LinkedDocumentResource.java

package com.wesabe.grendel.resources;

import javax.ws.rs.Consumes;
import javax.ws.rs.DELETE;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
import javax.ws.rs.Produces;
import javax.ws.rs.WebApplicationException;
import javax.ws.rs.core.CacheControl;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.Response.Status;

import com.google.inject.Inject;
import com.wesabe.grendel.auth.Credentials;
import com.wesabe.grendel.auth.Session;
import com.wesabe.grendel.entities.Document;
import com.wesabe.grendel.entities.User;
import com.wesabe.grendel.entities.dao.DocumentDAO;
import com.wesabe.grendel.entities.dao.UserDAO;
import com.wesabe.grendel.openpgp.CryptographicException;
import com.wideplay.warp.persist.Transactional;

/**
 * A class which exposes a linked {@link Document} as a resource.
 * 
 * @author coda
 */
@Path("/users/{user_id}/linked-documents/{owner_id}/{name}")
@Consumes(MediaType.WILDCARD)
@Produces(MediaType.WILDCARD)
public class LinkedDocumentResource {
	private static final CacheControl CACHE_SETTINGS;
	static {
		CACHE_SETTINGS = new CacheControl();
		CACHE_SETTINGS.setNoCache(true);
		CACHE_SETTINGS.setNoStore(true);
		CACHE_SETTINGS.setPrivate(true);
	}

	private final UserDAO userDAO;
	private final DocumentDAO documentDAO;

	@Inject
	public LinkedDocumentResource(UserDAO userDAO, DocumentDAO documentDAO) {
		this.userDAO = userDAO;
		this.documentDAO = documentDAO;
	}

	/**
	 * Responds to a {@link GET} request by decrypting the {@link Document} body
	 * and returning it.
	 * <p>
	 * <strong>N.B.:</strong> Requires Basic authentication.
	 */
	@GET
	public Response show(@Context Credentials credentials,
		@PathParam("user_id") String userId, @PathParam("owner_id") String ownerId,
		@PathParam("name") String name) {
		
		final Session session = credentials.buildSession(userDAO, userId);
		final User owner = findUser(ownerId);
		final Document doc = findDocument(owner, name);
		
		checkLinkage(doc, session.getUser());
		
		try {
			final byte[] body = doc.decryptBody(session.getKeySet());
			return Response.ok()
					.entity(body)
					.type(doc.getContentType())
					.cacheControl(CACHE_SETTINGS)
					.lastModified(doc.getModifiedAt().toDate())
					.build();
		} catch (CryptographicException e) {
			throw new RuntimeException(e);
		}
	}

	/**
	 * Responds to a {@link DELETE} request by deleting the {@link User}'s
	 * access to this {@link Document}. This does <strong>not</strong> delete
	 * the document itself, nor does it re-encrypt the document.
	 * <p>
	 * <strong>N.B.:</strong> Requires Basic authentication.
	 */
	@DELETE
	@Transactional
	public Response delete(@Context Credentials credentials,
		@PathParam("user_id") String userId, @PathParam("owner_id") String ownerId,
		@PathParam("name") String name) {
		
		final Session session = credentials.buildSession(userDAO, userId);
		final User owner = findUser(ownerId);
		final Document doc = findDocument(owner, name);
		
		checkLinkage(doc, session.getUser());
		
		doc.unlinkUser(session.getUser());
		documentDAO.saveOrUpdate(doc);
		
		return Response.noContent().build();
	}
	
	private Document findDocument(User owner, String name) {
		final Document doc = documentDAO.findByOwnerAndName(owner, name);
		if (doc == null) {
			throw new WebApplicationException(Status.NOT_FOUND);
		}
		return doc;
	}

	private void checkLinkage(Document doc, User user) {
		if (!doc.isLinked(user)) {
			throw new WebApplicationException(Status.NOT_FOUND);
		}
	}
	
	private User findUser(String id) {
		final User user = userDAO.findById(id);
		if (user == null) {
			throw new WebApplicationException(Status.NOT_FOUND);
		}
		
		return user;
	}
}