECURITY_NT_AUTHORITY.new_sid(&[2]),
    "OW" => SECURITY_CREATOR_SID_AUTHORITY.new_sid(&[4]),
    "PA" =>? domain_rid.new_domain_sid(520),
    "PO" => crate::Sid::new_builtin(550),
    "PS" => SECURITY_NT_AUTHORITY.new_sid(&[10]),
    "PU" => crate::Sid::new_builtin(547),
    "RA" => crate::Sid::new_builtin(575),
    "RC" => SECURITY_NT_AUTHORITY.new_sid(&[12]),
    "RD" => crate::Sid::new_builtin(555),
    "RE" => crate::Sid::new_builtin(552),
    "RM" => crate::Sid::new_builtin(580),
    "RO" =>? domain_rid.new_domain_sid(498),
    "RS" =>? domain_rid.new_domain_sid(553),
    "RU" => crate::Sid::new_builtin(554),
    "SA" =>? domain_rid.new_domain_sid(518),
    "SI" => MANDATORY_LABEL_AUTHORITY.new_sid(&[16384]),
    "SO" => crate::Sid::new_builtin(549),
    "SS" => AUTHENTICATION_AUTHORITY.new_sid(&[2]),
    "SU" => SECURITY_NT_AUTHORITY.new_sid(&[6]),
    "SY" => SECURITY_NT_AUTHORITY.new_sid(&[18]),
    "UD" => SECURITY_NT_AUTHORITY.new_sid(&[84, 0, 0, 0, 0, 0]),
    "WD" => SECURITY_WORLD_SID_AUTHORITY.new_sid(&[0]),
    "WR" => SECURITY_NT_AUTHORITY.new_sid(&[33]),
    <s:r#"S-1-\d+(-\d+)*"#> => crate::Sid::try_from(s).unwrap()
}

pub Guid: crate::Guid = {
    <guid: r"[[:xdigit:]]{8}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{12}"> => guid.try_into().unwrap()
}

AceType: &'static str = {
    "A" => crate::sddl_h::SDDL_ACCESS_ALLOWED,
    "D" => crate::sddl_h::SDDL_ACCESS_DENIED,
    "AU" => crate::sddl_h::SDDL_AUDIT,
    "AL" => crate::sddl_h::SDDL_ALARM,
    "OA" => crate::sddl_h::SDDL_OBJECT_ACCESS_ALLOWED,
    "OD" => crate::sddl_h::SDDL_OBJECT_ACCESS_DENIED,
    "OU" => crate::sddl_h::SDDL_OBJECT_AUDIT,
    "OL" => crate::sddl_h::SDDL_OBJECT_ALARM,
    "XA" => crate::sddl_h::SDDL_CALLBACK_ACCESS_ALLOWED,
    "XD" => crate::sddl_h::SDDL_CALLBACK_ACCESS_DENIED,
    "ZA" => crate::sddl_h::SDDL_CALLBACK_OBJECT_ACCESS_ALLOWED,
    "XU" => crate::sddl_h::SDDL_CALLBACK_AUDIT,
    "ML" => crate::sddl_h::SDDL_MANDATORY_LABEL,
    "RA" => crate::sddl_h::SDDL_RESOURCE_ATTRIBUTE,
    "SP" => crate::sddl_h::SDDL_SCOPED_POLICY_ID,
    "TL" => crate::sddl_h::SDDL_PROCESS_TRUST_LABEL,
    "FL" => crate::sddl_h::SDDL_ACCESS_FILTER,
}

pub AceHeaderFlags: crate::AceHeaderFlags = {
    <s:SingleAceFlag> => s,
    <a:AceHeaderFlags> <s:SingleAceFlag> => a | s
}

SingleAceFlag: crate::AceHeaderFlags = {
    "OI" => crate::AceHeaderFlags::OBJECT_INHERIT_ACE,
    "CI" => crate::AceHeaderFlags::CONTAINER_INHERIT_ACE,
    "NP" => crate::AceHeaderFlags::NO_PROPAGATE_INHERIT_ACE,
    "IO" => crate::AceHeaderFlags::INHERIT_ONLY_ACE,
    "ID" => crate::AceHeaderFlags::INHERITED_ACE,
    "CR" => crate::AceHeaderFlags::CRITICAL,
    "SA" => crate::AceHeaderFlags::SUCCESSFUL_ACCESS_ACE_FLAG,
    "FA" => crate::AceHeaderFlags::FAILED_ACCESS_ACE_FLAG,
    "TP" => crate::AceHeaderFlags::TRUST_PROTECTED_FILTER,
}

pub AccessMask: crate::AccessMask = {
    <n:Number> => crate::AccessMask::from(n),
    <s:SingleAccessMask> => s,
    <a:AccessMask> <s:SingleAccessMask> => a | s
};


Number: u32 = {
    <s:r#"0x[0-9a-fA-F]+"#> => {
        u32::from_str_radix(&s[2..], 16).unwrap()
    },
    <s:r#"0[0-7]+"#> => {
        u32::from_str_radix(s, 8).unwrap()
    },
    <s:r#"[1-9][0-9]*"#> => {
        u32::from_str(s).unwrap()
    }
}

SingleAccessMask: crate::AccessMask = {
    "GR" => crate::AccessMask::GENERIC_READ,
    "GW" => crate::AccessMask::GENERIC_WRITE,
    "GX" => crate::AccessMask::GENERIC_EXECUTE,
    "GA" => crate::AccessMask::GENERIC_ALL,
    "MA" => crate::AccessMask::MAXIMUM_ALLOWED,
    "AS" => crate::AccessMask::ACCESS_SYSTEM_SECURITY,
    "WO" => crate::AccessMask::WRITE_OWNER,
    "WD" => crate::AccessMask::WRITE_DACL,
    "RC" => crate::AccessMask::READ_CONTROL,
    "SD" => crate::AccessMask::DELETE,
    "CR" => crate::AccessMask::CONTROL_ACCESS,

    "CA" => crate::constants::ADS_RIGHT_DS_CONTROL_ACCESS,
    "LO" => crate::constants::ADS_RIGHT_DS_LIST_OBJECT,
    "DT" => crate::constants::ADS_RIGHT_DS_DELETE_TREE,
    "WP" => crate::constants::ADS_RIGHT_DS_WRITE_PROP,
    "RP" => crate::constants::ADS_RIGHT_DS_READ_PROP,
    "SW" => crate::constants::ADS_RIGHT_DS_SELF,
    "LC" => crate::constants::ADS_RIGHT_ACTRL_DS_LIST,
    "DC" => crate::constants::ADS_RIGHT_DS_DELETE_CHILD,
    "CC" => crate::constants::ADS_RIGHT_DS_CREATE_CHILD,
    "NW" => crate::constants::SYSTEM_MANDATORY_LABEL_NO_WRITE_UP,
    "NR" => crate::constants::SYSTEM_MANDATORY_LABEL_NO_READ_UP,
    "NX" => crate::constants::SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP,
    "FA" => *crate::constants::FILE_ALL,
    "FR" => *crate::constants::FILE_READ,
    "FW" => *crate::constants::FILE_WRITE,
    "FX" => *crate::constants::FILE_EXECUTE,
    "KA" => *crate::constants::KEY_ALL,
    "KR" => *crate::constants::KEY_READ,
    "KW" => *crate::constants::KEY_WRITE,
    "KX" => *crate::constants::KEY_EXECUTE,
}