Handling authorization in Subscription REST API

Subscription operations are allowed only on user's own subscription.

Author: saif-ericsson

pom.xml

@@ -225,7 +225,7 @@
 
             <!-- PhoenixNAP RAML Code Generator plugin used to generate sources
                 from raml -->
-            <plugin>
+               <plugin>
                 <groupId>com.phoenixnap.oss</groupId>
                 <artifactId>springmvc-raml-plugin</artifactId>
                 <version>${plugin-version}</version>
@@ -302,4 +302,4 @@
 
         </plugins>
     </build>
-</project>
+</project>

src/main/java/com/ericsson/ei/controller/QueryAggregatedObjectController.java

@@ -1,7 +1,6 @@
 
 package com.ericsson.ei.controller;
 
-import com.ericsson.ei.controller.model.QueryResponse;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;

src/main/java/com/ericsson/ei/controller/QueryMissedNotificationController.java

@@ -1,7 +1,6 @@
 
 package com.ericsson.ei.controller;
 
-import com.ericsson.ei.controller.model.QueryResponse;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;

src/main/java/com/ericsson/ei/controller/RuleCheckController.java

@@ -2,7 +2,6 @@
 package com.ericsson.ei.controller;
 
 import javax.validation.Valid;
-import com.ericsson.ei.controller.model.RuleCheckBody;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;

src/main/java/com/ericsson/ei/controller/SubscriptionController.java

@@ -26,7 +26,7 @@ public interface SubscriptionController {
      * 
      */
     @RequestMapping(value = "", method = RequestMethod.GET)
-    public ResponseEntity<List<com.ericsson.ei.controller.model.Subscription>> getSubscriptions();
+    public ResponseEntity<List<String>> getSubscriptions();
 
     /**
      * Takes the subscription rules, the name for subscription and the user name of the person registering this subscription and saves the subscription in subscription database. The name needs to be unique.
@@ -36,34 +36,34 @@ public interface SubscriptionController {
     public ResponseEntity<?> createSubscription(
         @Valid
         @RequestBody
-        List<com.ericsson.ei.controller.model.Subscription> subscription);
+        List<String> string);
 
     /**
      * Modify an existing Subscription.
      * 
      */
     @RequestMapping(value = "", method = RequestMethod.PUT)
-    public ResponseEntity<com.ericsson.ei.controller.model.SubscriptionResponse> updateSubscriptions(
+    public ResponseEntity<SubscriptionResponse> updateSubscriptions(
         @Valid
         @RequestBody
-        List<com.ericsson.ei.controller.model.Subscription> subscription);
+        List<String> string);
 
     /**
      * Returns the subscription rules for given subscription name.
      * 
      */
     @RequestMapping(value = "/{subscriptionName}", method = RequestMethod.GET)
-    public ResponseEntity<List<com.ericsson.ei.controller.model.Subscription>> getSubscriptionById(
+    public ResponseEntity<List<String>> getSubscriptionById(
         @PathVariable(required = false)
-        String subscriptionName);
+        java.lang.String subscriptionName);
 
     /**
      * Removes the subscription from the database.
      * 
      */
     @RequestMapping(value = "/{subscriptionName}", method = RequestMethod.DELETE)
-    public ResponseEntity<com.ericsson.ei.controller.model.SubscriptionResponse> deleteSubscriptionById(
+    public ResponseEntity<SubscriptionResponse> deleteSubscriptionById(
         @PathVariable(required = false)
-        String subscriptionName);
+        java.lang.String subscriptionName);
 
 }

src/main/java/com/ericsson/ei/controller/SubscriptionControllerImpl.java

@@ -23,8 +23,11 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Component;
 import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -45,6 +48,9 @@
 @Api(value = "subscription", description = "The Subscription API for the store and retrieve the subscriptions from the database")
 public class SubscriptionControllerImpl implements SubscriptionController {
 
+    @Value("${ldap.enabled}")
+    private boolean authenticate;
+
     @Autowired
     private ISubscriptionService subscriptionService;
 
@@ -58,7 +64,15 @@ public class SubscriptionControllerImpl implements SubscriptionController {
     public ResponseEntity<SubscriptionResponse> createSubscription(@RequestBody List<Subscription> subscriptions) {
         ResponseEntity<SubscriptionResponse> subResponse = null;
         SubscriptionResponse subscriptionResponse = new SubscriptionResponse();
+        
+        String user = "";        
         for (Subscription subscription : subscriptions) {
+
+            // Adding user name in subscription json
+            if (authenticate) {
+                user = currentUser();
+            }
+            subscription.setUserName(user);
             subResponse = null;
             try {
                 subscription.setCreated(Instant.now().toEpochMilli());
@@ -73,7 +87,7 @@ public ResponseEntity<SubscriptionResponse> createSubscription(@RequestBody List
                         HttpStatus.PRECONDITION_FAILED);
             }
 
-            if (!subscriptionService.doSubscriptionExist(subscription.getSubscriptionName())) {
+            if (!subscriptionService.doSubscriptionExist(subscription.getSubscriptionName(), user)) {
                 subscriptionService.addSubscription(subscription);
                 LOG.info("Subscription :" + subscription.getSubscriptionName() + " Inserted Successfully");
                 subscriptionResponse.setMsg("Inserted Successfully");
@@ -94,30 +108,34 @@ public ResponseEntity<SubscriptionResponse> createSubscription(@RequestBody List
     @CrossOrigin
     @ApiOperation(value = "Returns the subscription rules for given subscription name")
     public ResponseEntity<List<Subscription>> getSubscriptionById(@PathVariable String subscriptionName) {
+        String user = "";
+        if (authenticate) {
+            user = currentUser();
+        }
         List<Subscription> subscriptionList = new ArrayList<Subscription>();
         try {
             LOG.info("Subscription :" + subscriptionName + " fetch started");
-            subscriptionList.add(subscriptionService.getSubscription(subscriptionName));
+            subscriptionList.add(subscriptionService.getSubscription(subscriptionName, user));
             LOG.info("Subscription :" + subscriptionName + " fetched");
             return new ResponseEntity<List<Subscription>>(subscriptionList, HttpStatus.OK);
         } catch (SubscriptionNotFoundException e) {
             LOG.error("Subscription :" + subscriptionName + " not found in records");
             return new ResponseEntity<List<Subscription>>(subscriptionList, HttpStatus.OK);
-
         }
-
     }
 
     @Override
-
     // @CrossOrigin
     @ApiOperation(value = "Update the existing subscription by the subscription name")
     public ResponseEntity<SubscriptionResponse> updateSubscriptions(@RequestBody List<Subscription> subscriptions) {
+        String user = "";
+        if (authenticate) {
+            user = currentUser();
+        }
         Subscription subscription = subscriptions.get(0);
         String subscriptionName = subscription.getSubscriptionName();
         LOG.info("Subscription :" + subscriptionName + " update started");
         SubscriptionResponse subscriptionResponse = new SubscriptionResponse();
-
         try {
             subscription.setCreated(Instant.now().toEpochMilli());
             subscriptionValidator.validateSubscription(subscription);
@@ -130,8 +148,8 @@ public ResponseEntity<SubscriptionResponse> updateSubscriptions(@RequestBody Lis
             return new ResponseEntity<SubscriptionResponse>(subscriptionResponse, HttpStatus.PRECONDITION_FAILED);
         }
 
-        if (subscriptionService.doSubscriptionExist(subscriptionName)) {
-            subscriptionService.modifySubscription(subscription, subscriptionName);
+        if (subscriptionService.doSubscriptionExist(subscriptionName, user)) {
+            subscriptionService.modifySubscription(subscription, subscriptionName, user);
             LOG.info("Subscription :" + subscriptionName + " update completed");
             subscriptionResponse.setMsg("Updated Successfully");
             subscriptionResponse.setStatusCode(HttpStatus.OK.value());
@@ -143,16 +161,19 @@ public ResponseEntity<SubscriptionResponse> updateSubscriptions(@RequestBody Lis
             subscriptionResponse.setStatusCode(HttpStatus.BAD_REQUEST.value());
             return new ResponseEntity<SubscriptionResponse>(subscriptionResponse, HttpStatus.BAD_REQUEST);
         }
-
     }
 
     @Override
     @CrossOrigin
     @ApiOperation(value = "Removes the subscription from the database")
     public ResponseEntity<SubscriptionResponse> deleteSubscriptionById(@PathVariable String subscriptionName) {
+        String user = "";
+        if (authenticate) {
+            user = currentUser();
+        }
         SubscriptionResponse subscriptionResponse = new SubscriptionResponse();
         LOG.info("Subscription :" + subscriptionName + " delete started");
-        if (subscriptionService.deleteSubscription(subscriptionName)) {
+        if (subscriptionService.deleteSubscription(subscriptionName, user)) {
             LOG.info("Subscription :" + subscriptionName + " deleted Successfully");
             subscriptionResponse.setMsg("Deleted Successfully");
             subscriptionResponse.setStatusCode(HttpStatus.OK.value());
@@ -163,7 +184,6 @@ public ResponseEntity<SubscriptionResponse> deleteSubscriptionById(@PathVariable
             subscriptionResponse.setStatusCode(HttpStatus.BAD_REQUEST.value());
             return new ResponseEntity<SubscriptionResponse>(subscriptionResponse, HttpStatus.BAD_REQUEST);
         }
-
     }
 
     @Override
@@ -180,4 +200,8 @@ public ResponseEntity<List<Subscription>> getSubscriptions() {
             return new ResponseEntity<List<Subscription>>(subscriptionList, HttpStatus.OK);
         }
     }
+
+    public String currentUser() {
+        return SecurityContextHolder.getContext().getAuthentication().getName();        
+    }
 }

src/main/java/com/ericsson/ei/controller/model/Subscription.java

@@ -25,7 +25,8 @@
     "notificationMessageKeyValues",
     "repeat",
     "requirements",
-    "subscriptionName"
+    "subscriptionName",
+    "userName"
 })
 public class Subscription {
 
@@ -47,6 +48,8 @@ public class Subscription {
     private List<Requirement> requirements = new ArrayList<Requirement>();
     @JsonProperty("subscriptionName")
     private String subscriptionName;
+    @JsonProperty("userName")
+    private String userName;
     @JsonIgnore
     private Map<String, Object> additionalProperties = new HashMap<String, Object>();
 
@@ -140,6 +143,16 @@ public void setSubscriptionName(String subscriptionName) {
         this.subscriptionName = subscriptionName;
     }
 
+    @JsonProperty("userName")
+    public String getUserName() {
+        return userName;
+    }
+
+    @JsonProperty("userName")
+    public void setUserName(String userName) {
+        this.userName = userName;
+    }
+
     @Override
     public String toString() {
         return ToStringBuilder.reflectionToString(this);
@@ -157,7 +170,7 @@ public void setAdditionalProperty(String name, Object value) {
 
     @Override
     public int hashCode() {
-        return new HashCodeBuilder().append(aggregationtype).append(created).append(notificationMeta).append(notificationType).append(restPostBodyMediaType).append(notificationMessageKeyValues).append(repeat).append(requirements).append(subscriptionName).append(additionalProperties).toHashCode();
+        return new HashCodeBuilder().append(aggregationtype).append(created).append(notificationMeta).append(notificationType).append(restPostBodyMediaType).append(notificationMessageKeyValues).append(repeat).append(requirements).append(subscriptionName).append(userName).append(additionalProperties).toHashCode();
     }
 
     @Override
@@ -169,7 +182,7 @@ public boolean equals(Object other) {
             return false;
         }
         Subscription rhs = ((Subscription) other);
-        return new EqualsBuilder().append(aggregationtype, rhs.aggregationtype).append(created, rhs.created).append(notificationMeta, rhs.notificationMeta).append(notificationType, rhs.notificationType).append(restPostBodyMediaType, rhs.restPostBodyMediaType).append(notificationMessageKeyValues, rhs.notificationMessageKeyValues).append(repeat, rhs.repeat).append(requirements, rhs.requirements).append(subscriptionName, rhs.subscriptionName).append(additionalProperties, rhs.additionalProperties).isEquals();
+        return new EqualsBuilder().append(aggregationtype, rhs.aggregationtype).append(created, rhs.created).append(notificationMeta, rhs.notificationMeta).append(notificationType, rhs.notificationType).append(restPostBodyMediaType, rhs.restPostBodyMediaType).append(notificationMessageKeyValues, rhs.notificationMessageKeyValues).append(repeat, rhs.repeat).append(requirements, rhs.requirements).append(subscriptionName, rhs.subscriptionName).append(userName, rhs.userName).append(additionalProperties, rhs.additionalProperties).isEquals();
     }
 
 }

src/main/java/com/ericsson/ei/services/ISubscriptionService.java

@@ -44,30 +44,30 @@ public interface ISubscriptionService {
      * @return
      * @throws SubscriptionNotFoundException
      */
-    Subscription getSubscription(String name) throws SubscriptionNotFoundException;
+    Subscription getSubscription(String name, String user) throws SubscriptionNotFoundException;
 
     /**
      * 
      * @param subscription
      * @param subscriptionName
      * @return
      */
-    boolean modifySubscription(Subscription subscription, String subscriptionName);
+    boolean modifySubscription(Subscription subscription, String subscriptionName, String user);
 
     /**
      * 
      * @param name
      * @return 
      * @throws SubscriptionNotFoundException
      */
-    boolean deleteSubscription(String name);
+    boolean deleteSubscription(String name, String user);
 
     /**
      * doSubscriptionExist method checks the is there any Subscription By Subscription Name
      * @param name
      * @return true when Subscription available with same name. Otherwise returns false.
      */
-    boolean doSubscriptionExist(String name);
+    boolean doSubscriptionExist(String name, String user);
 
 
 }