/**
   * Set the roles for a user for a given document. The setEditRoles() method works in conjunction
   * with the above editRoles() method. The editRoles() method causes the Edit Roles web page to be
   * displayed. The setEditRoles() is invoked when the user clicks on the save button. Note that the
   * Edit Roles BO created in editRoles() is retrieved in setEditRoles() to determine the user and
   * what the new roles should be.
   *
   * @param mapping the mapping associated with this action.
   * @param form the form.
   * @param request the HTTP request
   * @param response the HTTP response
   * @return the next web page to display
   * @throws Exception
   */
  @Override
  public ActionForward setEditRoles(
      ActionMapping mapping,
      ActionForm form,
      HttpServletRequest request,
      HttpServletResponse response)
      throws Exception {

    ActionForward actionForward = null;

    PermissionsHelperBase permissionsHelper = ((PermissionsForm) form).getPermissionsHelper();
    PermissionsForm permissionsForm = (PermissionsForm) form;
    Document doc = permissionsForm.getDocument();

    // early exit if not authorized
    if (!permissionsHelper.canModifyPermissions()) {
      return protocolPermissionsAction.processAuthorizationViolation(
          SET_EDIT_ROLES_METHOD, mapping, form, request, response);
    }

    // The Edit Roles BO contains the username, javascriptEnabled, and the new set of
    // roles to set for the user in the document.

    PermissionsUserEditRoles editRoles = permissionsHelper.getEditRoles();

    // check any business rules
    boolean rulePassed =
        applyRules(new EditUserPermissionsRolesEvent(doc, permissionsHelper.getUsers(), editRoles));
    if (!rulePassed) {

      // If the user can't perform the save of the roles, then we will report the
      // error on the Edit Roles web page.  This allows the user to fix the error
      // and re-submit the save.

      actionForward = mapping.findForward(Constants.MAPPING_PERMISSIONS_EDIT_ROLES_PAGE);
    } else {
      updateRoles(editRoles, permissionsHelper);

      // If Javascript was enabled, we can simply cause the pop-up window to close.
      // If not, then we must return the user to the Permissions page.

      if (editRoles.getJavaScriptEnabled()) {
        actionForward = mapping.findForward(Constants.MAPPING_PERMISSIONS_CLOSE_EDIT_ROLES_PAGE);
      } else {
        actionForward = mapping.findForward(Constants.MAPPING_BASIC);
      }
    }

    return actionForward;
  }