gerrit.onap Code Review - portal/sdk.git/blob

   1 /*-
   2  * ================================================================================
   3  * eCOMP Portal SDK
   4  * ================================================================================
   5  * Copyright (C) 2017 AT&T Intellectual Property
   6  * ================================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ================================================================================
  19  */
  20 package org.openecomp.portalsdk.core.interceptor;
  21
  22 import java.net.HttpURLConnection;
  23 import java.util.List;
  24
  25 import javax.servlet.http.HttpServletRequest;
  26 import javax.servlet.http.HttpServletResponse;
  27 import javax.servlet.http.HttpSession;
  28
  29 import org.openecomp.portalsdk.core.controller.FusionBaseController;
  30 import org.openecomp.portalsdk.core.domain.App;
  31 import org.openecomp.portalsdk.core.exception.UrlAccessRestrictedException;
  32 import org.openecomp.portalsdk.core.logging.format.AlarmSeverityEnum;
  33 import org.openecomp.portalsdk.core.logging.logic.EELFLoggerDelegate;
  34 import org.openecomp.portalsdk.core.objectcache.AbstractCacheManager;
  35 import org.openecomp.portalsdk.core.onboarding.listener.PortalTimeoutHandler;
  36 import org.openecomp.portalsdk.core.onboarding.util.CipherUtil;
  37 import org.openecomp.portalsdk.core.onboarding.util.PortalApiConstants;
  38 import org.openecomp.portalsdk.core.onboarding.util.PortalApiProperties;
  39 import org.openecomp.portalsdk.core.service.DataAccessService;
  40 import org.openecomp.portalsdk.core.service.LoginService;
  41 import org.openecomp.portalsdk.core.service.WebServiceCallService;
  42 import org.openecomp.portalsdk.core.util.SystemProperties;
  43 import org.openecomp.portalsdk.core.web.support.UserUtils;
  44 import org.springframework.beans.factory.annotation.Autowired;
  45 import org.springframework.web.method.HandlerMethod;
  46 import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
  47
  48 public class ResourceInterceptor extends HandlerInterceptorAdapter {
  49         public static final String APP_METADATA = "APP.METADATA";
  50
  51         EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(ResourceInterceptor.class);
  52
  53         @Autowired
  54         private DataAccessService dataAccessService;
  55         @Autowired
  56         private LoginService loginService;
  57         @Autowired
  58         private WebServiceCallService webServiceCallService;
  59
  60         private AbstractCacheManager cacheManager;
  61
  62         @Override
  63         public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
  64                         throws Exception {
  65                 String uri = request.getRequestURI();
  66                 String url = uri.substring(uri.indexOf("/", 1) + 1);
  67                 logger.info(EELFLoggerDelegate.debugLogger, "Url - " + url);
  68                 logger.info(EELFLoggerDelegate.debugLogger, "lastIndexOf - " + uri.substring(uri.lastIndexOf("/") + 1));
  69                 if (handler instanceof HandlerMethod) {
  70                         HandlerMethod method = (HandlerMethod) handler;
  71                         FusionBaseController controller = (FusionBaseController) method.getBean();
  72                         if (!controller.isAccessible()) {
  73                                 if (controller.isRESTfulCall()) {
  74                                         // check user authentication for RESTful calls
  75                                         String secretKey = null;
  76                                         try {
  77                                                 if (!webServiceCallService.verifyRESTCredential(secretKey, request.getHeader("username"),
  78                                                                 request.getHeader("password"))) {
  79                                                         logger.error(EELFLoggerDelegate.errorLogger, "Error accesing RESTful service. Un-authorized",AlarmSeverityEnum.MINOR);
  80                                                         throw new UrlAccessRestrictedException();
  81                                                 }
  82                                         } catch (Exception e) {
  83                                                 logger.error(EELFLoggerDelegate.errorLogger, "Error authenticating RESTful service :" + e,AlarmSeverityEnum.MINOR);
  84                                                 //throw new UrlAccessRestrictedException();
  85                                                  HttpSession httpSession = request.getSession();
  86                                                     ((HttpServletResponse) response).setStatus(HttpURLConnection.HTTP_UNAUTHORIZED);
  87                                                     return false;
  88                                         }
  89                                 }
  90                                 if (!UserUtils.isUrlAccessible(request, url)) {
  91                                         logger.error(EELFLoggerDelegate.errorLogger, "Error accesing URL. Un-authorized",AlarmSeverityEnum.MINOR);
  92                                         throw new UrlAccessRestrictedException();
  93                                 }
  94                         }
  95                 }
  96
  97                 logger.debug("successfully authorized rest call");
  98                 logger.info(EELFLoggerDelegate.debugLogger, "successfully authorized rest call");
  99                 handleSessionUpdates(request);
 100                 logger.debug("handled session updates for synchronization");
 101                 logger.info(EELFLoggerDelegate.debugLogger, "handled session updates for synchronization");
 102                 return super.preHandle(request, response, handler);
 103         }
 104
 105         /**
 106          *
 107          * @param request
 108          */
 109         protected void handleSessionUpdates(HttpServletRequest request) {
 110
 111                 App app = null;
 112                 Object appObj = getCacheManager().getObject(APP_METADATA);
 113                 if (appObj == null) {
 114                         app = findApp();
 115                         getCacheManager().putObject(APP_METADATA, app);
 116
 117                 } else {
 118                         app = (App) appObj;
 119                 }
 120
 121                 String ecompRestURL = PortalApiProperties.getProperty(PortalApiConstants.ECOMP_REST_URL);
 122                 String decreptedPwd = "";
 123                 try {
 124                         decreptedPwd = CipherUtil.decrypt(app.getAppPassword(),
 125                                         SystemProperties.getProperty(SystemProperties.Decryption_Key));
 126                 } catch (Exception e) {
 127                         logger.error(EELFLoggerDelegate.errorLogger, "Could not decrypt Password" + e.getMessage(),AlarmSeverityEnum.MINOR);
 128                 }
 129
 130                 PortalTimeoutHandler.handleSessionUpdatesNative(request, app.getUsername(), decreptedPwd,
 131                                 PortalApiProperties.getProperty(PortalApiConstants.UEB_APP_KEY), ecompRestURL, null);
 132         }
 133
 134         public App findApp() {
 135                 List<?> list = null;
 136                 StringBuffer criteria = new StringBuffer();
 137                 criteria.append(" where id = 1");
 138                 list = getDataAccessService().getList(App.class, criteria.toString(), null, null);
 139                 return (list == null || list.size() == 0) ? null : (App) list.get(0);
 140         }
 141
 142         public DataAccessService getDataAccessService() {
 143                 return dataAccessService;
 144         }
 145
 146         public void setDataAccessService(DataAccessService dataAccessService) {
 147                 this.dataAccessService = dataAccessService;
 148         }
 149
 150         public LoginService getLoginService() {
 151                 return loginService;
 152         }
 153
 154         public void setLoginService(LoginService loginService) {
 155                 this.loginService = loginService;
 156         }
 157
 158         @Autowired
 159         public void setCacheManager(AbstractCacheManager cacheManager) {
 160                 this.cacheManager = cacheManager;
 161         }
 162
 163         public AbstractCacheManager getCacheManager() {
 164                 return cacheManager;
 165         }
 166
 167 }