package org.restafarian.core.security;

 import javax.servlet.ServletContext;

 import javax.servlet.http.HttpServletRequest;

 import javax.servlet.http.HttpServletResponse;

 import org.apache.commons.configuration.Configuration;

 import org.apache.commons.logging.Log;

 import org.apache.commons.logging.LogFactory;

 import org.restafarian.core.beans.Person;

 /**

  * <p>This module finds and returns the currently authenticated user

  * by returning the user stored in the session object.</p>

  */

 public class SessionBasedUserManager implements UserManager {

         private static final String AUTHENTICATED_USER = "authenticatedUser";

         private Log log = LogFactory.getLog(getClass());

         /**

          * <p>Initializes the module using the configuration.</p>

          *

          * @param context the <code>ServletContext</code> object

          * @param config the <code>Configuration</code> object

          */

         public void init(ServletContext context, Configuration config) {

                 log.info("Initializing the SessionBasedUserManager.");

         }

         /**

          * <p>Returns the currently authenticated user, or null, if there is

          * no user currently authenticated.</p>

          *

          * @param req the <code>HttpServletRequest</code> object

          * @return the currently authenticated user

          */

         public Person getAuthenticatedUser(HttpServletRequest req) {

                 return (Person) req.getSession().getAttribute(AUTHENTICATED_USER);

         }

         /**

          * <p>Sets the currently authenticated user.</p>

          *

          * @param req the <code>HttpServletRequest</code> object

          * @param res the <code>HttpServletResponse</code> object

          * @param user the currently authenticated user

          */

         public void setAuthenticatedUser(HttpServletRequest req, HttpServletResponse res, Person user) {

                 if (user != null) {

                         req.getSession().setAttribute(AUTHENTICATED_USER, user);

                 } else {

                         req.getSession().removeAttribute(AUTHENTICATED_USER);

                 }

         }

 }