func (pc PagesController) genCommentIndexResponse(curUser *CurrentUserInfo,
	wikiId string, pageId string, commentList *wikit.CommentIndexViewResponse) CommentIndexResponse {
	commentsUri := pc.genPageUri(wikiId, pageId) + "/comments"
	userRoles := curUser.User.Roles
	dbName := "wiki_" + wikiId
	admin := util.HasRole(userRoles, AdminRole(dbName)) ||
		util.HasRole(userRoles, AdminRole(MainDbName())) ||
		util.HasRole(userRoles, MasterRole())
	write := util.HasRole(userRoles, WriteRole(dbName))
	indexLinks := HatLinks{}
	indexLinks.Self = &HatLink{Href: commentsUri, Method: "GET"}
	if admin || write {
		indexLinks.Create = &HatLink{Href: commentsUri, Method: "POST"}
	}
	var entries []CommentResponse
	for _, com := range commentList.Rows {
		entries = append(entries,
			pc.genCommentRecordResponse(curUser, wikiId, pageId, com.Id, &com.Value))
	}
	return CommentIndexResponse{
		Links:     indexLinks,
		TotalRows: commentList.TotalRows,
		Offset:    commentList.Offset,
		Entries: CommentIndexList{
			List: entries,
		},
	}
}

func (wc WikisController) genWikiLinks(userRoles []string,
	wikiId string, dbName string, uri string) wikiLinks {
	//First, add links for wikiRecord in main db
	links := wikiLinks{}
	//Now check admin rights for wiki db and add links
	wikiDb := "wiki_" + wikiId
	admin := util.HasRole(userRoles, AdminRole(wikiDb)) ||
		util.HasRole(userRoles, AdminRole(MainDbName())) ||
		util.HasRole(userRoles, MasterRole())
	read := util.HasRole(userRoles, ReadRole(wikiDb))
	write := util.HasRole(userRoles, WriteRole(wikiDb))
	pageUri := uri + "/pages"
	links.Self = &HatLink{Href: uri, Method: "GET"}
	if admin || read || write {
		links.PageIndex = &HatLink{Href: pageUri, Method: "GET"}
	}
	if admin || write {
		links.Update = &HatLink{Href: uri, Method: "PUT"}
		links.CreatePage = &HatLink{Href: pageUri, Method: "POST"}
	}
	if admin {
		links.Delete = &HatLink{Href: uri, Method: "DELETE"}
	}
	return links
}

//Revoke user access
func (um *UserManager) RevokeRole(id string,
	revokeRequest *RoleRequest,
	curUser *CurrentUserInfo) (string, error) {

	theUser := curUser.User
	//Make sure user is an admin of the resource being requested
	resourceDbName := resourceDbName(revokeRequest)
	if !util.HasRole(theUser.Roles, AdminRole(MainDbName())) &&
		!util.HasRole(theUser.Roles, AdminRole(resourceDbName)) {
		//Not an admin
		return "", NotAdminError()
	}
	//Fetch the user
	userDb := Connection.SelectDB(UserDbName, AdminAuth)
	readUser := new(User)
	rev, err := userDb.Read(UserPrefix+id, readUser, nil)
	if err != nil {
		return "", err
	}
	//validate the role request
	if revokeRequest.validate() == false {
		return "", BadRequestError()
	}
	//ok, revoke the role
	revokeRole := revokeRequest.roleString()
	rev, err = Connection.RevokeRole(id, revokeRole, AdminAuth)
	if err != nil {
		return "", err
	}
	return rev, nil
}

//Get user list
func (uc UsersController) list(request *restful.Request,
	response *restful.Response) {
	curUser := GetCurrentUser(request, response)
	if curUser == nil {
		Unauthenticated(request, response)
		return
	}
	var limit int
	var pageNum int
	limitString := request.QueryParameter("numPerPage")
	if limitString == "" {
		limit = 0
	} else {
		ln, err := strconv.Atoi(limitString)
		if err != nil {
			log.Printf("Error: %v", err)
			WriteIllegalRequestError(response)
			return
		}
		limit = ln
	}
	pageNumString := request.QueryParameter("pageNum")
	if pageNumString == "" {
		pageNum = 1
	} else {
		if ln, err := strconv.Atoi(pageNumString); err != nil {
			log.Printf("Error: %v", err)
			WriteIllegalRequestError(response)
		} else {
			pageNum = ln
		}
	}
	ulr := UserListQueryResponse{}
	forResource := request.QueryParameter("forResource")
	searchText := request.QueryParameter("searchText")
	var err error
	if forResource != "" {
		//Make sure the user is an admin for the given resource
		if !util.HasRole(curUser.User.Roles, AdminRole(forResource)) &&
			!util.HasRole(curUser.User.Roles, AdminRole(MainDbName())) {
			WriteError(NotAdminError(), response)
			return
		}
		rolesArray := []string{AdminRole(forResource),
			WriteRole(forResource), ReadRole(forResource)}
		err = new(UserManager).GetUserListForRole(
			pageNum, limit, rolesArray, &ulr, curUser)
	} else if searchText != "" {
		err = new(UserManager).SearchForUsersByName(pageNum, limit, searchText, &ulr, curUser)
	} else {
		err = new(UserManager).GetUserList(pageNum, limit, &ulr, curUser)
	}
	if err != nil {
		WriteError(err, response)
		return
	}
	uir := uc.genUserListResponse(curUser, &ulr)
	SetAuth(response, curUser.Auth)
	response.WriteEntity(uir)
}

//Create a normal user
func (um *UserManager) Create(newUser *User,
	curUser *CurrentUserInfo) (string, error) {
	//Who am I?
	theUser := curUser.User

	//check for admin
	if !util.HasRole(theUser.Roles, AdminRole(MainDbName())) &&
		!util.HasRole(theUser.Roles, MasterRole()) {
		return "", NotAdminError()
	}
	//ok, now create the user
	err := um.validateUser(newUser)
	if err != nil {
		return "", err
	}
	newUser.Roles = []string{ReadRole(MainDbName()), AllUsersRole()}
	newUser.Type = "user"
	namestring := UserPrefix + newUser.UserName
	nowTime := time.Now().UTC()
	newUser.CreatedAt = nowTime
	newUser.ModifiedAt = nowTime

	userDb := Connection.SelectDB(UserDbName, AdminAuth)
	log.Printf("Creating new user account for: %v", newUser.UserName)
	return userDb.Save(newUser, namestring, "")
}

//Create usual links for an index
func GenIndexLinks(userRoles []string, dbName string, uri string) HatLinks {
	links := HatLinks{}
	admin := util.HasRole(userRoles, AdminRole(dbName))
	write := util.HasRole(userRoles, WriteRole(dbName))
	//Generate the self link
	links.Self = &HatLink{Href: uri, Method: "GET"}
	if admin || write {
		links.Create = &HatLink{Href: uri, Method: "POST"}
	}
	return links
}

func (fc FileController) genFileRecordLinks(userRoles []string,
	wikiDb string, uri string) fileLinks {
	links := fileLinks{}
	admin := util.HasRole(userRoles, AdminRole(wikiDb))
	write := util.HasRole(userRoles, WriteRole(wikiDb))
	links.Self = &HatLink{Href: uri, Method: "GET"}
	links.GetAttachment = &HatLink{Href: uri + "/content", Method: "GET"}
	if admin || write {
		links.Update = &HatLink{Href: uri, Method: "PUT"}
		links.Delete = &HatLink{Href: uri, Method: "DELETE"}
		links.SaveAttachment = &HatLink{Href: uri + "/content", Method: "PUT"}
	}
	return links
}

//Create the basic CRUD links for a resource record
func GenRecordLinks(userRoles []string, dbName string, uri string) HatLinks {
	links := HatLinks{}
	//Admin can be a resource admin OR a site admin/master
	admin := util.HasRole(userRoles, AdminRole(dbName)) ||
		util.HasRole(userRoles, AdminRole(MainDbName())) ||
		util.HasRole(userRoles, MasterRole())
	write := util.HasRole(userRoles, WriteRole(dbName))
	//Generate the self link
	links.Self = &HatLink{Href: uri, Method: "GET"}
	if admin || write {
		links.Update = &HatLink{Href: uri, Method: "PUT"}
		links.Delete = &HatLink{Href: uri, Method: "DELETE"}
	}
	return links
}

//Update a user
func (um *UserManager) Update(id string, rev string, updatedUser *User,
	curUser *CurrentUserInfo) (string, error) {
	//Who am I?
	theUser := curUser.User
	var auth couchdb.Auth
	//make sure Id matches the user object
	if id != updatedUser.UserName {
		return "", BadRequestError()
	}
	//check for admin
	if util.HasRole(theUser.Roles, AdminRole(MainDbName())) ||
		util.HasRole(theUser.Roles, MasterRole()) {
		auth = AdminAuth
	} else {
		auth = curUser.Auth
	}
	if err := um.validateUser(updatedUser); err != nil {
		return "", err
	}
	userDb := Connection.SelectDB(UserDbName, auth)
	//pull the user record
	namestring := UserPrefix + id
	//readUser := FullUserRecord{}
	var userData interface{}
	_, err := userDb.Read(namestring, &userData, nil)
	if err != nil {
		return "", err
	}
	readUser := userData.(map[string]interface{})
	//Update the user parameters of the read user
	//We do this instead of just pushing the updated user to CouchDB,
	//because the updated user doesn't contain password information,
	//and we don't want to wipe away the password.
	nowTime := time.Now().UTC()
	readUser["modifiedAt"] = nowTime
	readUser["userPublic"] = updatedUser.Public
	readUser["userName"] = updatedUser.UserName
	readUser["passwordReset"] = updatedUser.PassResetToken
	//And save the updated user
	uRev, err := userDb.Save(&readUser, namestring, rev)
	if err != nil {
		return "", err
	}
	//Censor the password
	//updatedUser.Password = ""
	return uRev, nil

}

//Get a user
func (um *UserManager) Read(id string, user *User,
	curUser *CurrentUserInfo) (string, error) {
	//Who am I?
	theUser := curUser.User
	readUser := User{}
	if util.HasRole(theUser.Roles, AdminRole(MainDbName())) {
		//This is an admin
		userDb := Connection.SelectDB(UserDbName, AdminAuth)
		rev, err := userDb.Read(UserPrefix+id, &readUser, nil)
		if err != nil {
			return "", err
		} else {
			*user = readUser
			return rev, nil
		}
	} else {
		userDb := Connection.SelectDB(UserDbName, curUser.Auth)
		if rev, err := userDb.Read(UserPrefix+id, &readUser, nil); err != nil {
			return "", err
		} else {
			*user = readUser
			return rev, nil
		}
	}
}

//Create a new wiki
func (wm *WikiManager) Create(id string, wr *WikiRecord,
	curUser *CurrentUserInfo) (string, error) {
	auth := curUser.Auth
	theUser := curUser.User
	//Verify user is authorized to create wikis
	mainDb := MainDbName()
	if !util.HasRole(theUser.Roles, AdminRole(mainDb)) &&
		!util.HasRole(theUser.Roles, WriteRole(mainDb)) {
		return "", NotAdminError()
	}
	owner := theUser.UserName
	//Add an entry for this wiki to the Main db
	wr.Id = id
	wr.Slug = slugification.Slugify(wr.Name)
	wr.CreatedAt = time.Now().UTC()
	wr.ModifiedAt = time.Now().UTC()
	wr.Type = "wiki_record"
	if err := wr.Validate(); err != nil {
		return "", err
	}
	cDb := Connection.SelectDB(mainDb, auth)
	log.Printf("Adding wiki entry %v to db %v", id, mainDb)
	rev, err := cDb.Save(&wr, id, "")
	//Check for duplicate slugs
	err = wm.checkForDuplicateSlug(wr.Slug)
	if err != nil {
		//Delete the wiki record we just created
		cDb.Delete(id, rev)
		return "", err
	}
	//Create the Wiki
	log.Printf("Creating Wiki: %v", id)
	err = wikit.CreateWiki(Connection, AdminAuth, owner, WikiDbName(id))
	if err != nil {
		//Delete the wiki record from maindb
		cDb.Delete(id, rev)
		return "", err
	}

	//Set Guest Acess
	if err := wm.setGuestAccess(id, wr, auth); err != nil {
		return rev, err
	}
	//wr.Id = id
	return rev, nil
}

//Generates the Links for a UserAvatar Record Response
func (ac AvatarController) genAvatarRecordLinks(user *User,
	userId string, uri string) avatarLinks {
	links := avatarLinks{}
	userRoles := user.Roles
	admin := util.HasRole(userRoles, AdminRole(MainDbName())) ||
		util.HasRole(userRoles, MasterRole())
	write := user.UserName == userId
	links.Self = &HatLink{Href: uri, Method: "GET"}
	links.GetLargeAvatar = &HatLink{Href: uri + "/image", Method: "GET"}
	links.GetThumbnailAvatar = &HatLink{Href: uri + "/thumbnail", Method: "GET"}
	if admin || write {
		links.Update = &HatLink{Href: uri, Method: "PUT"}
		links.Delete = &HatLink{Href: uri, Method: "DELETE"}
		links.SaveImage = &HatLink{Href: uri + "/image", Method: "PUT"}
	}
	return links
}

// Permissions are a bit different for comments, so we need a custom function
func (pc PagesController) genCommentRecordLinks(curUser *CurrentUserInfo,
	dbName string, commentUri string, commentAuthor string) HatLinks {
	links := HatLinks{}
	userRoles := curUser.User.Roles
	admin := util.HasRole(userRoles, AdminRole(dbName)) ||
		util.HasRole(userRoles, AdminRole(MainDbName())) ||
		util.HasRole(userRoles, MasterRole())
	ownComment := commentAuthor == curUser.User.UserName
	//Generate the self link
	links.Self = &HatLink{Href: commentUri, Method: "GET"}
	//Update links
	if admin || ownComment {
		links.Update = &HatLink{Href: commentUri, Method: "PUT"}
		links.Delete = &HatLink{Href: commentUri, Method: "DELETE"}
	}
	return links
}

//Delete a User Avatar Record
func (uam *UserAvatarManager) Delete(id string, curUser *CurrentUserInfo) (string, error) {
	theUser := curUser.User
	var auth couchdb.Auth
	if util.HasRole(theUser.Roles, AdminRole(MainDbName())) ||
		util.HasRole(theUser.Roles, MasterRole()) {
		auth = AdminAuth
	} else {
		auth = curUser.Auth
	}
	avatarDb := Connection.SelectDB(AvatarDbName(), auth)
	//Fetch the record
	avatarRecord := new(UserAvatar)
	rev, err := avatarDb.Read(id, avatarRecord, nil)
	if err != nil {
		return "", err
	}
	return avatarDb.Delete(id, rev)
}

//Save User Avatar Record
func (uam *UserAvatarManager) Save(id string, rev string,
	avatar *UserAvatar, curUser *CurrentUserInfo) (string, error) {
	nowTime := time.Now().UTC()
	if rev == "" {
		avatar.CreatedAt = nowTime
	}
	avatar.ModifiedAt = nowTime
	var auth couchdb.Auth
	//check for admin
	if util.HasRole(curUser.Roles, AdminRole(MainDbName())) ||
		util.HasRole(curUser.Roles, MasterRole()) {
		auth = AdminAuth
	} else {
		auth = curUser.Auth
	}
	avatarDb := Connection.SelectDB(AvatarDbName(), auth)
	return avatarDb.Save(avatar, id, rev)
}

// Change a user's password
func (um *UserManager) ChangePassword(id string, rev string,
	cpr *ChangePasswordRequest, curUser *CurrentUserInfo) (string, error) {
	theUser := curUser.User
	var auth couchdb.Auth
	//check for admin
	isAdmin := util.HasRole(theUser.Roles, AdminRole(MainDbName())) ||
		util.HasRole(theUser.Roles, MasterRole())

	if isAdmin {
		auth = AdminAuth
	} else {
		auth = curUser.Auth
	}
	//Must we validate the old password?
	if !isAdmin || (isAdmin && theUser.UserName == id) {
		//yes, let's use the old password to do this thing
		auth = &couchdb.BasicAuth{Username: id, Password: cpr.OldPassword}
	}
	//validate password
	err := um.validatePassword(cpr.NewPassword)
	if err != nil {
		return "", err
	}
	userDb := Connection.SelectDB(UserDbName, auth)
	//pull the user record
	namestring := UserPrefix + id
	var userData interface{}
	_, err = userDb.Read(namestring, &userData, nil)
	if err != nil {
		return "", err
	}
	readUser := userData.(map[string]interface{})
	//Update JUST the password (and modified time)
	nowTime := time.Now().UTC()
	readUser["modifiedAt"] = nowTime
	readUser["password"] = cpr.NewPassword
	//Save the updated user
	uRev, err := userDb.Save(&readUser, namestring, rev)
	if err != nil {
		return "", err
	}
	return uRev, nil

}

//Grant a role to a user
func (um *UserManager) GrantRole(id string,
	grantRequest *RoleRequest,
	curUser *CurrentUserInfo) (string, error) {

	newRole := grantRequest.roleString()
	//Who am I?
	theUser := curUser.User
	//Make sure user is an admin of the resource being requested
	resourceDbName := resourceDbName(grantRequest)
	if !util.HasRole(theUser.Roles, AdminRole(MainDbName())) &&
		!util.HasRole(theUser.Roles, MasterRole()) &&
		!util.HasRole(theUser.Roles, AdminRole(resourceDbName)) {
		//Not an admin
		return "", NotAdminError()
	}
	//Are we trying to grant the site admin role?
	//If so, curUser must be a master user
	if newRole == AdminRole(MainDbName()) &&
		!util.HasRole(theUser.Roles, MasterRole()) {
		return "", NotAdminError()

	}
	//Fetch the user
	userDb := Connection.SelectDB(UserDbName, AdminAuth)
	readUser := new(User)
	rev, err := userDb.Read(UserPrefix+id, readUser, nil)
	if err != nil {
		return "", err
	}
	//validate the role request
	if grantRequest.validate() == false {
		return "", BadRequestError()
	}
	//All is well, grant the role
	rev, err = Connection.GrantRole(id, newRole, AdminAuth)
	if err != nil {
		return "", err
	}
	return rev, nil
}

func (pm *PageManager) allowedToUpdateComment(wiki string, commentId string,
	curUser *CurrentUserInfo) bool {
	userName := curUser.User.UserName
	userRoles := curUser.User.Roles
	auth := curUser.Auth
	theWiki := wikit.SelectWiki(Connection, wikiDbString(wiki), auth)
	//First, we need to read the comment record
	comment := wikit.Comment{}
	_, err := theWiki.ReadComment(commentId, &comment)
	if err != nil {
		return false
	}
	//Only admins and the original comment author may update/delete
	isAdmin := util.HasRole(userRoles, AdminRole(wiki)) ||
		util.HasRole(userRoles, AdminRole(MainDbName())) ||
		util.HasRole(userRoles, MasterRole())
	if comment.Author == userName || isAdmin {
		return true
	} else {
		return false
	}

}

// Generate links for a user record response
func (uc UsersController) genUserRecordLinks(userRoles []string,
	userId string, curUserId string, uri string) HatLinks {
	links := HatLinks{}
	dbName := MainDbName()
	admin := util.HasRole(userRoles, AdminRole(dbName))
	//Write := util.HasRole(userRoles, WriteRole(dbName))
	self := func() bool {
		if curUserId == userId {
			return true
		} else {
			return false
		}
	}()
	links.Self = &HatLink{Href: uri, Method: "GET"}
	if admin || self {
		links.Update = &HatLink{Href: uri, Method: "PUT"}
	}
	return links
}

//Delete a user
func (um *UserManager) Delete(id string,
	curUser *CurrentUserInfo) (string, error) {
	//Who am I?
	theUser := curUser.User
	//check for admin
	if !util.HasRole(theUser.Roles, AdminRole(MainDbName())) {
		return "", NotAdminError()
	}
	//pull the user record
	namestring := UserPrefix + id
	readUser := new(User)
	rev, err := um.Read(id, readUser, curUser)
	if err != nil {
		return "", err
	}
	//Do the delete
	theDb := Connection.SelectDB(UserDbName, AdminAuth)
	return theDb.Delete(namestring, rev)
}