Merge "Fix sql injection vulnerability"
[portal.git] / ecomp-portal-BE-common / src / main / java / org / onap / portalapp / portal / service / AdminRolesServiceImpl.java
index c8e04f4..18aac6f 100644 (file)
@@ -4,6 +4,8 @@
  * ===================================================================
  * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
  * ===================================================================
+ * Modifications Copyright (c) 2019 Samsung
+ * ===================================================================
  *
  * Unless otherwise specified, all software contained herein is licensed
  * under the Apache License, Version 2.0 (the "License");
@@ -63,6 +65,7 @@ import org.onap.portalapp.portal.domain.EPUser;
 import org.onap.portalapp.portal.domain.EPUserApp;
 import org.onap.portalapp.portal.domain.UserIdRoleId;
 import org.onap.portalapp.portal.domain.UserRole;
+import org.onap.portalapp.portal.exceptions.RoleFunctionException;
 import org.onap.portalapp.portal.logging.aop.EPMetricsLog;
 import org.onap.portalapp.portal.logging.format.EPAppMessagesEnum;
 import org.onap.portalapp.portal.logging.logic.EPLogUtil;
@@ -75,6 +78,7 @@ import org.onap.portalapp.portal.utils.EcompPortalUtils;
 import org.onap.portalapp.portal.utils.PortalConstants;
 import org.onap.portalapp.util.EPUserUtils;
 import org.onap.portalsdk.core.domain.RoleFunction;
+import org.onap.portalsdk.core.domain.User;
 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
 import org.onap.portalsdk.core.restful.domain.EcompRole;
 import org.onap.portalsdk.core.service.DataAccessService;
@@ -143,9 +147,9 @@ public class AdminRolesServiceImpl implements AdminRolesService {
                        try {
                                userList = dataAccessService.executeNamedQuery("getEPUserByOrgUserId", userParams, null);
                        } catch (Exception e) {
-                               logger.error(EELFLoggerDelegate.errorLogger, "getEPUserByOrgUserId failed", e);                 
+                               logger.error(EELFLoggerDelegate.errorLogger, "getEPUserByOrgUserId failed", e);
                        }
-                               
+
                        HashMap<Long, Long> appsUserAdmin = new HashMap<Long, Long>();
                        if (userList!= null && userList.size() > 0) {
                                EPUser user = userList.get(0);
@@ -166,8 +170,10 @@ public class AdminRolesServiceImpl implements AdminRolesService {
                        appsListWithAdminRole.orgUserId = orgUserId;
                        List<EPApp> appsList = null;
                        try {
-                               appsList = dataAccessService.getList(EPApp.class,
-                                               "  where ( enabled = 'Y' or id = " + ECOMP_APP_ID + ")", null, null);
+//                             appsList = dataAccessService.getList(EPApp.class,
+//                                             null, null, null);
+                               
+                               appsList = dataAccessService.getList(EPApp.class, null);
                        } catch (Exception e) {
                                logger.error(EELFLoggerDelegate.errorLogger, "getAppsWithAdminRoleStateForUser 2 failed", e);
                                EPLogUtil.logEcompError(EPAppMessagesEnum.BeDaoSystemError);
@@ -200,9 +206,9 @@ public class AdminRolesServiceImpl implements AdminRolesService {
                                List<EPApp> apps = appsService.getAppsFullList();
                                HashMap<Long, EPApp> enabledApps = new HashMap<Long, EPApp>();
                                for (EPApp app : apps) {
-                                       if (app.getEnabled().booleanValue() || app.getId() == ECOMP_APP_ID) {
+//                                     if (app.getEnabled().booleanValue() || app.getId() == ECOMP_APP_ID) {
                                                enabledApps.put(app.getId(), app);
-                                       }
+//                                     }
                                }
                                List<AppNameIdIsAdmin> newAppsWhereUserIsAdmin = new ArrayList<AppNameIdIsAdmin>();
                                for (AppNameIdIsAdmin adminRole : newAppsListWithAdminRoles.appsRoles) {
@@ -265,7 +271,7 @@ public class AdminRolesServiceImpl implements AdminRolesService {
                                                        // Add user admin role for list of centralized applications in external system
                                                        addAdminRoleInExternalSystem(user, localSession, newAppsWhereUserIsAdmin);
                                                        result = true;
-                                               }       
+                                               }
                                        } catch (Exception e) {
                                                EPLogUtil.logEcompError(logger, EPAppMessagesEnum.BeDaoSystemError, e);
                                                logger.error(EELFLoggerDelegate.errorLogger,
@@ -444,12 +450,14 @@ public class AdminRolesServiceImpl implements AdminRolesService {
 
        public boolean isAccountAdmin(EPUser user) {
                try {
-                       EPUser currentUser = user != null
-                                       ? (EPUser) dataAccessService.getDomainObject(EPUser.class, user.getId(), null)
-                                       : null;
-                       
+        if (user == null) {
+            return false;
+        }
+
+                       EPUser currentUser = (EPUser) dataAccessService.getDomainObject(EPUser.class, user.getId(), null);
+
                        final Map<String, Long> userParams = new HashMap<>();
-                       userParams.put("userId", user.getId()); 
+                       userParams.put("userId", user.getId());
                        logger.debug(EELFLoggerDelegate.debugLogger, "Is account admin for user {}", user.getId());
                        List<Integer> userAdminApps = new ArrayList<>();
 
@@ -460,7 +468,7 @@ public class AdminRolesServiceImpl implements AdminRolesService {
                        if (currentUser != null && currentUser.getId() != null) {
                                for (EPUserApp userApp : currentUser.getEPUserApps()) {
 
-                                       
+
                                        if (userApp.getRole().getId().equals(ACCOUNT_ADMIN_ROLE_ID)||(userAdminApps.size()>1)) {
                                                logger.debug(EELFLoggerDelegate.debugLogger, "Is account admin for userAdminApps() - for user {}, found Id {}", user.getOrgUserId(), userApp.getRole().getId());
                                                // Account Administrator sees only the applications
@@ -476,19 +484,14 @@ public class AdminRolesServiceImpl implements AdminRolesService {
                }
                return false;
        }
-       
-       
+
+
        public boolean isRoleAdmin(EPUser user) {
                try {
                        logger.debug(EELFLoggerDelegate.debugLogger, "Checking if user has isRoleAdmin access");
 
-                       EPUser currentUser = user != null
-                                       ? (EPUser) dataAccessService.getDomainObject(EPUser.class, user.getId(), null)
-                                       : null;
                                        final Map<String, Long> userParams = new HashMap<>();
-                                       userParams.put("userId", user.getId()); 
-                                       List<RoleFunction> roleFunctionSet = new ArrayList<>();
-
+                                       userParams.put("userId", user.getId());
                                        List getRoleFuncListOfUser = dataAccessService.executeNamedQuery("getRoleFunctionsOfUserforAlltheApplications", userParams, null);
                                        logger.debug(EELFLoggerDelegate.debugLogger, "Checking if user has isRoleAdmin access :: getRoleFuncListOfUser" , getRoleFuncListOfUser);
                                        Set<String> getRoleFuncListOfPortalSet = new HashSet<>(getRoleFuncListOfUser);
@@ -497,26 +500,15 @@ public class AdminRolesServiceImpl implements AdminRolesService {
                                        roleFunSet = getRoleFuncListOfPortalSet.stream().filter(x -> x.contains("|")).collect(Collectors.toSet());
                                        if (roleFunSet.size() > 0)
                                                for (String roleFunction : roleFunSet) {
-                                                       //String roleFun = EcompPortalUtils.getFunctionCode(roleFunction);
-                                                       String roleFun = EcompPortalUtils.getFunctionCode(roleFunction);
                                                        String type = externalAccessRolesService.getFunctionCodeType(roleFunction);
-                                                       //getRoleFuncListOfPortalSet.remove(roleFunction);
                                                        getRoleFuncListOfPortalSet1.add(type);
                                                }
                                
-                                       
-                                       
-                                       for (String rolefunc : getRoleFuncListOfPortalSet1) {
-                                               logger.debug(EELFLoggerDelegate.debugLogger, "Checking if user has approver rolefunction" , rolefunc);
-                                       if (rolefunc.equalsIgnoreCase(TYPE_APPROVER)) {
-                                                       logger.debug(EELFLoggerDelegate.debugLogger, "Checking if user has approver rolefunction" , rolefunc);
-                                           return true;
-                                       }else{
-                                                      return false;
-
-                                       }
-                                   }
-                              
+                                       boolean checkIfFunctionsExits = getRoleFuncListOfPortalSet1.stream()
+                                                       .anyMatch(roleFunction -> roleFunction.equalsIgnoreCase("Approver"));
+                                       logger.debug(EELFLoggerDelegate.debugLogger, "Checking if user has approver rolefunction" , checkIfFunctionsExits);
+
+                                       return checkIfFunctionsExits;
                
                } catch (Exception e) {
                        EPLogUtil.logEcompError(logger, EPAppMessagesEnum.BeDaoSystemError, e);
@@ -568,13 +560,61 @@ public class AdminRolesServiceImpl implements AdminRolesService {
                Boolean isApplicationAccountAdmin=false;
                try {
                                        final Map<String, Long> userParams = new HashMap<>();
-                                       userParams.put("userId", user.getId()); 
+                                       userParams.put("userId", user.getId());
                                        logger.debug(EELFLoggerDelegate.debugLogger, "Is account admin for user {}", user.getId());
                                        List<Integer> userAdminApps = new ArrayList<>();
                                        userAdminApps =dataAccessService.executeNamedQuery("getAdminAppsForTheUser", userParams, null);
                                        if(userAdminApps.size()>=1){
                                        isApplicationAccountAdmin=userAdminApps.contains((int) (long) app.getId());
                                        logger.debug(EELFLoggerDelegate.debugLogger, "Is account admin for user is true{} ,appId {}", user.getId(),app.getId());
+                                       }
+                       } catch (Exception e) {
+                       EPLogUtil.logEcompError(logger, EPAppMessagesEnum.BeDaoSystemError, e);
+                       logger.error(EELFLoggerDelegate.errorLogger,
+                                       "Exception occurred while executing isAccountAdminOfApplication operation", e);
+               }
+               logger.debug(EELFLoggerDelegate.debugLogger, "In AdminRolesServiceImpl() - isAccountAdminOfApplication = {} and userId ={} ", isApplicationAccountAdmin, user.getOrgUserId());
+               return isApplicationAccountAdmin;
+
+       }
+
+       @Override
+       public Set<String> getAllAppsFunctionsOfUser(String OrgUserId) throws RoleFunctionException {
+               final Map<String, String> params = new HashMap<>();
+               params.put("userId", OrgUserId);
+               List getRoleFuncListOfPortal = dataAccessService.executeNamedQuery("getAllAppsFunctionsOfUser", params, null);
+               Set<String> getRoleFuncListOfPortalSet = new HashSet<>(getRoleFuncListOfPortal);
+               Set<String> roleFunSet = new HashSet<>();
+               roleFunSet = getRoleFuncListOfPortalSet.stream().filter(x -> x.contains("|")).collect(Collectors.toSet());
+               if (roleFunSet.size() > 0)
+                       for (String roleFunction : roleFunSet) {
+                               String roleFun = EcompPortalUtils.getFunctionCode(roleFunction);
+                               getRoleFuncListOfPortalSet.remove(roleFunction);
+                               getRoleFuncListOfPortalSet.add(roleFun);
+                       }
+
+               Set<String> finalRoleFunctionSet = new HashSet<>();
+               for (String roleFn : getRoleFuncListOfPortalSet) {
+                       finalRoleFunctionSet.add(EPUserUtils.decodeFunctionCode(roleFn));
+               }
+               
+//             List<String> functionsOfUser = new ArrayList<>(getRoleFuncListOfPortal);
+               return finalRoleFunctionSet;
+       }
+
+       
+       @Override
+       public boolean isAccountAdminOfAnyActiveorInactiveApplication(EPUser user, EPApp app) {
+               Boolean isApplicationAccountAdmin=false;
+               try {
+                                       final Map<String, Long> userParams = new HashMap<>();
+                                       userParams.put("userId", user.getId()); 
+                                       logger.debug(EELFLoggerDelegate.debugLogger, "Is account admin for user {}", user.getId());
+                                       List<Integer> userAdminApps = new ArrayList<>();
+                                       userAdminApps =dataAccessService.executeNamedQuery("getAllAdminAppsofTheUser", userParams, null);
+                                       if(userAdminApps.size()>=1){
+                                       isApplicationAccountAdmin=userAdminApps.contains((int) (long) app.getId());
+                                       logger.debug(EELFLoggerDelegate.debugLogger, "Is account admin for user is true{} ,appId {}", user.getId(),app.getId());
                                        }                                       
                        } catch (Exception e) {
                        EPLogUtil.logEcompError(logger, EPAppMessagesEnum.BeDaoSystemError, e);