| .. | .. |
|---|
| 6 | 6 | import java.util.Set; |
|---|
| 7 | 7 | |
|---|
| 8 | 8 | import javax.annotation.security.RolesAllowed; |
|---|
| 9 | +import javax.enterprise.context.RequestScoped; |
|---|
| 9 | 10 | import javax.inject.Inject; |
|---|
| 10 | | -import javax.inject.Provider; |
|---|
| 11 | 11 | import javax.persistence.EntityManager; |
|---|
| 12 | 12 | import javax.persistence.PersistenceException; |
|---|
| 13 | 13 | import javax.persistence.TypedQuery; |
|---|
| 14 | 14 | import javax.servlet.http.HttpServletRequest; |
|---|
| 15 | +import javax.transaction.Transactional; |
|---|
| 15 | 16 | import javax.ws.rs.Consumes; |
|---|
| 16 | 17 | import javax.ws.rs.DELETE; |
|---|
| 17 | 18 | import javax.ws.rs.FormParam; |
|---|
| .. | .. |
|---|
| 35 | 36 | import net.curisit.securis.db.User; |
|---|
| 36 | 37 | import net.curisit.securis.security.BasicSecurityContext; |
|---|
| 37 | 38 | import net.curisit.securis.security.Securable; |
|---|
| 39 | +import net.curisit.securis.services.exception.SeCurisServiceException; |
|---|
| 40 | +import net.curisit.securis.services.exception.SeCurisServiceException.ErrorCodes; |
|---|
| 38 | 41 | import net.curisit.securis.utils.TokenHelper; |
|---|
| 39 | 42 | |
|---|
| 40 | 43 | import org.apache.logging.log4j.LogManager; |
|---|
| 41 | 44 | import org.apache.logging.log4j.Logger; |
|---|
| 42 | | - |
|---|
| 43 | | -import com.google.inject.persist.Transactional; |
|---|
| 44 | 45 | |
|---|
| 45 | 46 | /** |
|---|
| 46 | 47 | * User resource |
|---|
| .. | .. |
|---|
| 48 | 49 | * @author roberto <roberto.sanchez@curisit.net> |
|---|
| 49 | 50 | */ |
|---|
| 50 | 51 | @Path("/user") |
|---|
| 52 | +@RequestScoped |
|---|
| 51 | 53 | public class UserResource { |
|---|
| 52 | 54 | |
|---|
| 53 | 55 | @Inject |
|---|
| 54 | 56 | TokenHelper tokenHelper; |
|---|
| 55 | 57 | |
|---|
| 56 | 58 | @Inject |
|---|
| 57 | | - Provider<EntityManager> emProvider; |
|---|
| 59 | + EntityManager em; |
|---|
| 58 | 60 | |
|---|
| 59 | 61 | private static final Logger LOG = LogManager.getLogger(UserResource.class); |
|---|
| 60 | 62 | |
|---|
| .. | .. |
|---|
| 75 | 77 | public Response index() { |
|---|
| 76 | 78 | LOG.info("Getting users list "); |
|---|
| 77 | 79 | |
|---|
| 78 | | - EntityManager em = emProvider.get(); |
|---|
| 80 | + // EntityManager em = emProvider.get(); |
|---|
| 79 | 81 | em.clear(); |
|---|
| 80 | 82 | TypedQuery<User> q = em.createNamedQuery("list-users", User.class); |
|---|
| 81 | 83 | |
|---|
| .. | .. |
|---|
| 102 | 104 | return Response.status(Status.NOT_FOUND).build(); |
|---|
| 103 | 105 | } |
|---|
| 104 | 106 | |
|---|
| 105 | | - EntityManager em = emProvider.get(); |
|---|
| 107 | + // EntityManager em = emProvider.get(); |
|---|
| 106 | 108 | em.clear(); |
|---|
| 107 | 109 | User lt = em.find(User.class, uid); |
|---|
| 108 | 110 | if (lt == null) { |
|---|
| .. | .. |
|---|
| 123 | 125 | @RolesAllowed(BasicSecurityContext.ROL_ADMIN) |
|---|
| 124 | 126 | public Response create(User user, @HeaderParam(TokenHelper.TOKEN_HEADER_PÀRAM) String token) { |
|---|
| 125 | 127 | LOG.info("Creating new user"); |
|---|
| 126 | | - EntityManager em = emProvider.get(); |
|---|
| 128 | + // EntityManager em = emProvider.get(); |
|---|
| 127 | 129 | User currentUser = em.find(User.class, user.getUsername()); |
|---|
| 128 | 130 | if (currentUser != null) { |
|---|
| 129 | 131 | LOG.info("User with id {} was found in DB, we'll try to modify it", user.getUsername()); |
|---|
| .. | .. |
|---|
| 179 | 181 | @RolesAllowed(BasicSecurityContext.ROL_ADMIN) |
|---|
| 180 | 182 | public Response modify(User user, @PathParam("uid") String uid, @HeaderParam(TokenHelper.TOKEN_HEADER_PÀRAM) String token) { |
|---|
| 181 | 183 | LOG.info("Modifying user with id: {}", uid); |
|---|
| 182 | | - EntityManager em = emProvider.get(); |
|---|
| 184 | + // EntityManager em = emProvider.get(); |
|---|
| 183 | 185 | User currentUser = em.find(User.class, uid); |
|---|
| 184 | 186 | if (currentUser == null) { |
|---|
| 185 | 187 | LOG.info("User with id {} not found in DB, we'll try to create it", uid); |
|---|
| .. | .. |
|---|
| 222 | 224 | @RolesAllowed(BasicSecurityContext.ROL_ADMIN) |
|---|
| 223 | 225 | public Response delete(@PathParam("uid") String uid, @Context HttpServletRequest request) { |
|---|
| 224 | 226 | LOG.info("Deleting app with id: {}", uid); |
|---|
| 225 | | - EntityManager em = emProvider.get(); |
|---|
| 227 | + // EntityManager em = emProvider.get(); |
|---|
| 226 | 228 | User app = em.find(User.class, uid); |
|---|
| 227 | 229 | if (app == null) { |
|---|
| 228 | 230 | LOG.error("User with id {} can not be deleted, It was not found in DB", uid); |
|---|
| .. | .. |
|---|
| 238 | 240 | @Produces({ |
|---|
| 239 | 241 | MediaType.APPLICATION_JSON |
|---|
| 240 | 242 | }) |
|---|
| 241 | | - public Response login(@FormParam("username") String username, @FormParam("password") String password, @Context HttpServletRequest request) { |
|---|
| 243 | + public Response login(@FormParam("username") String username, @FormParam("password") String password, @Context HttpServletRequest request) |
|---|
| 244 | + throws SeCurisServiceException { |
|---|
| 242 | 245 | LOG.info("index session: " + request.getSession()); |
|---|
| 243 | 246 | LOG.info("user: {}, pass: {}", username, password); |
|---|
| 244 | 247 | LOG.info("is user in role: {} == {} ? ", "advance", request.isUserInRole("advance")); |
|---|
| 245 | 248 | LOG.info("is user in role: {} == {} ? ", "admin", request.isUserInRole("admin")); |
|---|
| 246 | 249 | |
|---|
| 247 | | - EntityManager em = emProvider.get(); |
|---|
| 250 | + // EntityManager em = emProvider.get(); |
|---|
| 248 | 251 | User user = em.find(User.class, username); |
|---|
| 249 | 252 | if (user == null) { |
|---|
| 250 | 253 | LOG.error("Inknown username {} used in login service", username); |
|---|
| 251 | | - return Response.status(Status.UNAUTHORIZED).build(); |
|---|
| 254 | + throw new SeCurisServiceException(ErrorCodes.UNAUTHORIZED_ACCESS, "Wrong credentials"); |
|---|
| 252 | 255 | } |
|---|
| 253 | 256 | String securedPassword = Utils.sha256(password); |
|---|
| 254 | 257 | |
|---|
| 255 | 258 | if (securedPassword == null || !securedPassword.equals(user.getPassword())) { |
|---|
| 256 | | - // TODO: Code to test exception handling |
|---|
| 257 | | - return Response.status(Status.UNAUTHORIZED).build(); |
|---|
| 259 | + throw new SeCurisServiceException(ErrorCodes.UNAUTHORIZED_ACCESS, "Wrong credentials"); |
|---|
| 258 | 260 | } |
|---|
| 259 | 261 | user.setLastLogin(new Date()); |
|---|
| 260 | 262 | em.getTransaction().begin(); |
|---|