UserResource.java

/*******************************************************************************
 * Copyright (c) 2013 aegif.
 *
 * This file is part of NemakiWare.
 *
 * NemakiWare is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * NemakiWare is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along with NemakiWare.
 * If not, see <http://www.gnu.org/licenses/>.
 *
 * Contributors:
 *     linzhixing(https://github.com/linzhixing) - initial API and implementation
 ******************************************************************************/
package jp.aegif.nemaki.rest;

import java.text.SimpleDateFormat;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Set;

import javax.servlet.http.HttpServletRequest;
import javax.ws.rs.Consumes;
import javax.ws.rs.DELETE;
import javax.ws.rs.FormParam;
import javax.ws.rs.GET;
import javax.ws.rs.POST;
import javax.ws.rs.PUT;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
import javax.ws.rs.Produces;
import javax.ws.rs.QueryParam;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.MediaType;

import jp.aegif.nemaki.businesslogic.PrincipalService;
import jp.aegif.nemaki.common.ErrorCode;
import jp.aegif.nemaki.model.User;
import jp.aegif.nemaki.util.AuthenticationUtil;
import jp.aegif.nemaki.util.PropertyManager;
import jp.aegif.nemaki.util.constant.PropertyKey;

import org.apache.chemistry.opencmis.commons.server.CallContext;
import org.apache.commons.collections.CollectionUtils;
import org.apache.commons.lang.StringUtils;
import org.json.simple.JSONArray;
import org.json.simple.JSONObject;
import org.json.simple.parser.JSONParser;
import org.json.simple.parser.ParseException;
import org.mindrot.jbcrypt.BCrypt;
import org.springframework.stereotype.Component;

@Component
@Path("/repo/{repositoryId}/user/")
public class UserResource extends ResourceBase {

	PrincipalService principalService;
	public void setPrincipalService(PrincipalService principalService) {
		this.principalService = principalService;
	}

	SolrResource solrResource;
	public void setSolrResource(SolrResource value){
		this.solrResource = value;
	}

	private PropertyManager propertyManager;
	public void setPropertyManager(PropertyManager propertyManager) {
		this.propertyManager = propertyManager;
	}

	@SuppressWarnings("unchecked")
	@GET
	@Path("/list")
	@Produces(MediaType.APPLICATION_JSON)
	public String list(@PathParam("repositoryId") String repositoryId) {
		boolean status = true;
		JSONObject result = new JSONObject();
		JSONArray listJSON = new JSONArray();
		JSONArray errMsg = new JSONArray();

		// Get all users list
		List<User> userList;
		try {
			userList = principalService.getUsers(repositoryId);
			for (User user : userList) {
				JSONObject userJSON = convertUserToJson(user);
				listJSON.add(userJSON);
			}
			result.put("users", listJSON);
		} catch (Exception e) {
			status = false;
			e.printStackTrace();
			addErrMsg(errMsg, ITEM_ALLUSERS, ErrorCode.ERR_LIST);
		}
		result = makeResult(status, result, errMsg);
		return result.toJSONString();
	}

	@SuppressWarnings("unchecked")
	@GET
	@Path("/show/{id}")
	@Produces(MediaType.APPLICATION_JSON)
	public String show(@PathParam("repositoryId") String repositoryId, @PathParam("id") String userId) {
		boolean status = true;
		JSONObject result = new JSONObject();
		JSONArray errMsg = new JSONArray();

		// Validation
		if (StringUtils.isBlank(userId)) {
			status = false;
			addErrMsg(errMsg, ITEM_USERID, ErrorCode.ERR_MANDATORY);
		}

		User user = principalService.getUserById(repositoryId, userId);

		if (user == null) {
			status = false;
			addErrMsg(errMsg, ITEM_USER, ErrorCode.ERR_NOTFOUND);
		} else {
			result.put("user", convertUserToJson(user));
		}
		result = makeResult(status, result, errMsg);
		return result.toJSONString();
	}

	/**
	 * Search user by id TODO Use Solr
	 *
	 * @param query
	 * @return
	 */
	@SuppressWarnings("unchecked")
	@GET
	@Path("/search")
	@Produces(MediaType.APPLICATION_JSON)
	public String search(@PathParam("repositoryId") String repositoryId, @QueryParam("query") String query) {
		boolean status = true;
		JSONObject result = new JSONObject();
		JSONArray errMsg = new JSONArray();

		List<User> users;
		JSONArray queriedUsers = new JSONArray();
		users = principalService.getUsers(repositoryId);
		for (User user : users) {
			if (user.getUserId().startsWith(query) || user.getName().startsWith(query)) {
				JSONObject userJSON = convertUserToJson(user);
				queriedUsers.add(userJSON);
			}
		}

		if (queriedUsers.isEmpty()) {
			status = false;
			addErrMsg(errMsg, ITEM_USER, ErrorCode.ERR_NOTFOUND);
		} else {
			result.put("result", queriedUsers);
		}

		result = makeResult(status, result, errMsg);
		return result.toJSONString();
	}

	@POST
	@Path("/create/{id}")
	@Produces(MediaType.APPLICATION_JSON)
	@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
	public String create(@PathParam("repositoryId") String repositoryId, @PathParam("id") String userId,
			@FormParam(FORM_USERNAME) String name, @FormParam(FORM_PASSWORD) String password,
			@FormParam(FORM_FIRSTNAME) String firstName, @FormParam(FORM_LASTNAME) String lastName,
			@FormParam(FORM_EMAIL) String email, @Context HttpServletRequest httpRequest) {

		boolean status = true;
		JSONObject result = new JSONObject();
		JSONArray errMsg = new JSONArray();

		// Validation
		status = validateNewUser(status, errMsg, userId, name, firstName, lastName, password, repositoryId);

		// Create a user
		if (status) {
			// initialize mandatory but space-allowed parameters
			if (StringUtils.isBlank(lastName))
				lastName = "";
			if (StringUtils.isBlank(email))
				email = "";

			// Generate a password hash
			String passwordHash = BCrypt.hashpw(password, BCrypt.gensalt());

			User user = new User(userId, name, firstName, lastName, email, passwordHash);
			setFirstSignature(httpRequest, user);

			// TODO Error handling
			principalService.createUser(repositoryId, user);

		}
		result = makeResult(status, result, errMsg);
		return result.toJSONString();
	}

	@PUT
	@Path("/changePassword/{id}")
	@Produces(MediaType.APPLICATION_JSON)
	@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
	public String changePassword(@PathParam("repositoryId") String repositoryId, @PathParam("id") String userId,
			@FormParam(FORM_OLDPASSWORD) String oldPassword, @FormParam(FORM_NEWPASSWORD) String newPassword,
			@Context HttpServletRequest httpRequest) {
		boolean status = true;
		JSONObject result = new JSONObject();
		JSONArray errMsg = new JSONArray();

		User user = principalService.getUserById(repositoryId, userId);

		// Validation
		status = checkAuthorityForUser(status, errMsg, httpRequest, userId, repositoryId);
		if (status) {

			if (!AuthenticationUtil.passwordMatches(oldPassword, user.getPasswordHash())) {
				status = false;
				addErrMsg(errMsg, ITEM_USER, ErrorCode.ERR_WRONGPASSWORD);
			}

			// Edit & Update
			if (status) {
				// Edit the user info
				String passwordHash = BCrypt.hashpw(newPassword, BCrypt.gensalt());
				user.setPasswordHash(passwordHash);
				setModifiedSignature(httpRequest, user);

				try {
					principalService.updateUser(repositoryId, user);
				} catch (Exception e) {
					e.printStackTrace();
					status = false;
					addErrMsg(errMsg, ITEM_USER, ErrorCode.ERR_UPDATE);
				}

				setModifiedSignature(httpRequest, user);
				try {
					principalService.updateUser(repositoryId, user);
				} catch (Exception e) {
					e.printStackTrace();
					status = false;
					addErrMsg(errMsg, ITEM_USER, ErrorCode.ERR_UPDATE);
				}

				if(status){
					String solrUserId = propertyManager.readValue(PropertyKey.SOLR_NEMAKI_USERID);
					if(user.getUserId().equals(solrUserId)){
						JSONObject capResult = solrResource.changeAdminPasswordImpl(repositoryId, newPassword, oldPassword, httpRequest);
						if (capResult.get(ITEM_STATUS).toString()  != SUCCESS){
							// TODO: Error handling
							status = false;
							addErrMsg(errMsg, ITEM_USER, capResult.get(ITEM_ERROR).toString());
						}
					}
				}
			}
		}
		makeResult(status, result, errMsg);
		return result.toJSONString();

	}

	@PUT
	@Path("/update/{id}")
	@Produces(MediaType.APPLICATION_JSON)
	@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
	public String update(@PathParam("repositoryId") String repositoryId, @PathParam("id") String userId,
			@FormParam(FORM_USERNAME) String name, @FormParam(FORM_FIRSTNAME) String firstName,
			@FormParam(FORM_LASTNAME) String lastName, @FormParam(FORM_EMAIL) String email,
			@FormParam("addFavorites") String addFavorites, @FormParam("removeFavorites") String removeFavorites,
			@FormParam(FORM_PASSWORD) String password, @Context HttpServletRequest httpRequest) {
		boolean status = true;
		JSONObject result = new JSONObject();
		JSONArray errMsg = new JSONArray();

		// Existing user
		User user = principalService.getUserById(repositoryId, userId);

		// Validation
		status = checkAuthorityForUser(status, errMsg, httpRequest, userId, repositoryId);
		// status = validateUser(status, errMsg, userId, name, firstName,
		// lastName);

		// Edit & Update
		if (status) {
			// Edit the user info
			// if a parameter is not input, it won't be modified.
			if (userId != null)
				user.setUserId(userId);
			if (name != null)
				user.setName(name);
			if (firstName != null)
				user.setFirstName(firstName);
			if (lastName != null)
				user.setLastName(lastName);
			if (email != null)
				user.setEmail(email);
			if (addFavorites != null) {
				try {
					JSONArray l = (JSONArray) (new JSONParser().parse(addFavorites));
					Set<String> fs = user.getFavorites();
					if (CollectionUtils.isEmpty(fs)) {
						fs = new HashSet<String>();
					}
					fs.addAll(l);
					user.setFavorites(fs);
					System.out.println();
					// fs.addAll(l);
				} catch (ParseException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				}
			}
			if (removeFavorites != null) {
				try {
					JSONArray l = (JSONArray) (new JSONParser().parse(removeFavorites));
					user.getFavorites().removeAll(l);
				} catch (ParseException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				}
			}
			if (StringUtils.isNotBlank(password)) {
				// TODO Error handling
				user = principalService.getUserById(repositoryId, userId);

				// Edit & Update
				if (status) {
					// Edit the user info
					String passwordHash = BCrypt.hashpw(password, BCrypt.gensalt());
					user.setPasswordHash(passwordHash);
					setModifiedSignature(httpRequest, user);

					try {
						principalService.updateUser(repositoryId, user);
					} catch (Exception e) {
						e.printStackTrace();
						status = false;
						addErrMsg(errMsg, ITEM_USER, ErrorCode.ERR_UPDATE);
					}
				}
			}
			setModifiedSignature(httpRequest, user);

			try {
				principalService.updateUser(repositoryId, user);
			} catch (Exception e) {
				e.printStackTrace();
				status = false;
				addErrMsg(errMsg, ITEM_USER, ErrorCode.ERR_UPDATE);
			}
		}

		makeResult(status, result, errMsg);
		return result.toJSONString();
	}

	@DELETE
	@Path("/delete/{id}")
	@Produces(MediaType.APPLICATION_JSON)
	public String delete(@PathParam("repositoryId") String repositoryId, @PathParam("id") String userId,
			@Context HttpServletRequest httpRequest) {
		boolean status = true;
		JSONObject result = new JSONObject();
		JSONArray errMsg = new JSONArray();

		// Existing user
		User user = principalService.getUserById(repositoryId, userId);
		if (user == null) {
			status = false;
			addErrMsg(errMsg, ITEM_USER, ErrorCode.ERR_NOTFOUND);
		}

		// Validation
		status = checkAuthorityForUser(status, errMsg, httpRequest, userId, repositoryId);

		// Delete a user
		if (status) {
			try {
				principalService.deleteUser(repositoryId, user.getId());
			} catch (Exception ex) {
				ex.printStackTrace();
				status = false;
				addErrMsg(errMsg, ITEM_USER, ErrorCode.ERR_DELETE);
			}
		} else {
			status = false;
			addErrMsg(errMsg, ITEM_USER, ErrorCode.ERR_DELETE);
		}
		result = makeResult(status, result, errMsg);
		return result.toJSONString();
	}

	private boolean validateUser(boolean status, JSONArray errMsg, String userId, String userName, String firstName,
			String lastName) {
		if (StringUtils.isBlank(userId)) {
			status = false;
			addErrMsg(errMsg, ITEM_USERID, ErrorCode.ERR_MANDATORY);
		}

		if (StringUtils.isBlank(userName)) {
			status = false;
			addErrMsg(errMsg, ITEM_USERNAME, ErrorCode.ERR_MANDATORY);
		}

		return status;
	}

	private boolean validateNewUser(boolean status, JSONArray errMsg, String userId, String userName, String firstName,
			String lastName, String password, String repositoryId) {
		status = validateUser(status, errMsg, userId, userName, firstName, lastName);

		// userID uniqueness
		User user = principalService.getUserById(repositoryId, userId);
		if (user != null) {
			status = false;
			addErrMsg(errMsg, ITEM_USERID, ErrorCode.ERR_ALREADYEXISTS);
		}

		if (StringUtils.isBlank(password)) {
			status = false;
			addErrMsg(errMsg, ITEM_PASSWORD, ErrorCode.ERR_MANDATORY);
		}
		return status;
	}

	@SuppressWarnings("unchecked")
	private JSONObject convertUserToJson(User user) {
		SimpleDateFormat sdf = new SimpleDateFormat(DATE_FORMAT);
		String created = new String();
		try {
			if (user.getCreated() != null) {
				created = sdf.format(user.getCreated().getTime());
			}
		} catch (Exception ex) {
			ex.printStackTrace();
		}
		String modified = new String();
		try {
			if (user.getModified() != null) {
				modified = sdf.format(user.getModified().getTime());
			}
		} catch (Exception ex) {
			ex.printStackTrace();
		}
		JSONObject userJSON = new JSONObject();
		userJSON.clear();
		userJSON.put(ITEM_USERID, user.getUserId());
		userJSON.put(ITEM_USERNAME, user.getName());
		userJSON.put(ITEM_FIRSTNAME, user.getFirstName());
		userJSON.put(ITEM_LASTNAME, user.getLastName());
		userJSON.put(ITEM_EMAIL, user.getEmail());
		userJSON.put(ITEM_TYPE, user.getType());
		userJSON.put(ITEM_CREATOR, user.getCreator());
		userJSON.put(ITEM_CREATED, created);
		userJSON.put(ITEM_MODIFIER, user.getModifier());
		userJSON.put(ITEM_MODIFIED, modified);

		boolean isAdmin = (user.isAdmin() == null) ? false : user.isAdmin();
		userJSON.put(ITEM_IS_ADMIN, isAdmin);

		JSONArray jfs = new JSONArray();
		Set<String> ufs = user.getFavorites();
		if (CollectionUtils.isNotEmpty(ufs)) {
			Iterator<String> ufsItr = ufs.iterator();
			while (ufsItr.hasNext()) {
				jfs.add(ufsItr.next());
			}
		}
		userJSON.put("favorites", jfs);

		return userJSON;
	}

	private boolean checkAuthorityForUser(boolean status, JSONArray errMsg, HttpServletRequest httpRequest,
			String resoureId, String repositoryId) {
		CallContext callContext = (CallContext) httpRequest.getAttribute("CallContext");

		String userId = callContext.getUsername();
		String password = callContext.getPassword();
		if (!userId.equals(resoureId) && !isAdminOperaiton(repositoryId, userId, password) && !isSystemUser(repositoryId, resoureId)) {
			status = false;
			addErrMsg(errMsg, ITEM_USER, ErrorCode.ERR_NOTAUTHENTICATED);
		}
		return status;
	}

	private boolean isSystemUser(String repositoryId, String userId){
		boolean result = false;
		User user = principalService.getUserById(repositoryId, userId);

		result = user.isAdmin();
		if(result) return true;

		String solrUserId = propertyManager.readValue(PropertyKey.SOLR_NEMAKI_USERID);
		result = user.getUserId().equals(solrUserId);
		if(result) return true;

		return result;
	}

	private boolean isAdminOperaiton(String repositoryId, String userId, String password) {
		if (StringUtils.isBlank(userId) || StringUtils.isBlank(password)) {
			return false;
		}

		User user = principalService.getUserById(repositoryId, userId);
		boolean isAdmin = (user.isAdmin() == null) ? false : user.isAdmin();
		if (isAdmin) {
			// password check
			boolean match = BCrypt.checkpw(password, user.getPasswordHash());
			if (match)
				return true;
		}
		return false;
	}


}