Skip to content
Snippets Groups Projects
Commit 8f794709 authored by Piotr Gawron's avatar Piotr Gawron
Browse files

user API for updating user privileges

parent ca310b19
No related branches found
No related tags found
2 merge requests!115Resolve "admin panel should use API",!114Resolve "admin panel should use API"
Hide whitespace changes
Inline Side-by-side
Showing
with 152 additions and 17 deletions
rest-api/src/main/java/lcsb/mapviewer/api/users/UserController.java
+ 17
− 1
View file @ 8f794709
......@@ -14,13 +14,18 @@ import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.CookieValue;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import com.fasterxml.jackson.core.JsonParseException;
import com.fasterxml.jackson.databind.JsonMappingException;
import lcsb.mapviewer.api.BaseController;
import lcsb.mapviewer.api.ObjectNotFoundException;
import lcsb.mapviewer.api.QueryException;
import lcsb.mapviewer.common.Configuration;
import lcsb.mapviewer.services.SecurityException;
import lcsb.mapviewer.services.interfaces.IUserService;
......@@ -77,7 +82,18 @@ public class UserController extends BaseController {
) throws SecurityException, ObjectNotFoundException {
return userRest.getUser(token, login, columns);
}
@RequestMapping(value = "/users/{login}:updatePrivileges", method = { RequestMethod.POST }, produces = { MediaType.APPLICATION_JSON_VALUE })
public Map<String, Object> updatePrivileges(//
@RequestBody String body, //
@CookieValue(value = Configuration.AUTH_TOKEN) String token, //
@PathVariable(value = "login") String login //
) throws SecurityException, JsonParseException, JsonMappingException, IOException, QueryException {
Map<String, Object> node = parseBody(body);
Map<String, Object> data = getData(node, "privileges");
return userRest.updatePrivileges(token, login, data);
}
@RequestMapping(value = "/users/", method = { RequestMethod.GET }, produces = { MediaType.APPLICATION_JSON_VALUE })
public List<Map<String, Object>> getUsers(//
@CookieValue(value = Configuration.AUTH_TOKEN) String token, //
......
rest-api/src/main/java/lcsb/mapviewer/api/users/UserRestImpl.java
+ 46
− 3
View file @ 8f794709
......@@ -7,11 +7,13 @@ import java.util.List;
import java.util.Map;
import java.util.Set;
import org.apache.log4j.Logger;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.transaction.annotation.Transactional;
import lcsb.mapviewer.api.BaseRestImpl;
import lcsb.mapviewer.api.ObjectNotFoundException;
import lcsb.mapviewer.api.QueryException;
import lcsb.mapviewer.common.exception.InvalidArgumentException;
import lcsb.mapviewer.model.user.BasicPrivilege;
import lcsb.mapviewer.model.user.ObjectPrivilege;
......@@ -24,6 +26,7 @@ import lcsb.mapviewer.services.view.AuthenticationToken;
@Transactional(value = "txManager")
public class UserRestImpl extends BaseRestImpl {
Logger logger = Logger.getLogger(UserRestImpl.class);
@Autowired
private ILayoutService layoutService;
......@@ -35,13 +38,12 @@ public class UserRestImpl extends BaseRestImpl {
boolean isAdmin = getUserService().userHasPrivilege(ownUserData, PrivilegeType.USER_MANAGEMENT);
if (ownUserData.getLogin().equals(login)) {
return prepareUse(ownUserData, columnSet, true);
} else if (isAdmin) {
if (ownUserData.getLogin().equals(login) || isAdmin) {
User user = getUserService().getUserByLogin(login);
if (user == null) {
throw new ObjectNotFoundException("User doesn't exist");
}
logger.debug(user.hashCode());
return prepareUse(user, columnSet, isAdmin);
} else {
throw new SecurityException("You cannot access data of the user with given id");
......@@ -168,4 +170,45 @@ public class UserRestImpl extends BaseRestImpl {
return result;
}
public Map<String, Object> updatePrivileges(String token, String login, Map<String, Object> privilegesData) throws SecurityException, QueryException {
if (privilegesData == null) {
throw new QueryException("Privileges not defined");
}
logger.debug(privilegesData);
try {
AuthenticationToken authenticationToken = getUserService().getToken(token);
User modifiedUser = getUserService().getUserByLogin(login);
logger.debug(modifiedUser.hashCode());
for (String key : privilegesData.keySet()) {
Object value = privilegesData.get(key);
PrivilegeType type = PrivilegeType.valueOf(key);
Integer objectId = null;
Object privilegeToSet = null;
if (type.getPrivilegeClassType().equals(BasicPrivilege.class)) {
privilegeToSet = value;
} else if (type.getPrivilegeClassType().equals(ObjectPrivilege.class)) {
if (value instanceof Map) {
privilegeToSet = ((Map<?, ?>) value).get(value);
objectId = (Integer) ((Map<?, ?>) value).get(objectId);
} else {
throw new QueryException("Invalid value for privilege: " + key);
}
} else {
throw new QueryException("Unknown privilege type: " + key);
}
if (objectId == null) {
getUserService().setUserPrivilege(modifiedUser, type, privilegeToSet, authenticationToken);
} else {
getUserService().setUserPrivilege(modifiedUser, type, privilegeToSet, objectId, authenticationToken);
}
}
return getUser(token, login, "");
} catch (IllegalArgumentException e) {
throw new QueryException("Invalid input", e);
}
}
}
rest-api/src/test/java/lcsb/mapviewer/api/users/UserRestImplTest.java
+ 24
− 1
View file @ 8f794709
package lcsb.mapviewer.api.users;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertTrue;
import java.util.HashMap;
import java.util.Map;
import org.apache.log4j.Logger;
import org.junit.After;
......@@ -10,8 +15,8 @@ import org.junit.Test;
import org.springframework.beans.factory.annotation.Autowired;
import lcsb.mapviewer.api.RestTestFunctions;
import lcsb.mapviewer.api.users.UserRestImpl;
import lcsb.mapviewer.common.Configuration;
import lcsb.mapviewer.model.user.PrivilegeType;
public class UserRestImplTest extends RestTestFunctions {
Logger logger = Logger.getLogger(UserRestImplTest.class);
......@@ -42,6 +47,24 @@ public class UserRestImplTest extends RestTestFunctions {
}
}
@Test
public void testUpdatePrivileges() throws Exception {
try {
Map<String, Object> data = new HashMap<>();
data.put(PrivilegeType.ADD_MAP.name(), 1);
userRestImpl.updatePrivileges(adminToken.getId(), Configuration.ANONYMOUS_LOGIN, data);
assertTrue(userService.userHasPrivilege(userService.getUserByLogin(Configuration.ANONYMOUS_LOGIN), PrivilegeType.ADD_MAP));
data.put(PrivilegeType.ADD_MAP.name(), 0);
userRestImpl.updatePrivileges(adminToken.getId(), Configuration.ANONYMOUS_LOGIN, data);
assertFalse(userService.userHasPrivilege(userService.getUserByLogin(Configuration.ANONYMOUS_LOGIN), PrivilegeType.ADD_MAP));
} catch (Exception e) {
e.printStackTrace();
throw e;
}
}
@Test
public void testGetUsers() throws Exception {
try {
......
service/src/main/java/lcsb/mapviewer/services/impl/UserService.java
+ 58
− 9
View file @ 8f794709
......@@ -310,16 +310,9 @@ public class UserService implements IUserService {
@Override
public int getUserPrivilegeLevel(User user, PrivilegeType type, Object object) {
if (type.getPrivilegeClassType() != ObjectPrivilege.class) {
throw new InvalidArgumentException("This privilege doesn't accept object parameter");
}
if (object == null) {
throw new InvalidArgumentException("Object cannot be null");
}
if (!type.getPrivilegeObjectType().isAssignableFrom(object.getClass())) {
throw new InvalidArgumentException(
"This privilege accept only " + type.getPrivilegeObjectType() + " objects parameter, but " + object.getClass() + " class found.");
}
Integer id = null;
try {
id = ObjectUtils.getIdOfObject(object);
......@@ -327,6 +320,17 @@ public class UserService implements IUserService {
logger.error(e.getMessage(), e);
throw new InvalidArgumentException("Internal server error. Problem with accessing id of the parameter object");
}
if (!type.getPrivilegeObjectType().isAssignableFrom(object.getClass())) {
throw new InvalidArgumentException(
"This privilege accept only " + type.getPrivilegeObjectType() + " objects parameter, but " + object.getClass() + " class found.");
}
return getUserPrivilegeLevel(user, type, id);
}
private int getUserPrivilegeLevel(User user, PrivilegeType type, Integer id) {
if (type.getPrivilegeClassType() != ObjectPrivilege.class) {
throw new InvalidArgumentException("This privilege doesn't accept object parameter");
}
if (id == null) {
throw new InvalidArgumentException("Parameter object has null id value");
}
......@@ -355,8 +359,8 @@ public class UserService implements IUserService {
}
@Override
public void setUserPrivilege(User user, PrivilegeType type) {
BasicPrivilege privilege = new BasicPrivilege(1, type, user);
public void setUserPrivilege(User user, PrivilegeType type, Integer value) {
BasicPrivilege privilege = new BasicPrivilege(value, type, user);
BasicPrivilege oldPrivilege = null;
for (BasicPrivilege privilegeIter : user.getPrivileges()) {
......@@ -590,4 +594,49 @@ public class UserService implements IUserService {
throw new SecurityException("You have no access to users data");
}
}
@Override
public void setUserPrivilege(User user, PrivilegeType type, Object value, AuthenticationToken token) throws SecurityException {
if (!userHasPrivilege(token, PrivilegeType.USER_MANAGEMENT)) {
throw new SecurityException("You cannot modify user privileges");
}
if (value instanceof Integer) {
setUserPrivilege(user, type, (Integer) value);
} else if (value instanceof Boolean) {
if ((Boolean) value) {
setUserPrivilege(user, type, 1);
} else {
setUserPrivilege(user, type, 0);
}
} else {
throw new InvalidArgumentException("Invalid privilege value: " + value);
}
}
@Override
public void setUserPrivilege(User user, PrivilegeType type, Object value, Integer objectId, AuthenticationToken token) throws SecurityException {
boolean canModify = userHasPrivilege(token, PrivilegeType.USER_MANAGEMENT);
if (!canModify) {
if (type.getPrivilegeObjectType().isAssignableFrom(Project.class)) {
canModify = getUserPrivilegeLevel(getUserByToken(token), type, objectId) > 0;
}
}
if (!canModify) {
throw new SecurityException("You cannot modify user privileges");
}
Project projectIdWrapper = new Project();
projectIdWrapper.setId(objectId);
if (value instanceof Integer) {
setUserPrivilege(user, new ObjectPrivilege(projectIdWrapper, (Integer) value, type, user));
} else if (value instanceof Boolean) {
if ((Boolean) value) {
setUserPrivilege(user, new ObjectPrivilege(projectIdWrapper, 1, type, user));
} else {
setUserPrivilege(user, new ObjectPrivilege(projectIdWrapper, 0, type, user));
}
} else {
throw new InvalidArgumentException("Invalid privilege value: " + value);
}
}
}
service/src/main/java/lcsb/mapviewer/services/interfaces/IUserService.java
+ 5
− 1
View file @ 8f794709
......@@ -201,7 +201,7 @@ public interface IUserService {
* @param type
* type of the privilege
*/
void setUserPrivilege(User user, PrivilegeType type);
void setUserPrivilege(User user, PrivilegeType type, Integer value);
/**
* Updates users from list of user
......@@ -258,4 +258,8 @@ public interface IUserService {
User getUserById(String creatorId, AuthenticationToken authenticationToken) throws SecurityException;
List<User> getUsers(AuthenticationToken token) throws SecurityException;
void setUserPrivilege(User modifiedUser, PrivilegeType type, Object privilegeToSet, AuthenticationToken authenticationToken) throws SecurityException;
void setUserPrivilege(User modifiedUser, PrivilegeType type, Object privilegeToSet, Integer objectId, AuthenticationToken authenticationToken) throws SecurityException;
}
web/src/test/java/lcsb/mapviewer/bean/ConfigurationBeanTest.java
+ 2
− 2
View file @ 8f794709
......@@ -33,8 +33,8 @@ public class ConfigurationBeanTest extends WebTestFunctions {
user2 = new User();
userService.addUser(user2);
userService.setUserPrivilege(user2, PrivilegeType.CONFIGURATION_MANAGE);
userService.setUserPrivilege(user2, PrivilegeType.ADD_MAP);
userService.setUserPrivilege(user2, PrivilegeType.CONFIGURATION_MANAGE, 1);
userService.setUserPrivilege(user2, PrivilegeType.ADD_MAP, 1);
uBean.setLoggedUser(user2);
oldValue = configurationService.getConfigurationValue(ConfigurationElementType.DEFAULT_MAP);
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment