# HG changeset patch # User Raimund Renkert # Date 1427129537 -3600 # Node ID a04658486edec8a90dab18c1e9252e3a08700bf1 # Parent bb76a5d7a98db1f2b238c6d74f3f8050eb00859a Use authentication info for authorization of requested objects. diff -r bb76a5d7a98d -r a04658486ede src/main/java/de/intevation/lada/query/QueryTools.java --- a/src/main/java/de/intevation/lada/query/QueryTools.java Mon Mar 23 17:50:51 2015 +0100 +++ b/src/main/java/de/intevation/lada/query/QueryTools.java Mon Mar 23 17:52:17 2015 +0100 @@ -24,6 +24,9 @@ import javax.persistence.Query; import javax.ws.rs.core.MultivaluedMap; +import de.intevation.lada.util.auth.Authorization; +import de.intevation.lada.util.auth.UserInfo; + /** * Utility class to handle the SQL query configuration. @@ -159,13 +162,19 @@ public static List> prepareResult( List result, - List names + List names, + Authorization authorization, + UserInfo userInfo ) { List> ret = new ArrayList>(); for (Object[] row: result) { Map set = new HashMap(); for (int i = 0; i < row.length; i++) { set.put(names.get(i), row[i]); + if (names.get(i).toString().equals("id")) { + boolean readOnly = authorization.isReadOnly((Integer)row[i]); + set.put("readonly", readOnly); + } } ret.add(set); } diff -r bb76a5d7a98d -r a04658486ede src/main/java/de/intevation/lada/rest/KommentarMService.java --- a/src/main/java/de/intevation/lada/rest/KommentarMService.java Mon Mar 23 17:50:51 2015 +0100 +++ b/src/main/java/de/intevation/lada/rest/KommentarMService.java Mon Mar 23 17:52:17 2015 +0100 @@ -9,6 +9,7 @@ import javax.enterprise.context.RequestScoped; import javax.inject.Inject; +import javax.servlet.http.HttpServletRequest; import javax.ws.rs.DELETE; import javax.ws.rs.GET; import javax.ws.rs.POST; @@ -22,42 +23,29 @@ import javax.ws.rs.core.MultivaluedMap; import javax.ws.rs.core.UriInfo; -import org.apache.log4j.Logger; - import de.intevation.lada.model.land.LKommentarM; -import de.intevation.lada.util.annotation.AuthenticationConfig; import de.intevation.lada.util.annotation.AuthorizationConfig; import de.intevation.lada.util.annotation.RepositoryConfig; -import de.intevation.lada.util.auth.Authentication; -import de.intevation.lada.util.auth.AuthenticationType; import de.intevation.lada.util.auth.Authorization; import de.intevation.lada.util.auth.AuthorizationType; import de.intevation.lada.util.data.QueryBuilder; import de.intevation.lada.util.data.Repository; import de.intevation.lada.util.data.RepositoryType; +import de.intevation.lada.util.rest.RequestMethod; import de.intevation.lada.util.rest.Response; @Path("mkommentar") @RequestScoped public class KommentarMService { - /* The logger used in this class.*/ - @Inject - private Logger logger; - /* The data repository granting read/write access.*/ @Inject @RepositoryConfig(type=RepositoryType.RW) private Repository defaultRepo; - /* The authentication module.*/ - @Inject - @AuthenticationConfig(type=AuthenticationType.NONE) - private Authentication authentication; - /* The authorization module.*/ @Inject - @AuthorizationConfig(type=AuthorizationType.NONE) + @AuthorizationConfig(type=AuthorizationType.OPEN_ID) private Authorization authorization; /** @@ -70,12 +58,9 @@ @Produces(MediaType.APPLICATION_JSON) public Response get( @Context HttpHeaders headers, - @Context UriInfo info + @Context UriInfo info, + @Context HttpServletRequest request ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } MultivaluedMap params = info.getQueryParameters(); if (params.isEmpty() || !params.containsKey("messungsId")) { return defaultRepo.getAll(LKommentarM.class, "land"); @@ -86,7 +71,10 @@ defaultRepo.entityManager("land"), LKommentarM.class); builder.and("messungsId", messungId); - return defaultRepo.filter(builder.getQuery(), "land"); + return authorization.filter( + request, + defaultRepo.filter(builder.getQuery(), "land"), + LKommentarM.class); } /** @@ -99,16 +87,16 @@ @Produces(MediaType.APPLICATION_JSON) public Response getById( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } - return defaultRepo.getById( - LKommentarM.class, - Integer.valueOf(id), - "land"); + return authorization.filter( + request, + defaultRepo.getById( + LKommentarM.class, + Integer.valueOf(id), + "land"), + LKommentarM.class); } @POST @@ -116,9 +104,15 @@ @Produces(MediaType.APPLICATION_JSON) public Response create( @Context HttpHeaders headers, + @Context HttpServletRequest request, LKommentarM kommentar ) { - if (!authentication.isAuthenticated(headers)) { + if (!authorization.isAuthorized( + request, + kommentar, + RequestMethod.POST, + LKommentarM.class) + ) { return new Response(false, 699, null); } /* Persist the new object*/ @@ -135,10 +129,15 @@ @Produces(MediaType.APPLICATION_JSON) public Response update( @Context HttpHeaders headers, + @Context HttpServletRequest request, LKommentarM kommentar ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); + if (!authorization.isAuthorized( + request, + kommentar, + RequestMethod.PUT, + LKommentarM.class) + ) { return new Response(false, 699, null); } return defaultRepo.update(kommentar, "land"); @@ -154,16 +153,21 @@ @Produces(MediaType.APPLICATION_JSON) public Response delete( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } /* Get the object by id*/ Response kommentar = defaultRepo.getById(LKommentarM.class, Integer.valueOf(id), "land"); LKommentarM kommentarObj = (LKommentarM)kommentar.getData(); + if (!authorization.isAuthorized( + request, + kommentarObj, + RequestMethod.DELETE, + LKommentarM.class) + ) { + return new Response(false, 699, null); + } return defaultRepo.delete(kommentarObj, "land"); } } diff -r bb76a5d7a98d -r a04658486ede src/main/java/de/intevation/lada/rest/KommentarPService.java --- a/src/main/java/de/intevation/lada/rest/KommentarPService.java Mon Mar 23 17:50:51 2015 +0100 +++ b/src/main/java/de/intevation/lada/rest/KommentarPService.java Mon Mar 23 17:52:17 2015 +0100 @@ -9,6 +9,7 @@ import javax.enterprise.context.RequestScoped; import javax.inject.Inject; +import javax.servlet.http.HttpServletRequest; import javax.ws.rs.DELETE; import javax.ws.rs.GET; import javax.ws.rs.POST; @@ -25,16 +26,14 @@ import org.apache.log4j.Logger; import de.intevation.lada.model.land.LKommentarP; -import de.intevation.lada.util.annotation.AuthenticationConfig; import de.intevation.lada.util.annotation.AuthorizationConfig; import de.intevation.lada.util.annotation.RepositoryConfig; -import de.intevation.lada.util.auth.Authentication; -import de.intevation.lada.util.auth.AuthenticationType; import de.intevation.lada.util.auth.Authorization; import de.intevation.lada.util.auth.AuthorizationType; import de.intevation.lada.util.data.QueryBuilder; import de.intevation.lada.util.data.Repository; import de.intevation.lada.util.data.RepositoryType; +import de.intevation.lada.util.rest.RequestMethod; import de.intevation.lada.util.rest.Response; @Path("pkommentar") @@ -50,14 +49,9 @@ @RepositoryConfig(type=RepositoryType.RW) private Repository defaultRepo; - /* The authentication module.*/ - @Inject - @AuthenticationConfig(type=AuthenticationType.NONE) - private Authentication authentication; - /* The authorization module.*/ @Inject - @AuthorizationConfig(type=AuthorizationType.NONE) + @AuthorizationConfig(type=AuthorizationType.OPEN_ID) private Authorization authorization; /** @@ -70,12 +64,9 @@ @Produces(MediaType.APPLICATION_JSON) public Response get( @Context HttpHeaders headers, - @Context UriInfo info + @Context UriInfo info, + @Context HttpServletRequest request ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } MultivaluedMap params = info.getQueryParameters(); if (params.isEmpty() || !params.containsKey("probeId")) { return defaultRepo.getAll(LKommentarP.class, "land"); @@ -86,7 +77,10 @@ defaultRepo.entityManager("land"), LKommentarP.class); builder.and("probeId", probeId); - return defaultRepo.filter(builder.getQuery(), "land"); + return authorization.filter( + request, + defaultRepo.filter(builder.getQuery(), "land"), + LKommentarP.class); } /** @@ -99,16 +93,13 @@ @Produces(MediaType.APPLICATION_JSON) public Response getById( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } - return defaultRepo.getById( - LKommentarP.class, - Integer.valueOf(id), - "land"); + return authorization.filter( + request, + defaultRepo.getById(LKommentarP.class,Integer.valueOf(id), "land"), + LKommentarP.class); } @POST @@ -116,9 +107,15 @@ @Produces(MediaType.APPLICATION_JSON) public Response create( @Context HttpHeaders headers, + @Context HttpServletRequest request, LKommentarP kommentar ) { - if (!authentication.isAuthenticated(headers)) { + if (!authorization.isAuthorized( + request, + kommentar, + RequestMethod.POST, + LKommentarP.class) + ) { return new Response(false, 699, null); } /* Persist the new object*/ @@ -133,9 +130,18 @@ @PUT @Path("/{id}") @Produces(MediaType.APPLICATION_JSON) - public Response update(@Context HttpHeaders headers, LKommentarP kommentar) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); + public Response update( + @Context HttpHeaders headers, + @Context HttpServletRequest request, + LKommentarP kommentar + ) { + if (!authorization.isAuthorized( + request, + kommentar, + RequestMethod.PUT, + LKommentarP.class) + ) { + logger.debug("User is not authorized!"); return new Response(false, 699, null); } return defaultRepo.update(kommentar, "land"); @@ -151,16 +157,22 @@ @Produces(MediaType.APPLICATION_JSON) public Response delete( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } /* Get the object by id*/ Response kommentar = defaultRepo.getById(LKommentarP.class, Integer.valueOf(id), "land"); LKommentarP kommentarObj = (LKommentarP)kommentar.getData(); + if (!authorization.isAuthorized( + request, + kommentarObj, + RequestMethod.DELETE, + LKommentarP.class) + ) { + logger.debug("User is not authorized!"); + return new Response(false, 699, null); + } return defaultRepo.delete(kommentarObj, "land"); } } diff -r bb76a5d7a98d -r a04658486ede src/main/java/de/intevation/lada/rest/LoginService.java --- a/src/main/java/de/intevation/lada/rest/LoginService.java Mon Mar 23 17:50:51 2015 +0100 +++ b/src/main/java/de/intevation/lada/rest/LoginService.java Mon Mar 23 17:52:17 2015 +0100 @@ -5,20 +5,23 @@ * and comes with ABSOLUTELY NO WARRANTY! Check out * the documentation coming with IMIS-Labordaten-Application for details. */ +package de.intevation.lada.rest; + +import java.util.Date; +import java.util.HashMap; +import java.util.Map; import javax.enterprise.context.RequestScoped; - +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.GET; import javax.ws.rs.Path; -import javax.ws.rs.GET; -import javax.inject.Inject; +import javax.ws.rs.Produces; import javax.ws.rs.core.Context; import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.UriInfo; -import javax.ws.rs.Produces; - -import org.apache.log4j.Logger; import de.intevation.lada.util.rest.Response; + /** * This class serves as a login check service */ @@ -26,24 +29,24 @@ @RequestScoped public class LoginService { - /* The logger used in this class.*/ - @Inject - private Logger logger; - /** * Get all probe objects. * * @return Response object containing all probe objects. */ - @SuppressWarnings("unchecked") @GET @Path("/") @Produces("application/json") public Response get( @Context HttpHeaders headers, - @Context UriInfo info + @Context UriInfo info, + @Context HttpServletRequest request ) { + Map response = new HashMap(); + response.put("username", request.getAttribute("lada.user.name")); + response.put("roles", request.getAttribute("lada.user.roles")); + response.put("servertime", new Date().getTime()); /* This should probably contain the users name and roles. */ - return new Response(true, 200, "Success"); + return new Response(true, 200, response); } } diff -r bb76a5d7a98d -r a04658486ede src/main/java/de/intevation/lada/rest/MessungService.java --- a/src/main/java/de/intevation/lada/rest/MessungService.java Mon Mar 23 17:50:51 2015 +0100 +++ b/src/main/java/de/intevation/lada/rest/MessungService.java Mon Mar 23 17:52:17 2015 +0100 @@ -11,6 +11,7 @@ import javax.enterprise.context.RequestScoped; import javax.inject.Inject; +import javax.servlet.http.HttpServletRequest; import javax.ws.rs.DELETE; import javax.ws.rs.GET; import javax.ws.rs.POST; @@ -24,43 +25,30 @@ import javax.ws.rs.core.MultivaluedMap; import javax.ws.rs.core.UriInfo; -import org.apache.log4j.Logger; - import de.intevation.lada.model.land.LMessung; import de.intevation.lada.model.land.MessungTranslation; -import de.intevation.lada.util.annotation.AuthenticationConfig; import de.intevation.lada.util.annotation.AuthorizationConfig; import de.intevation.lada.util.annotation.RepositoryConfig; -import de.intevation.lada.util.auth.Authentication; -import de.intevation.lada.util.auth.AuthenticationType; import de.intevation.lada.util.auth.Authorization; import de.intevation.lada.util.auth.AuthorizationType; import de.intevation.lada.util.data.QueryBuilder; import de.intevation.lada.util.data.Repository; import de.intevation.lada.util.data.RepositoryType; +import de.intevation.lada.util.rest.RequestMethod; import de.intevation.lada.util.rest.Response; @Path("messung") @RequestScoped public class MessungService { - /* The logger used in this class.*/ - @Inject - private Logger logger; - /* The data repository granting read/write access.*/ @Inject @RepositoryConfig(type=RepositoryType.RW) private Repository defaultRepo; - /* The authentication module.*/ - @Inject - @AuthenticationConfig(type=AuthenticationType.NONE) - private Authentication authentication; - /* The authorization module.*/ @Inject - @AuthorizationConfig(type=AuthorizationType.NONE) + @AuthorizationConfig(type=AuthorizationType.OPEN_ID) private Authorization authorization; /** @@ -73,12 +61,9 @@ @Produces(MediaType.APPLICATION_JSON) public Response get( @Context HttpHeaders headers, - @Context UriInfo info + @Context UriInfo info, + @Context HttpServletRequest request ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } MultivaluedMap params = info.getQueryParameters(); if (params.isEmpty() || !params.containsKey("probeId")) { return defaultRepo.getAll(LMessung.class, "land"); @@ -89,7 +74,10 @@ defaultRepo.entityManager("land"), LMessung.class); builder.and("probeId", probeId); - return defaultRepo.filter(builder.getQuery(), "land"); + return authorization.filter( + request, + defaultRepo.filter(builder.getQuery(), "land"), + LMessung.class); } /** @@ -102,13 +90,13 @@ @Produces(MediaType.APPLICATION_JSON) public Response getById( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } - return defaultRepo.getById(LMessung.class, Integer.valueOf(id), "land"); + return authorization.filter( + request, + defaultRepo.getById(LMessung.class, Integer.valueOf(id), "land"), + LMessung.class); } @POST @@ -116,11 +104,18 @@ @Produces(MediaType.APPLICATION_JSON) public Response create( @Context HttpHeaders headers, + @Context HttpServletRequest request, LMessung messung ) { - if (!authentication.isAuthenticated(headers)) { + if (!authorization.isAuthorized( + request, + messung, + RequestMethod.POST, + LMessung.class) + ) { return new Response(false, 699, null); } + /* Persist the new messung object*/ Response response = defaultRepo.create(messung, "land"); LMessung ret = (LMessung)response.getData(); @@ -142,9 +137,17 @@ @PUT @Path("/{id}") @Produces(MediaType.APPLICATION_JSON) - public Response update(@Context HttpHeaders headers, LMessung messung) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); + public Response update( + @Context HttpHeaders headers, + @Context HttpServletRequest request, + LMessung messung + ) { + if (!authorization.isAuthorized( + request, + messung, + RequestMethod.PUT, + LMessung.class) + ) { return new Response(false, 699, null); } Response response = defaultRepo.update(messung, "land"); @@ -164,16 +167,21 @@ @Produces(MediaType.APPLICATION_JSON) public Response delete( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } /* Get the messung object by id*/ Response messung = defaultRepo.getById(LMessung.class, Integer.valueOf(id), "land"); LMessung messungObj = (LMessung)messung.getData(); + if (!authorization.isAuthorized( + request, + messung, + RequestMethod.DELETE, + LMessung.class) + ) { + return new Response(false, 699, null); + } /* Create a query and request the messungTranslation object for the * messung*/ QueryBuilder builder = diff -r bb76a5d7a98d -r a04658486ede src/main/java/de/intevation/lada/rest/MesswertService.java --- a/src/main/java/de/intevation/lada/rest/MesswertService.java Mon Mar 23 17:50:51 2015 +0100 +++ b/src/main/java/de/intevation/lada/rest/MesswertService.java Mon Mar 23 17:52:17 2015 +0100 @@ -9,6 +9,7 @@ import javax.enterprise.context.RequestScoped; import javax.inject.Inject; +import javax.servlet.http.HttpServletRequest; import javax.ws.rs.DELETE; import javax.ws.rs.GET; import javax.ws.rs.POST; @@ -25,16 +26,14 @@ import org.apache.log4j.Logger; import de.intevation.lada.model.land.LMesswert; -import de.intevation.lada.util.annotation.AuthenticationConfig; import de.intevation.lada.util.annotation.AuthorizationConfig; import de.intevation.lada.util.annotation.RepositoryConfig; -import de.intevation.lada.util.auth.Authentication; -import de.intevation.lada.util.auth.AuthenticationType; import de.intevation.lada.util.auth.Authorization; import de.intevation.lada.util.auth.AuthorizationType; import de.intevation.lada.util.data.QueryBuilder; import de.intevation.lada.util.data.Repository; import de.intevation.lada.util.data.RepositoryType; +import de.intevation.lada.util.rest.RequestMethod; import de.intevation.lada.util.rest.Response; @Path("messwert") @@ -50,14 +49,9 @@ @RepositoryConfig(type=RepositoryType.RW) private Repository defaultRepo; - /* The authentication module.*/ - @Inject - @AuthenticationConfig(type=AuthenticationType.NONE) - private Authentication authentication; - /* The authorization module.*/ @Inject - @AuthorizationConfig(type=AuthorizationType.NONE) + @AuthorizationConfig(type=AuthorizationType.OPEN_ID) private Authorization authorization; /** @@ -70,12 +64,9 @@ @Produces(MediaType.APPLICATION_JSON) public Response get( @Context HttpHeaders headers, - @Context UriInfo info + @Context UriInfo info, + @Context HttpServletRequest request ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } MultivaluedMap params = info.getQueryParameters(); if (params.isEmpty() || !params.containsKey("messungsId")) { logger.debug("get all"); @@ -87,7 +78,10 @@ defaultRepo.entityManager("land"), LMesswert.class); builder.and("messungsId", messungId); - return defaultRepo.filter(builder.getQuery(), "land"); + return authorization.filter( + request, + defaultRepo.filter(builder.getQuery(), "land"), + LMesswert.class); } /** @@ -100,13 +94,13 @@ @Produces(MediaType.APPLICATION_JSON) public Response getById( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } - return defaultRepo.getById(LMesswert.class, Integer.valueOf(id), "land"); + return authorization.filter( + request, + defaultRepo.getById(LMesswert.class, Integer.valueOf(id), "land"), + LMesswert.class); } @POST @@ -114,9 +108,15 @@ @Produces(MediaType.APPLICATION_JSON) public Response create( @Context HttpHeaders headers, + @Context HttpServletRequest request, LMesswert messwert ) { - if (!authentication.isAuthenticated(headers)) { + if (!authorization.isAuthorized( + request, + messwert, + RequestMethod.POST, + LMesswert.class) + ) { return new Response(false, 699, null); } /* Persist the new messung object*/ @@ -131,9 +131,17 @@ @PUT @Path("/{id}") @Produces(MediaType.APPLICATION_JSON) - public Response update(@Context HttpHeaders headers, LMesswert messwert) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); + public Response update( + @Context HttpHeaders headers, + @Context HttpServletRequest request, + LMesswert messwert + ) { + if (!authorization.isAuthorized( + request, + messwert, + RequestMethod.PUT, + LMesswert.class) + ) { return new Response(false, 699, null); } Response response = defaultRepo.update(messwert, "land"); @@ -153,16 +161,21 @@ @Produces(MediaType.APPLICATION_JSON) public Response delete( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } /* Get the messwert object by id*/ Response messwert = defaultRepo.getById(LMesswert.class, Integer.valueOf(id), "land"); LMesswert messwertObj = (LMesswert)messwert.getData(); + if (!authorization.isAuthorized( + request, + messwertObj, + RequestMethod.DELETE, + LMesswert.class) + ) { + return new Response(false, 699, null); + } /* Delete the messwert object*/ return defaultRepo.delete(messwertObj, "land"); } diff -r bb76a5d7a98d -r a04658486ede src/main/java/de/intevation/lada/rest/OrtService.java --- a/src/main/java/de/intevation/lada/rest/OrtService.java Mon Mar 23 17:50:51 2015 +0100 +++ b/src/main/java/de/intevation/lada/rest/OrtService.java Mon Mar 23 17:52:17 2015 +0100 @@ -9,6 +9,7 @@ import javax.enterprise.context.RequestScoped; import javax.inject.Inject; +import javax.servlet.http.HttpServletRequest; import javax.ws.rs.DELETE; import javax.ws.rs.GET; import javax.ws.rs.POST; @@ -25,16 +26,14 @@ import org.apache.log4j.Logger; import de.intevation.lada.model.land.LOrt; -import de.intevation.lada.util.annotation.AuthenticationConfig; import de.intevation.lada.util.annotation.AuthorizationConfig; import de.intevation.lada.util.annotation.RepositoryConfig; -import de.intevation.lada.util.auth.Authentication; -import de.intevation.lada.util.auth.AuthenticationType; import de.intevation.lada.util.auth.Authorization; import de.intevation.lada.util.auth.AuthorizationType; import de.intevation.lada.util.data.QueryBuilder; import de.intevation.lada.util.data.Repository; import de.intevation.lada.util.data.RepositoryType; +import de.intevation.lada.util.rest.RequestMethod; import de.intevation.lada.util.rest.Response; @Path("ort") @@ -50,14 +49,9 @@ @RepositoryConfig(type=RepositoryType.RW) private Repository defaultRepo; - /* The authentication module.*/ - @Inject - @AuthenticationConfig(type=AuthenticationType.NONE) - private Authentication authentication; - /* The authorization module.*/ @Inject - @AuthorizationConfig(type=AuthorizationType.NONE) + @AuthorizationConfig(type=AuthorizationType.OPEN_ID) private Authorization authorization; /** @@ -70,12 +64,9 @@ @Produces(MediaType.APPLICATION_JSON) public Response get( @Context HttpHeaders headers, - @Context UriInfo info + @Context UriInfo info, + @Context HttpServletRequest request ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } MultivaluedMap params = info.getQueryParameters(); if (params.isEmpty() || !params.containsKey("probeId")) { logger.debug("get all"); @@ -87,7 +78,10 @@ defaultRepo.entityManager("land"), LOrt.class); builder.and("probeId", probeId); - return defaultRepo.filter(builder.getQuery(), "land"); + return authorization.filter( + request, + defaultRepo.filter(builder.getQuery(), "land"), + LOrt.class); } /** @@ -100,13 +94,13 @@ @Produces(MediaType.APPLICATION_JSON) public Response getById( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } - return defaultRepo.getById(LOrt.class, Integer.valueOf(id), "land"); + return authorization.filter( + request, + defaultRepo.getById(LOrt.class, Integer.valueOf(id), "land"), + LOrt.class); } @POST @@ -114,9 +108,14 @@ @Produces(MediaType.APPLICATION_JSON) public Response create( @Context HttpHeaders headers, + @Context HttpServletRequest request, LOrt ort ) { - if (!authentication.isAuthenticated(headers)) { + if (!authorization.isAuthorized( + request, + ort, + RequestMethod.POST, + LOrt.class)) { return new Response(false, 699, null); } /* Persist the new object*/ @@ -131,9 +130,16 @@ @PUT @Path("/{id}") @Produces(MediaType.APPLICATION_JSON) - public Response update(@Context HttpHeaders headers, LOrt ort) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); + public Response update( + @Context HttpHeaders headers, + @Context HttpServletRequest request, + LOrt ort + ) { + if (!authorization.isAuthorized( + request, + ort, + RequestMethod.PUT, + LOrt.class)) { return new Response(false, 699, null); } Response response = defaultRepo.update(ort, "land"); @@ -153,16 +159,20 @@ @Produces(MediaType.APPLICATION_JSON) public Response delete( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } /* Get the messwert object by id*/ Response object = defaultRepo.getById(LOrt.class, Integer.valueOf(id), "land"); LOrt ortObj = (LOrt)object.getData(); + if (!authorization.isAuthorized( + request, + ortObj, + RequestMethod.PUT, + LOrt.class)) { + return new Response(false, 699, null); + } /* Delete the messwert object*/ return defaultRepo.delete(ortObj, "land"); } diff -r bb76a5d7a98d -r a04658486ede src/main/java/de/intevation/lada/rest/ProbeService.java --- a/src/main/java/de/intevation/lada/rest/ProbeService.java Mon Mar 23 17:50:51 2015 +0100 +++ b/src/main/java/de/intevation/lada/rest/ProbeService.java Mon Mar 23 17:52:17 2015 +0100 @@ -20,6 +20,7 @@ import javax.json.JsonObject; import javax.json.JsonReader; import javax.persistence.Query; +import javax.servlet.http.HttpServletRequest; import javax.ws.rs.DELETE; import javax.ws.rs.GET; import javax.ws.rs.POST; @@ -38,16 +39,14 @@ import de.intevation.lada.model.land.LProbe; import de.intevation.lada.model.land.ProbeTranslation; import de.intevation.lada.query.QueryTools; -import de.intevation.lada.util.annotation.AuthenticationConfig; import de.intevation.lada.util.annotation.AuthorizationConfig; import de.intevation.lada.util.annotation.RepositoryConfig; -import de.intevation.lada.util.auth.Authentication; -import de.intevation.lada.util.auth.AuthenticationType; import de.intevation.lada.util.auth.Authorization; import de.intevation.lada.util.auth.AuthorizationType; import de.intevation.lada.util.data.QueryBuilder; import de.intevation.lada.util.data.Repository; import de.intevation.lada.util.data.RepositoryType; +import de.intevation.lada.util.rest.RequestMethod; import de.intevation.lada.util.rest.Response; import de.intevation.lada.validation.Validator; import de.intevation.lada.validation.Violation; @@ -72,14 +71,9 @@ @RepositoryConfig(type=RepositoryType.RW) private Repository defaultRepo; - /* The authentication module.*/ - @Inject - @AuthenticationConfig(type=AuthenticationType.NONE) - private Authentication authentication; - /* The authorization module.*/ @Inject - @AuthorizationConfig(type=AuthorizationType.NONE) + @AuthorizationConfig(type=AuthorizationType.OPEN_ID) private Authorization authorization; @Inject @@ -97,12 +91,11 @@ @Produces("application/json") public Response get( @Context HttpHeaders headers, - @Context UriInfo info + @Context UriInfo info, + @Context HttpServletRequest request ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } + logger.debug("user: " + request.getAttribute("lada.user.name")); + logger.debug("roles: " + request.getAttribute("lada.user.roles")); MultivaluedMap params = info.getQueryParameters(); if (params.isEmpty() || !params.containsKey("qid")) { return defaultRepo.getAll(LProbe.class, "land"); @@ -116,11 +109,12 @@ sql = jsonQuery.getString("sql"); if (params.containsKey("sort")) { String sort = params.getFirst("sort"); + logger.debug("Sort parameter: " + sort); JsonReader reader = Json.createReader(new StringReader(sort)); - JsonObject sortProperties = reader.readObject(); + JsonObject sortProperties = reader.readArray().getJsonObject(0); sql += " ORDER BY "; - sql += sortProperties.getJsonString("property") + " "; - sql += sortProperties.getJsonString("direction"); + sql += sortProperties.getJsonString("property").getString() + " "; + sql += sortProperties.getJsonString("direction").getString(); } JsonArray jsonFilters = jsonQuery.getJsonArray("filters"); JsonArray jsonResults = jsonQuery.getJsonArray("result"); @@ -143,7 +137,7 @@ params, defaultRepo.entityManager("land")); List> result = - QueryTools.prepareResult(query.getResultList(), results); + QueryTools.prepareResult(query.getResultList(), results, authorization, authorization.getInfo(request)); if (params.containsKey("start") && params.containsKey("limit")) { int start = Integer.valueOf(params.getFirst("start")); int limit = Integer.valueOf(params.getFirst("limit")); @@ -163,19 +157,16 @@ @Produces(MediaType.APPLICATION_JSON) public Response getById( @Context HttpHeaders headers, - @PathParam("id") String id + @PathParam("id") String id, + @Context HttpServletRequest request ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } Response response = defaultRepo.getById(LProbe.class, Integer.valueOf(id), "land"); Violation violation = validator.validate(response.getData()); if (violation.hasWarnings()) { response.setWarnings(violation.getWarnings()); } - return response; + return this.authorization.filter(request, response, LProbe.class); } /** @@ -186,8 +177,17 @@ @POST @Path("/") @Produces(MediaType.APPLICATION_JSON) - public Response create(@Context HttpHeaders headers, LProbe probe) { - if (!authentication.isAuthenticated(headers)) { + public Response create( + @Context HttpHeaders headers, + @Context HttpServletRequest request, + LProbe probe + ) { + if (!authorization.isAuthorized( + request, + probe, + RequestMethod.POST, + LProbe.class) + ) { return new Response(false, 699, null); } Violation violation = validator.validate(probe); @@ -221,9 +221,17 @@ @PUT @Path("/{id}") @Produces(MediaType.APPLICATION_JSON) - public Response update(@Context HttpHeaders headers, LProbe probe) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); + public Response update( + @Context HttpHeaders headers, + @Context HttpServletRequest request, + LProbe probe + ) { + if (!authorization.isAuthorized( + request, + probe, + RequestMethod.PUT, + LProbe.class) + ) { return new Response(false, 699, null); } Violation violation = validator.validate(probe); @@ -253,16 +261,21 @@ @Produces(MediaType.APPLICATION_JSON) public Response delete( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } /* Get the probe object by id*/ Response probe = defaultRepo.getById(LProbe.class, Integer.valueOf(id), "land"); LProbe probeObj = (LProbe)probe.getData(); + if (!authorization.isAuthorized( + request, + probeObj, + RequestMethod.DELETE, + LProbe.class) + ) { + return new Response(false, 699, null); + } /* Create a query and request the probetranslation object for the * probe*/ QueryBuilder builder = diff -r bb76a5d7a98d -r a04658486ede src/main/java/de/intevation/lada/rest/StatusService.java --- a/src/main/java/de/intevation/lada/rest/StatusService.java Mon Mar 23 17:50:51 2015 +0100 +++ b/src/main/java/de/intevation/lada/rest/StatusService.java Mon Mar 23 17:52:17 2015 +0100 @@ -9,6 +9,7 @@ import javax.enterprise.context.RequestScoped; import javax.inject.Inject; +import javax.servlet.http.HttpServletRequest; import javax.ws.rs.DELETE; import javax.ws.rs.GET; import javax.ws.rs.POST; @@ -22,42 +23,29 @@ import javax.ws.rs.core.MultivaluedMap; import javax.ws.rs.core.UriInfo; -import org.apache.log4j.Logger; - import de.intevation.lada.model.land.LStatus; -import de.intevation.lada.util.annotation.AuthenticationConfig; import de.intevation.lada.util.annotation.AuthorizationConfig; import de.intevation.lada.util.annotation.RepositoryConfig; -import de.intevation.lada.util.auth.Authentication; -import de.intevation.lada.util.auth.AuthenticationType; import de.intevation.lada.util.auth.Authorization; import de.intevation.lada.util.auth.AuthorizationType; import de.intevation.lada.util.data.QueryBuilder; import de.intevation.lada.util.data.Repository; import de.intevation.lada.util.data.RepositoryType; +import de.intevation.lada.util.rest.RequestMethod; import de.intevation.lada.util.rest.Response; @Path("status") @RequestScoped public class StatusService { - /* The logger used in this class.*/ - @Inject - private Logger logger; - /* The data repository granting read/write access.*/ @Inject @RepositoryConfig(type=RepositoryType.RW) private Repository defaultRepo; - /* The authentication module.*/ - @Inject - @AuthenticationConfig(type=AuthenticationType.NONE) - private Authentication authentication; - /* The authorization module.*/ @Inject - @AuthorizationConfig(type=AuthorizationType.NONE) + @AuthorizationConfig(type=AuthorizationType.OPEN_ID) private Authorization authorization; /** @@ -70,12 +58,9 @@ @Produces(MediaType.APPLICATION_JSON) public Response get( @Context HttpHeaders headers, - @Context UriInfo info + @Context UriInfo info, + @Context HttpServletRequest request ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } MultivaluedMap params = info.getQueryParameters(); if (params.isEmpty() || !params.containsKey("messungsId")) { return defaultRepo.getAll(LStatus.class, "land"); @@ -86,7 +71,10 @@ defaultRepo.entityManager("land"), LStatus.class); builder.and("messungsId", messungId); - return defaultRepo.filter(builder.getQuery(), "land"); + return authorization.filter( + request, + defaultRepo.filter(builder.getQuery(), "land"), + LStatus.class); } /** @@ -99,13 +87,13 @@ @Produces(MediaType.APPLICATION_JSON) public Response getById( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } - return defaultRepo.getById(LStatus.class, Integer.valueOf(id), "land"); + return authorization.filter( + request, + defaultRepo.getById(LStatus.class, Integer.valueOf(id), "land"), + LStatus.class); } @POST @@ -113,9 +101,15 @@ @Produces(MediaType.APPLICATION_JSON) public Response create( @Context HttpHeaders headers, + @Context HttpServletRequest request, LStatus status ) { - if (!authentication.isAuthenticated(headers)) { + if (!authorization.isAuthorized( + request, + status, + RequestMethod.POST, + LStatus.class) + ) { return new Response(false, 699, null); } /* Persist the new object*/ @@ -130,9 +124,17 @@ @PUT @Path("/{id}") @Produces(MediaType.APPLICATION_JSON) - public Response update(@Context HttpHeaders headers, LStatus status) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); + public Response update( + @Context HttpHeaders headers, + @Context HttpServletRequest request, + LStatus status + ) { + if (!authorization.isAuthorized( + request, + status, + RequestMethod.PUT, + LStatus.class) + ) { return new Response(false, 699, null); } Response response = defaultRepo.update(status, "land"); @@ -152,16 +154,21 @@ @Produces(MediaType.APPLICATION_JSON) public Response delete( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } /* Get the object by id*/ Response object = defaultRepo.getById(LStatus.class, Integer.valueOf(id), "land"); LStatus obj = (LStatus)object.getData(); + if (!authorization.isAuthorized( + request, + obj, + RequestMethod.DELETE, + LStatus.class) + ) { + return new Response(false, 699, null); + } /* Delete the object*/ return defaultRepo.delete(obj, "land"); } diff -r bb76a5d7a98d -r a04658486ede src/main/java/de/intevation/lada/rest/ZusatzwertService.java --- a/src/main/java/de/intevation/lada/rest/ZusatzwertService.java Mon Mar 23 17:50:51 2015 +0100 +++ b/src/main/java/de/intevation/lada/rest/ZusatzwertService.java Mon Mar 23 17:52:17 2015 +0100 @@ -9,6 +9,7 @@ import javax.enterprise.context.RequestScoped; import javax.inject.Inject; +import javax.servlet.http.HttpServletRequest; import javax.ws.rs.DELETE; import javax.ws.rs.GET; import javax.ws.rs.POST; @@ -22,42 +23,29 @@ import javax.ws.rs.core.MultivaluedMap; import javax.ws.rs.core.UriInfo; -import org.apache.log4j.Logger; - import de.intevation.lada.model.land.LZusatzWert; -import de.intevation.lada.util.annotation.AuthenticationConfig; import de.intevation.lada.util.annotation.AuthorizationConfig; import de.intevation.lada.util.annotation.RepositoryConfig; -import de.intevation.lada.util.auth.Authentication; -import de.intevation.lada.util.auth.AuthenticationType; import de.intevation.lada.util.auth.Authorization; import de.intevation.lada.util.auth.AuthorizationType; import de.intevation.lada.util.data.QueryBuilder; import de.intevation.lada.util.data.Repository; import de.intevation.lada.util.data.RepositoryType; +import de.intevation.lada.util.rest.RequestMethod; import de.intevation.lada.util.rest.Response; @Path("zusatzwert") @RequestScoped public class ZusatzwertService { - /* The logger used in this class.*/ - @Inject - private Logger logger; - /* The data repository granting read/write access.*/ @Inject @RepositoryConfig(type=RepositoryType.RW) private Repository defaultRepo; - /* The authentication module.*/ - @Inject - @AuthenticationConfig(type=AuthenticationType.NONE) - private Authentication authentication; - /* The authorization module.*/ @Inject - @AuthorizationConfig(type=AuthorizationType.NONE) + @AuthorizationConfig(type=AuthorizationType.OPEN_ID) private Authorization authorization; /** @@ -70,12 +58,9 @@ @Produces(MediaType.APPLICATION_JSON) public Response get( @Context HttpHeaders headers, + @Context HttpServletRequest request, @Context UriInfo info ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } MultivaluedMap params = info.getQueryParameters(); if (params.isEmpty() || !params.containsKey("probeId")) { return defaultRepo.getAll(LZusatzWert.class, "land"); @@ -86,7 +71,10 @@ defaultRepo.entityManager("land"), LZusatzWert.class); builder.and("probeId", probeId); - return defaultRepo.filter(builder.getQuery(), "land"); + return authorization.filter( + request, + defaultRepo.filter(builder.getQuery(), "land"), + LZusatzWert.class); } /** @@ -99,13 +87,13 @@ @Produces(MediaType.APPLICATION_JSON) public Response getById( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } - return defaultRepo.getById(LZusatzWert.class, Integer.valueOf(id), "land"); + return authorization.filter( + request, + defaultRepo.getById(LZusatzWert.class, Integer.valueOf(id), "land"), + LZusatzWert.class); } @POST @@ -113,9 +101,15 @@ @Produces(MediaType.APPLICATION_JSON) public Response create( @Context HttpHeaders headers, + @Context HttpServletRequest request, LZusatzWert zusatzwert ) { - if (!authentication.isAuthenticated(headers)) { + if (!authorization.isAuthorized( + request, + zusatzwert, + RequestMethod.POST, + LZusatzWert.class) + ) { return new Response(false, 699, null); } /* Persist the new object*/ @@ -132,10 +126,15 @@ @Produces(MediaType.APPLICATION_JSON) public Response update( @Context HttpHeaders headers, + @Context HttpServletRequest request, LZusatzWert zusatzwert ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); + if (!authorization.isAuthorized( + request, + zusatzwert, + RequestMethod.PUT, + LZusatzWert.class) + ) { return new Response(false, 699, null); } Response response = defaultRepo.update(zusatzwert, "land"); @@ -155,16 +154,21 @@ @Produces(MediaType.APPLICATION_JSON) public Response delete( @Context HttpHeaders headers, + @Context HttpServletRequest request, @PathParam("id") String id ) { - if (!authentication.isAuthenticated(headers)) { - logger.debug("User is not authenticated!"); - return new Response(false, 699, null); - } /* Get the object by id*/ Response object = defaultRepo.getById(LZusatzWert.class, Integer.valueOf(id), "land"); LZusatzWert obj = (LZusatzWert)object.getData(); + if (!authorization.isAuthorized( + request, + obj, + RequestMethod.DELETE, + LZusatzWert.class) + ) { + return new Response(false, 699, null); + } /* Delete the object*/ return defaultRepo.delete(obj, "land"); }