blame | history | patch | commit | commitdiff
rsanchez
2014-10-15 7686a892d556333194349f73fee3a268b6202d66 
 securis/src/main/java/net/curisit/securis/services/UserResource.java
....@@ -5,9 +5,11 @@
55 import java.util.List;
66 import java.util.Set;
77 
8
+import javax.annotation.security.RolesAllowed;
89 import javax.inject.Inject;
910 import javax.inject.Provider;
1011 import javax.persistence.EntityManager;
12
+import javax.persistence.PersistenceException;
1113 import javax.persistence.TypedQuery;
1214 import javax.servlet.http.HttpServletRequest;
1315 import javax.ws.rs.Consumes;
....@@ -31,6 +33,8 @@
3133 import net.curisit.securis.SeCurisException;
3234 import net.curisit.securis.db.Organization;
3335 import net.curisit.securis.db.User;
36
+import net.curisit.securis.security.BasicSecurityContext;
37
+import net.curisit.securis.security.Securable;
3438 import net.curisit.securis.utils.TokenHelper;
3539 
3640 import org.apache.logging.log4j.LogManager;
....@@ -66,6 +70,8 @@
6670     @Produces({
6771         MediaType.APPLICATION_JSON
6872     })
73
+    @Securable
74
+    @RolesAllowed(BasicSecurityContext.ROL_ADMIN)
6975     public Response index() {
7076         LOG.info("Getting users list ");
7177 
....@@ -86,6 +92,8 @@
8692     @Produces({
8793         MediaType.APPLICATION_JSON
8894     })
95
+    @Securable
96
+    @RolesAllowed(BasicSecurityContext.ROL_ADMIN)
8997     public Response get(@PathParam("uid") String uid, @HeaderParam(TokenHelper.TOKEN_HEADER_PÀRAM) String token) {
9098         LOG.info("Getting user data for id: {}: ", uid);
9199         if (uid == null || "".equals(uid)) {
....@@ -109,6 +117,8 @@
109117         MediaType.APPLICATION_JSON
110118     })
111119     @Transactional
120
+    @Securable
121
+    @RolesAllowed(BasicSecurityContext.ROL_ADMIN)
112122     public Response create(User user, @HeaderParam(TokenHelper.TOKEN_HEADER_PÀRAM) String token) {
113123         LOG.info("Creating new user");
114124         EntityManager em = emProvider.get();
....@@ -122,6 +132,11 @@
122132             this.setUserOrg(user, user.getOrgsIds(), em);
123133         } catch (SeCurisException e) {
124134             return Response.status(Status.NOT_FOUND).header(DefaultExceptionHandler.ERROR_MESSAGE_HEADER, e.getMessage()).build();
135
+        }
136
+        if (user.getPassword() != null && !"".equals(user.getPassword())) {
137
+            user.setPassword(Utils.sha256(user.getPassword()));
138
+        } else {
139
+            return Response.status(DefaultExceptionHandler.DEFAULT_APP_ERROR_STATUS_CODE).header(DefaultExceptionHandler.ERROR_MESSAGE_HEADER, "User password is mandatory").build();
125140         }
126141         user.setModificationTimestamp(new Date());
127142         user.setLastLogin(null);
....@@ -157,6 +172,8 @@
157172     @Produces({
158173         MediaType.APPLICATION_JSON
159174     })
175
+    @Securable
176
+    @RolesAllowed(BasicSecurityContext.ROL_ADMIN)
160177     public Response modify(User user, @PathParam("uid") String uid, @HeaderParam(TokenHelper.TOKEN_HEADER_PÀRAM) String token) {
161178         LOG.info("Modifying user with id: {}", uid);
162179         EntityManager em = emProvider.get();
....@@ -176,7 +193,13 @@
176193         currentUser.setRoles(user.getRoles());
177194         currentUser.setLang(user.getLang());
178195         currentUser.setModificationTimestamp(new Date());
179
-        currentUser.setPassword(user.getPassword());
196
+        if (user.getPassword() != null && !"".equals(user.getPassword())) {
197
+            currentUser.setPassword(Utils.sha256(user.getPassword()));
198
+        } else {
199
+            // Password has not been modified
200
+            //return Response.status(DefaultExceptionHandler.DEFAULT_APP_ERROR_STATUS_CODE).header(DefaultExceptionHandler.ERROR_MESSAGE_HEADER, "User password is mandatory").build();
201
+        }
202
+
180203         currentUser.setLastLogin(user.getLastLogin());
181204 
182205         em.persist(currentUser);
....@@ -190,6 +213,8 @@
190213     @Produces({
191214         MediaType.APPLICATION_JSON
192215     })
216
+    @Securable
217
+    @RolesAllowed(BasicSecurityContext.ROL_ADMIN)
193218     public Response delete(@PathParam("uid") String uid, @Context HttpServletRequest request) {
194219         LOG.info("Deleting app with id: {}", uid);
195220         EntityManager em = emProvider.get();
....@@ -208,16 +233,35 @@
208233     @Produces({
209234         MediaType.APPLICATION_JSON
210235     })
211
-    public Response login(@FormParam("username") String user, @FormParam("password") String password, @Context HttpServletRequest request) {
236
+    public Response login(@FormParam("username") String username, @FormParam("password") String password, @Context HttpServletRequest request) {
212237         LOG.info("index session: " + request.getSession());
213
-        LOG.info("user: {}, pass: {}", user, password);
238
+        LOG.info("user: {}, pass: {}", username, password);
214239         LOG.info("is user in role: {} == {} ? ", "advance", request.isUserInRole("advance"));
215
-
216
-        if ("no".equals(password)) {
240
+        LOG.info("is user in role: {} == {} ? ", "admin", request.isUserInRole("admin"));
241
+        
242
+        EntityManager em = emProvider.get();
243
+        User user = em.find(User.class, username);
244
+        if (user == null) {
245
+            LOG.error("Inknown username {} used in login service", username);
246
+            return Response.status(Status.UNAUTHORIZED).build();
247
+        }
248
+        String securedPassword = Utils.sha256(password);
249
+        
250
+        if (securedPassword == null || !securedPassword.equals(user.getPassword())) {
217251             // TODO: Code to test exception handling
218252             return Response.status(Status.UNAUTHORIZED).build();
219253         }
220
-        String tokenAuth = tokenHelper.generateToken(user);
254
+        user.setLastLogin(new Date());
255
+        em.getTransaction().begin();
256
+        try {
257
+            em.persist(user);
258
+            em.getTransaction().commit();
259
+        } catch(PersistenceException ex) {
260
+            LOG.error("Error updating last login date for user: {}", username);
261
+            LOG.error(ex);
262
+            em.getTransaction().rollback();
263
+        }
264
+        String tokenAuth = tokenHelper.generateToken(username);
221265         return Response.ok(Utils.createMap("success", true, "token", tokenAuth)).build();
222266     }
223267