package com.randomnoun.common.security;
   
   /* (c) 2013 randomnoun. All Rights Reserved. This work is licensed under a
    * BSD Simplified License. (http://www.randomnoun.com/bsd-simplified.html)
    */
   
   import java.io.IOException;
   import java.util.ArrayList;
   import java.util.HashMap;
  import java.util.Iterator;
  import java.util.List;
  import java.util.Map;
  
  import com.randomnoun.common.MRUCache;
  
  /**
   * This class manages users, roles, resources and permissions for an application.
   * 
   * <p>Most of the code that adds/deletes/maintains these objects has been removed, that is
   * now the responsibility of the security implementation code. 
   * 
   * <p>Methods to read user and permission data are delegated to the SecurityLoader, and
   * methods that authenticate users are delegated to the SecurityAuthenticator.
   * 
   * <p>This class now mostly acts as a cache for user and role data, and can perform
   * simple and complex permission checks for users against resources.
   * 
   * <p>The following properties can be passed to the SecurityContext during construction;
   * property keys are defined as static public final Strings in this class.
   *
   * <ul>
   * <li>INIT_CASE_INSENSITIVE - make the security cache case-insensitive, typically when interfacing with 
   *     Active Directory. Defaults to false.
   * <li>INIT_USER_CACHE_SIZE - maximum size of user cache
   * <li>INIT_USER_CACHE_EXPIRY - expiry time of users from the user cache (in milliseconds). If this
   *     property is not set, user caching is disabled.
   * </ul>
   *
   * <p>Additional properties may also be required based on the SecurityLoader implementation used.
   * 
   * @author knoxg
   *
   * @see com.randomnoun.common.security.SecurityLoader
   */
  public class SecurityContext {
      
      // /** The logger for this class */
      // private static Logger logger = Logger.getLogger(SecurityContext.class.getName());
  
      /** SecurityContext properties */
      private Map<String, Object> properties = null;
  
      /** An initialisation property key. See the class documentation for details. */
      public static final String INIT_USER_CACHE_SIZE = "securityContext.userCacheSize";
  
      /** An initialisation property key. See the class documentation for details. */
      public static final String INIT_USER_CACHE_EXPIRY = "securityContext.userCacheExpiry";
  
      /** An initialisation property key. See the class documentation for details. */
      public static final String INIT_USERNAME_MASK = "securityContext.usernameMask";
      
      /** An initialisation property key. See the class documentation for details. */
  	public static final String INIT_CASE_INSENSITIVE = "securityContext.caseInsensitive";
  
      /** Maps rolenames to maps of permission names (in the form 'activity.resource')
       * to Permission objects (possibly containing ResourceCriteria objects). 
       * 
  	 * If the security context is case-insensitive, then role names are lower-cased.
       */
      private Map<String, Map<String, Permission>> rolePermissionCache = null;
  
      /** Maps usernames to maps of permission names (in the form 'activity.resource')
       * to Permission objects (possibly containing ResourceCriteria objects). 
       *  
       * If the security context is case-insensitive, then usernames are lower-cased. */
      private Map<User, Map<String, Permission>> userPermissionCache = null;
      
      /** Maps user objects to list of roles. 
       * 
       * @TODO convert to HashSet ?
       */
      private Map<User, List<String>> userRoleCache = null;
  
      /** Maps userIds to Users. 
       */
      private Map<Long, User> userCache = null;
      
      /** This security loader is used to retrieve information from a persistant data
       *  store for this context */
      private SecurityLoader securityLoader = null;
  
      
      /** The authenticator, if you want to actually check passwords */
      private SecurityAuthenticator securityAuthenticator = null;
  
      // should probably use guava caches for all of this now
      
      /** This class is invoked by the MRUCache to recalculate values in the
       * user permission cache that have expired, or where not in the cache to begin with.
      */
     private static class UserPermissionCallback
         implements MRUCache.RetrievalCallback {
 
     	SecurityLoader loader;
 
         /** Creates a new callback used to populate the
          *  user cache
          */
         public UserPermissionCallback(SecurityLoader loader) {
             this.loader = loader;
         }
 
         /** this method is only called if the required value is not in the cache,
          * or the value in the cache has expired.
          *
          * @param key The username of the User to return
          */
         public Object get(Object key) {
             if (key==null) { throw new NullPointerException("null key"); }
             if (!(key instanceof User)) {
             	throw new IllegalArgumentException("Expected user as User, found " + key.getClass().getName());
             }
 
             User user = (User) key;
 			
 			Map<String, Permission> result = new HashMap<String, Permission>();
             try {
                 List<Permission> permissions = loader.loadUserPermissions(user);
                 for (Iterator<Permission> i = permissions.iterator(); i.hasNext(); ) {
                 	Permission perm = (Permission) i.next();
                 	if (result.containsKey(perm.getActivity() + "." + perm.getResource())) {
                 		throw new IllegalStateException("User '" + key + "' contains two versions of permission '" + 
                 		  perm.getActivity() + "." + perm.getResource() + "'; please check the database");
                 	}
                 	result.put(perm.getActivity() + "." + perm.getResource(), perm);
                 }
             } catch (IOException ioe) {
                 throw new RuntimeException("IOException reading user permissions", ioe);
             }
             return result;
         }
     }
 
 	/** This class is invoked by the MRUCache to recalculate values in the
 	 * user permission cache that have expired, or where not in the cache to begin with.
 	 */
 	private static class RolePermissionCallback
 		implements MRUCache.RetrievalCallback {
 
 		SecurityLoader loader;
 
 		/** Creates a new rowcount callback used to populate the
 		 *  user cache
 		 */
 		public RolePermissionCallback(SecurityLoader loader) {
 			this.loader = loader;
 		}
 
 		/** this method is only called if the required value is not in the cache,
 		 * or the value in the cache has expired.
 		 *
 		 * @param key The username of the User to return
 		 */
 		public Object get(Object key) {
 			if (key==null) { throw new NullPointerException("null key"); }
 			if (!(key instanceof String)) {
 				throw new IllegalArgumentException("Expected roleName as string, found " + key.getClass().getName());
 			}
 			String rolename = (String) key;
 			Map<String, Permission> result = new HashMap<String, Permission>();
 			try {
 				List<Permission> permissions = loader.loadRolePermissions(rolename);
 				for (Iterator<Permission> i = permissions.iterator(); i.hasNext(); ) {
 					Permission perm = (Permission) i.next();
 					if (result.containsKey(perm.getActivity() + "." + perm.getResource())) {
 						throw new IllegalStateException("Role '" + key + "' contains two versions of permission '" + 
 						  perm.getActivity() + "." + perm.getResource() + "'; please check the database");
 					}
 					result.put(perm.getActivity() + "." + perm.getResource(), perm);
 				}
 			} catch (IOException ioe) {
 				throw new RuntimeException("IOException reading role permissions", ioe);
 			}
 			return result;
 		}
 	}
 
 
 	/** This class is invoked by the MRUCache to recalculate values in the
 	 * user role cache that have expired, or where not in the cache to begin with.
 	 */
 	private static class UserRoleCallback
 		implements MRUCache.RetrievalCallback {
 
 		SecurityLoader loader;
 
 		/** Creates a new rowcount callback used to populate the
 		 *  user cache
 		 */
 		public UserRoleCallback(SecurityLoader loader) {
 			this.loader = loader;
 		}
 
 		/** this method is only called if the required value is not in the cache,
 		 * or the value in the cache has expired.
 		 *
 		 * @param key The username of the User to return
 		 */
 		public Object get(Object key) {
 			if (key==null) { throw new NullPointerException("null key"); }
 			if (!(key instanceof User)) {
 				throw new IllegalArgumentException("Expected user as User, found " + key.getClass().getName());
 			}
 			
 			try {
 				// @TODO convert to HashSet ?
 				return loader.loadUserRoles((User) key);
 			} catch (IOException ioe) {
 				throw new RuntimeException("IOException reading user permissions", ioe);
 			}
 		}
 	}
 
 
 	/** This class is invoked by the MRUCache to load Users. It delegates to the Loader.
 	 */
 	private static class UserCallback
 		implements MRUCache.RetrievalCallback {
 
 		SecurityLoader loader;
 
 		/** Creates a new rowcount callback used to populate the
 		 *  user cache
 		 */
 		public UserCallback(SecurityLoader loader) {
 			this.loader = loader;
 		}
 
 		/** this method is only called if the required value is not in the cache,
 		 * or the value in the cache has expired.
 		 *
 		 * @param key The username of the User to return
 		 */
 		public Object get(Object key) {
 			if (key==null) { throw new NullPointerException("null key"); }
 			if (!(key instanceof Number)) {
 				throw new IllegalArgumentException("Expected numeric userId, found " + key.getClass().getName());
 			}
 			
 			try {
 				// @TODO convert to HashSet ?
 				return loader.loadUser(((Number) key).longValue());
 			} catch (IOException ioe) {
 				throw new RuntimeException("IOException reading user", ioe);
 			}
 		}
 	}
 
 
     /**
      * Creates a new SecurityContext object.
      *
      * @param properties Initialisation properties for this SecurityContext, its
      *   SecurityLoader, and SecurityAuthenticator
      *
      * @throws IllegalStateException if the context is configured to preload,
      *   and it fails to do so.
      */
     public SecurityContext(Map<String, Object> properties, SecurityLoader securityLoader, 
     		SecurityAuthenticator securityAuthenticator) {
         this.properties = properties;
         this.securityLoader = securityLoader;
         this.securityLoader.initialise(properties);
         this.securityAuthenticator = securityAuthenticator;
         this.securityAuthenticator.initialise(properties);
 		resetSecurityContext();
     }
     
 
 	/** Retrieve a list of permissions for this user, as Permission objects.
 	 * 
 	 * @param user
 	 * @return
 	 * @throws IOException
 	 */
 	public List<Permission> getUserPermissions(User user) throws IOException {
 		// @TODO should get this User out of our userCache, keyed by id
 		
 		List<Permission> permissions = new ArrayList<Permission>();
 		Map<String, Permission> cachedPermissions = userPermissionCache.get(user);
 		for (Iterator<Permission> i = cachedPermissions.values().iterator(); i.hasNext(); ) {
 			permissions.add(i.next());
 		}
 		return permissions;
 	}
 
 
     /** Returns a list of Permission objects that apply to the specified rolename.
      *
      * @param roleName the role name
      * @return A List of Permission objects that apply to that role
      */
     public List<Permission> getRolePermissions(String roleName) {
         // retrieve from cache
         List<Permission> result = new ArrayList<Permission>();
         if (roleName==null) {
         	throw new NullPointerException("null roleName");
         } else {
         	Map<String, Permission> rolePermissions = rolePermissionCache.get(roleName);
         	if (rolePermissions == null) {
         		throw new IllegalArgumentException("Unknown role '" + roleName + "'");
         	}
         	for (Iterator<Permission> i = rolePermissions.values().iterator(); i.hasNext(); ) {
         		result.add(i.next());
         	}
         }
         return result;
     }
 
     /**
      * Return a list of User objects representing all users contained in this
      * security context. Permission information relating to that user is not
      * populated unless the 'populatePermission' parameter is set to true.
      *
      * <p>The information returned by this function may be cached, depending
      * on the initialisation properties of the security context.
      *
      * @return A List of Users.
      */
     public List<User> getAllUsers() throws IOException {
         return securityLoader.loadAllUsers();
     }
 
     /**
      * Return a List of all resources in this security context, identified
      * by String.
      *
      * <p>The information returned by this function may be cached, depending
      * on the initialisation properties of the security context.
      *
      * @return A List of resources
      */
     public List<String> getAllResources() throws IOException {
         return securityLoader.loadAllResources();
     }
 
 	/**
 	 * Return a List of all Permissions in this security context.
 	 *
 	 * <p>The information returned by this function may be cached, depending
 	 * on the initialisation properties of the security context.
 	 *
 	 * @return A List of resources
 	 */
 	public List<Permission> getAllPermissions() throws IOException {
 		return securityLoader.loadAllPermissions();
 	}
 
 
     /**
      * Return a List of all activities in this security context for a given
      * resource, identified by String.
      *
      * <p>The information returned by this function may be cached, depending
      * on the initialisation properties of the security context.
      *
      * @param resourceName The resource we wish to retrieve activities for
      *
      * @return A List of activities.
      *
      * @throws SecurityException
      */
     public List<String> getAllActivities(String resourceName) throws IOException {
         return securityLoader.loadAllActivities(resourceName);
     }
 
     /**
      * Return a List of roles in this security context for the User, identified
      * by String.
      *
      * <p>The information returned by this function may be cached, depending
      * on the initialisation properties of the security context.
      *
      * @return A List of roles.
      */
     public List<String> getAllRoles()
         throws IOException {
         return securityLoader.loadAllRoles();
     }
 
     /**
      * Return a List of all roles in this security context, identified
      * by String.
      *
      * <p>The information returned by this function may be cached, depending
      * on the initialisation properties of the security context.
      *
      * @return A List of roles.
      */
     public List<String> getUserRoles(User user)
         throws IOException 
     {
         List<String> cachedRoles = userRoleCache.get(user);
         if (cachedRoles==null) {
         	throw new IllegalStateException("Unknown user '" + user + "'");
         }
         return cachedRoles;
     }
 
 	/** 
 	 * Returns a detailed list of roles from the security context. Each role
 	 * is defined as a Map with the following keys:
 	 * 
 	 * <attributes>
 	 * roleId - the numeric id for the role
 	 * roleName - the name of the role for
 	 * system - (Number) set to 1 if this role is read-only, 0 otherwise
 	 * description - a description for the role
 	 * </attributes>
 	 * 
 	 * @return a list of roles, as described above
 	 * 
 	 * @throws IOException
 	 */
     public List<Map<String, Object>> getAllRoleDetails()
         throws IOException {
         return securityLoader.loadAllRoleDetails();
     }
 
 	/** 
 	 * Returns a detailed list of users from the security context. Each user
 	 * is defined as a Map with the following keys:
 	 * 
 	 * <attributes>
 	 * userId - the login name for the user
 	 * name - the full name of the user
 	 * system - (Number) set to 1 if this role is read-only, 0 otherwise
 	 * </attributes>
 	 * 
 	 * @return a list of users, as described above
 	 * 
 	 * @throws IOException
 	 */
     public List<Map<String, Object>> getAllUserDetails()
         throws IOException {
         return securityLoader.loadAllUserDetails();
     }
 
   
 
 
     /** Returns true if a user is allowed to perform the permission supplied. The permission
      *  is expressed in 'activity.resourceType' format, e.g. 'update.message'. No expression
      *  context is supplied; this method will not evaluate any conditional resource
      *  restrictions. This is useful in cases where the full resource context is not known,
      *  for example when a message is first created by a user.
      *
      *  <p>In this case, the 'create.message' permission can be checked using this method
      *  before the user starts entering information, and 'create.message' can be
      *  checked with an expression context after the header fields have been populated.
      *
      * <p>If a permission is supplied that is not known by the application, this
      * method will return false.
      *
      * @param user The user we are determining
      * @param permission The permission we are testing for. Permissions are expressed in
      *   'activity.resourceType' format.
      * @return true if the permission is allowed, false is the permission is denied.
      *
      * @throws NullPointerException if either parameter to this method is null
      * @throws IllegalArgumentException if the permission supplied is formatted incorrectly.
      */
     public boolean hasPermission(User user, String permission) {
         return hasPermission(user, permission, null);
     }
 
     /**
      * Returns true if a user is allowed to perform the permission supplied, with
      * given resource context. If a permission is assigned to both the user
      * and the role, then the user permission is evaluated first.
      *
      * @param user The user we are determining
      * @param permission The permission we are testing for. Permissions are expressed in
      *   'activity.resourceType' format.
      * @param context The resource context used to evaluate against the resource expression
      *
      * @return true if the permission is allowed, false is the permission is denied.
      *
      * @throws NullPointerException if either parameter to this method is null
      * @throws IllegalArgumentException if the permission supplied is formatted incorrectly.
      */
     public boolean hasPermission(User user, String permission, Map<String, Object> context) {
     	// @TODO should get this User out of our userCache, keyed by id
         if (permission == null) { throw new NullPointerException("Null permission"); }
         if (user == null) { throw new NullPointerException("Null user"); }
 
         int pos = permission.indexOf('.');
         if (pos == -1) {
             throw new IllegalArgumentException("Illegal permission value '" + permission + "'");
         }
 
 		//  try per-user permissions...
 		Map<String, Permission> userPermissions = userPermissionCache.get(user);
 		if (userPermissions == null) {
 			// @TODO - load from DB ? should be handled by MRUCache
 			throw new IllegalStateException("Unknown user '" + user.getUsername() + "'");
 		} else {
 			Permission userPermission = (Permission) userPermissions.get(permission);
 			if (userPermission!=null) {
 				if (context == null) {
 					return true;
 				} else {
 					ResourceCriteria criteria = userPermission.getResourceCriteria();
 					if (criteria == null || criteria.evaluate(context)) {
 						return true;
 					}
 				}
 			}
 		}
 		
 		// then try per-role permissions ...
 		List<String> roles = userRoleCache.get(user);
 		if (roles == null) {
 			// @TODO - load from DB ? should be handled by MRUCache
 			throw new IllegalStateException("Unknown user '" + user.getUsername() + "'");
 		} else {
 			for (Iterator<String> i = roles.iterator(); i.hasNext(); ) {
 				String rolename = (String) i.next();
 				Map<String, Permission> rolePermissions = rolePermissionCache.get(rolename);
 				if (rolePermissions == null) {
 					// @TODO - load from DB ? should be handled by MRUCache
 					throw new IllegalStateException("Unknown role '" + rolename + "'");
 				} else {
 					// this is a strange data structure
 					Permission rolePermission = (Permission) rolePermissions.get(permission);
 					if (rolePermission!=null) {
 						if (context == null) {
 							return true;
 						} else {
 							ResourceCriteria criteria = rolePermission.getResourceCriteria();
 							if (criteria == null || criteria.evaluate(context)) {
 								return true;
 							}
 						}	
 					}
 				}
 			}
 		}
 
         return false;
     }
 
 	/**
 	 * Returns the Permission object for a specific user/permission combination, or null
 	 * if this permission is not granted. This method will not search the user's 
 	 * role-based permissions. 
 	 *
 	 * @param user The user we are determining
 	 * @param permission The permission we are testing for. Permissions are expressed in
 	 *   'activity.resourceType' format.
 	 *
 	 * @return a permission object. 
 	 *
 	 * @throws NullPointerException if either parameter to this method is null
 	 * @throws IllegalArgumentException if the permission supplied is formatted incorrectly.
 	 */
 	public Permission getPermission(User user, String permission) {
 		// @TODO should get this User out of our userCache, keyed by id
 		if (permission == null) { throw new NullPointerException("Null permission"); }
 		if (user == null) { throw new NullPointerException("Null user"); }
 
 		int pos = permission.indexOf('.');
 		if (pos == -1) {
 			throw new IllegalArgumentException("Illegal permission value '" + permission + "'");
 		}
 
 		//  try per-user permissions...
 		Map<String, Permission> userPermissions = userPermissionCache.get(user);
 		if (userPermissions == null) {
 			// @TODO - load from DB ? should be handled by MRUCache
 			throw new IllegalStateException("Unknown user '" + user.getUsername() + "'");
 		} else {
 			Permission userPermission = (Permission) userPermissions.get(permission);
 			if (userPermission != null) {
 				return userPermission;
 			}
 		}
 
 		return null;
 	}
     
     
     /**
      * Returns a list of all Permission objects assigned to a user and all the 
      * roles that the user is a member of. This allows multiple permission conditions
      * to be applied to a user, one for each role.
      *
      * @param user The user we are determining
      * @param permission The permission we are testing for. Permissions are expressed in
      *   'activity.resourceType' format.
      *
      * @return a List of Permission objects, or an empty list if the user 
      *   (and none of their roles) contains this permission
      *
      * @throws NullPointerException if either parameter to this method is null
      * @throws IllegalArgumentException if the permission supplied is formatted incorrectly.
      */
     public List<Permission> getPermissions(User user, String permission) {
     	// @TODO should get this User out of our userCache, keyed by id
         if (permission == null) { throw new NullPointerException("Null permission"); }
         if (user == null) { throw new NullPointerException("Null user"); }
         List<Permission> result = new ArrayList<Permission>();
 
         int pos = permission.indexOf('.');
         if (pos == -1) {
             throw new IllegalArgumentException("Illegal permission value '" + permission + "'");
         }
 
 		//  try per-user permissions...
 		Map<String, Permission> userPermissions = userPermissionCache.get(user);
 		if (userPermissions == null) {
 			// @TODO - load from DB ? should be handled by MRUCache
 			throw new IllegalStateException("Unknown user '" + user.getUsername() + "'");
 		} else {
 			Permission userPermission = (Permission) userPermissions.get(permission);
 			if (userPermission != null) {
 				result.add(userPermission);
 			}
 		}
 		
 		// then try per-role permissions ...
 		List<String> roles = userRoleCache.get(user);
 		if (roles == null) {
 			throw new IllegalStateException("Unknown user '" + user.getUsername() + "'");
 		} else {
 			for (Iterator<String> i = roles.iterator(); i.hasNext(); ) {
 				String rolename = (String) i.next();
 				Map<String, Permission> rolePermissions = rolePermissionCache.get(rolename);
 				if (rolePermissions == null) {
 					throw new IllegalStateException("Unknown role '" + rolename + "'");
 				} else {
 					Permission rolePermission = (Permission) rolePermissions.get(permission);
 					if (rolePermission!=null) {
 						result.add(rolePermission);
 					}
 				}
 			}
 		}
 		return result;
     }
     
 
 
     /** Returns a string representation of this security context.
      *
      * @return a string representation of this security context.
      */
     public String toString() {
         return super.toString() + (rolePermissionCache == null ? " - uninitialised" : ": " + rolePermissionCache.toString());
     }
 
     /** Clear all caches and re-initialises this security context (as defined 
      * in this instance's initial initialisation properties). 
      * This method also resets this security context's loader.
      */
     @SuppressWarnings("unchecked")
 	public void resetSecurityContext() {
         // logger.debug("Security context properties: " + properties.toString());
     	
 		int cacheSize = Integer.MAX_VALUE;
 		int cacheExpiry = Integer.MAX_VALUE;
         if (properties.get(INIT_USER_CACHE_SIZE) != null && properties.get(INIT_USER_CACHE_EXPIRY) != null) {
             cacheSize = Integer.parseInt((String) properties.get(INIT_USER_CACHE_SIZE));
             cacheExpiry = Integer.parseInt((String) properties.get(INIT_USER_CACHE_EXPIRY));
         }
 
         UserPermissionCallback userPermissionCallback = new UserPermissionCallback(this.securityLoader);
         userPermissionCache = new MRUCache(cacheSize, cacheExpiry, userPermissionCallback );
 
 		UserRoleCallback userRoleCallback = new UserRoleCallback (this.securityLoader);
 		userRoleCache = new MRUCache(cacheSize, cacheExpiry, userRoleCallback );
 
 		RolePermissionCallback rolePermissionCallback = new RolePermissionCallback (this.securityLoader);
 		rolePermissionCache = new MRUCache(cacheSize, cacheExpiry, rolePermissionCallback );
 
 		UserCallback userCallback = new UserCallback (this.securityLoader);
 		userCache = new MRUCache(cacheSize, cacheExpiry, userCallback );
 
 		try {
 			securityLoader.resetSecurityContext();	
 		} catch (IOException ioe) {
 			throw (IllegalArgumentException) new IllegalArgumentException(
 			  "Cannot initialise security Context").initCause(ioe);
 		}
     }
 
     /**
      * Authenticate the supplied username and password with the authentication provider.
      * Returns true if the username/password combination is valid, false otherwise
      *
      * <p>Some authentication providers may require more complex handshakes (e.g. TFA authentication)
      * which are currently suported by setting flags in a subclassed User object. 
      * Possible mangling the password parameter as well. See the securityAuthenticator
      * documentation for details.
      *
      * <p>The User object passed to this method may not have a valid userId assigned to it (this 
      * may be set by the authentication provider).
      *
      * @param user user 
      * @param password password
      *
      * @return true if the username/password combination is valid, false otherwise
      *
      * @throws IOException an exception occurred accessing the authentication provider.
      */
     public boolean authenticate(User user, String password)
         throws IOException {
     	// @TODO should get this User out of our userCache, keyed by id
         return securityAuthenticator.authenticate(user, password);
     }
 
     /** Returns a User, given their userId
      * 
      * <p>This method will not load role or permissions data for the user. 
      * 
      * @param userId
      * @return
      */
     public User getUser(long userId) {
     	// this cache has different User objects than the User objects in the role/user permission caches, 
 		User user = (User) userCache.get(userId);
 		return user;
     }
 
     
 	// why are these methods public ?
     public List<Permission> loadRolePermissions(String role)
         throws IOException {
         return securityLoader.loadRolePermissions(role);
     }
 
     public List<Permission> loadUserRolePermissions(User user)
         throws IOException {
         return securityLoader.loadUserRolePermissions(user);
     }
 
 
 }