datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/FeedServlet.java

   1 /*******************************************************************************
   2  * ============LICENSE_START==================================================
   3  * * org.onap.dmaap
   4  * * ===========================================================================
   5  * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
   6  * * ===========================================================================
   7  * * Licensed under the Apache License, Version 2.0 (the "License");
   8  * * you may not use this file except in compliance with the License.
   9  * * You may obtain a copy of the License at
  10  * *
  11  *  *      http://www.apache.org/licenses/LICENSE-2.0
  12  * *
  13  *  * Unless required by applicable law or agreed to in writing, software
  14  * * distributed under the License is distributed on an "AS IS" BASIS,
  15  * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * * See the License for the specific language governing permissions and
  17  * * limitations under the License.
  18  * * ============LICENSE_END====================================================
  19  * *
  20  * * ECOMP is a trademark and service mark of AT&T Intellectual Property.
  21  * *
  22  ******************************************************************************/
  23
  24
  25 package org.onap.dmaap.datarouter.provisioning;
  26
  27 import static org.onap.dmaap.datarouter.provisioning.utils.HttpServletUtils.sendResponseError;
  28
  29 import com.att.eelf.configuration.EELFLogger;
  30 import com.att.eelf.configuration.EELFManager;
  31 import java.io.IOException;
  32 import java.io.InvalidObjectException;
  33 import javax.servlet.http.HttpServletRequest;
  34 import javax.servlet.http.HttpServletResponse;
  35 import org.json.JSONException;
  36 import org.json.JSONObject;
  37
  38 import org.onap.dmaap.datarouter.authz.AuthorizationResponse;
  39 import org.onap.dmaap.datarouter.provisioning.beans.EventLogRecord;
  40 import org.onap.dmaap.datarouter.provisioning.beans.Feed;
  41 import org.onap.dmaap.datarouter.provisioning.eelf.EelfMsgs;
  42
  43
  44
  45 /**
  46  * This servlet handles provisioning for the &lt;feedURL&gt; which is generated by the provisioning
  47  * server to handle a particular feed. It supports DELETE to mark the feed as deleted,
  48  * and GET to retrieve information about the feed, and PUT to modify the feed.
  49  *
  50  * @author Robert Eby
  51  * @version $Id$
  52  */
  53 @SuppressWarnings("serial")
  54
  55 public class FeedServlet extends ProxyServlet {
  56
  57     //Adding EELF Logger Rally:US664892
  58     private static EELFLogger eelfLogger = EELFManager.getInstance().getLogger(FeedServlet.class);
  59
  60     /**
  61      * Delete the Feed at the address /feed/&lt;feednumber&gt;.
  62      * See the <i>Deleting a Feed</i> section in the <b>Provisioning API</b>
  63      * document for details on how this method should be invoked.
  64      */
  65     @Override
  66     public void doDelete(HttpServletRequest req, HttpServletResponse resp) {
  67         setIpFqdnRequestIDandInvocationIDForEelf("doDelete", req);
  68         eelfLogger.info(EelfMsgs.ENTRY);
  69         try {
  70             eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID,
  71                     req.getHeader(BEHALF_HEADER),getIdFromPath(req) + "");
  72             EventLogRecord elr = new EventLogRecord(req);
  73             String message = isAuthorizedForProvisioning(req);
  74             if (message != null) {
  75                 elr.setMessage(message);
  76                 elr.setResult(HttpServletResponse.SC_FORBIDDEN);
  77                 eventlogger.error(elr.toString());
  78                 sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
  79                 return;
  80             }
  81             if (isProxyServer()) {
  82                 super.doDelete(req, resp);
  83                 return;
  84             }
  85             String bhdr = req.getHeader(BEHALF_HEADER);
  86             if (bhdr == null) {
  87                 message = MISSING_ON_BEHALF;
  88                 elr.setMessage(message);
  89                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
  90                 eventlogger.error(elr.toString());
  91                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
  92                 return;
  93             }
  94             int feedid = getIdFromPath(req);
  95             if (feedid < 0) {
  96                 message = MISSING_FEED;
  97                 elr.setMessage(message);
  98                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
  99                 eventlogger.error(elr.toString());
 100                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 101                 return;
 102             }
 103             Feed feed = Feed.getFeedById(feedid);
 104             if (feed == null || feed.isDeleted()) {
 105                 message = MISSING_FEED;
 106                 elr.setMessage(message);
 107                 elr.setResult(HttpServletResponse.SC_NOT_FOUND);
 108                 eventlogger.error(elr.toString());
 109                 sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
 110                 return;
 111             }
 112             /*
 113              * START - AAF changes
 114              * TDP EPIC US# 307413
 115              * CADI code - check on permissions based on Legacy/AAF users to allow to delete/remove feed
 116              */
 117             String aafInstance = feed.getAafInstance();
 118             if (aafInstance == null || "".equals(aafInstance) || "legacy".equalsIgnoreCase(aafInstance)) {
 119                 AuthorizationResponse aresp = authz.decide(req);
 120                 if (! aresp.isAuthorized()) {
 121                     message = POLICY_ENGINE;
 122                     elr.setMessage(message);
 123                     elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 124                     eventlogger.error(elr.toString());
 125                     sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 126                     return;
 127                 }
 128             } else {
 129                 String permission = getFeedPermission(aafInstance, BaseServlet.DELETE_PERMISSION);
 130                 eventlogger.info("FeedServlet.doDelete().. Permission String - " + permission);
 131                 if (!req.isUserInRole(permission)) {
 132                     message = "AAF disallows access to permission - " + permission;
 133                     elr.setMessage(message);
 134                     elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 135                     eventlogger.error(elr.toString());
 136                     sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 137                     return;
 138                 }
 139             }
 140             /*
 141              * END - AAF changes
 142              */
 143             // Delete FEED table entry (set DELETED flag)
 144             feed.setDeleted(true);
 145             if (doUpdate(feed)) {
 146                 activeFeeds--;
 147                 // send response
 148                 elr.setResult(HttpServletResponse.SC_NO_CONTENT);
 149                 eventlogger.info(elr.toString());
 150                 resp.setStatus(HttpServletResponse.SC_NO_CONTENT);
 151                 provisioningDataChanged();
 152             } else {
 153                 // Something went wrong with the UPDATE
 154                 elr.setResult(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
 155                 eventlogger.error(elr.toString());
 156                 sendResponseError(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG, eventlogger);
 157             }
 158         } finally {
 159             eelfLogger.info(EelfMsgs.EXIT);
 160         }
 161     }
 162
 163     /**
 164      * Get information on the feed at the address /feed/&lt;feednumber&gt;.
 165      * See the <i>Retrieving Information about a Feed</i> section in the <b>Provisioning API</b>
 166      * document for details on how this method should be invoked.
 167      */
 168     @Override
 169     public void doGet(HttpServletRequest req, HttpServletResponse resp) {
 170         setIpFqdnRequestIDandInvocationIDForEelf("doGet", req);
 171         eelfLogger.info(EelfMsgs.ENTRY);
 172         try {
 173             eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID,
 174                     req.getHeader(BEHALF_HEADER),getIdFromPath(req) + "");
 175             EventLogRecord elr = new EventLogRecord(req);
 176             String message = isAuthorizedForProvisioning(req);
 177             if (message != null) {
 178                 elr.setMessage(message);
 179                 elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 180                 eventlogger.error(elr.toString());
 181                 sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 182                 return;
 183             }
 184             if (isProxyServer()) {
 185                 super.doGet(req, resp);
 186                 return;
 187             }
 188             String bhdr = req.getHeader(BEHALF_HEADER);
 189             if (bhdr == null) {
 190                 message = MISSING_ON_BEHALF;
 191                 elr.setMessage(message);
 192                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 193                 eventlogger.error(elr.toString());
 194                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 195                 return;
 196             }
 197             int feedid = getIdFromPath(req);
 198             if (feedid < 0) {
 199                 message = MISSING_FEED;
 200                 elr.setMessage(message);
 201                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 202                 eventlogger.error(elr.toString());
 203                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 204                 return;
 205             }
 206             Feed feed = Feed.getFeedById(feedid);
 207             if (feed == null || feed.isDeleted()) {
 208                 message = MISSING_FEED;
 209                 elr.setMessage(message);
 210                 elr.setResult(HttpServletResponse.SC_NOT_FOUND);
 211                 eventlogger.error(elr.toString());
 212                 sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
 213                 return;
 214             }
 215             // Check with the Authorizer
 216             AuthorizationResponse aresp = authz.decide(req);
 217             if (! aresp.isAuthorized()) {
 218                 message = POLICY_ENGINE;
 219                 elr.setMessage(message);
 220                 elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 221                 eventlogger.error(elr.toString());
 222                 sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 223                 return;
 224             }
 225
 226             // send response
 227             elr.setResult(HttpServletResponse.SC_OK);
 228             eventlogger.info(elr.toString());
 229             resp.setStatus(HttpServletResponse.SC_OK);
 230             resp.setContentType(FEEDFULL_CONTENT_TYPE);
 231             try {
 232                 resp.getOutputStream().print(feed.asJSONObject(true).toString());
 233             } catch (IOException ioe) {
 234                 eventlogger.error("PROV0101 FeedServlet.doGet: " + ioe.getMessage(), ioe);
 235             }
 236         } finally {
 237             eelfLogger.info(EelfMsgs.EXIT);
 238         }
 239     }
 240
 241     /**
 242      * PUT on the &lt;feedURL&gt; for a feed.
 243      * See the <i>Modifying a Feed</i> section in the <b>Provisioning API</b>
 244      * document for details on how this method should be invoked.
 245      */
 246     @Override
 247     public void doPut(HttpServletRequest req, HttpServletResponse resp) {
 248         setIpFqdnRequestIDandInvocationIDForEelf("doPut", req);
 249         eelfLogger.info(EelfMsgs.ENTRY);
 250         try {
 251             eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID,
 252                     req.getHeader(BEHALF_HEADER),getIdFromPath(req) + "");
 253             EventLogRecord elr = new EventLogRecord(req);
 254             String message = isAuthorizedForProvisioning(req);
 255             if (message != null) {
 256                 elr.setMessage(message);
 257                 elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 258                 eventlogger.error(elr.toString());
 259                 sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 260                 return;
 261             }
 262             if (isProxyServer()) {
 263                 super.doPut(req, resp);
 264                 return;
 265             }
 266             String bhdr = req.getHeader(BEHALF_HEADER);
 267             if (bhdr == null) {
 268                 message = MISSING_ON_BEHALF;
 269                 elr.setMessage(message);
 270                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 271                 eventlogger.error(elr.toString());
 272                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 273                 return;
 274             }
 275             int feedid = getIdFromPath(req);
 276             if (feedid < 0) {
 277                 message = MISSING_FEED;
 278                 elr.setMessage(message);
 279                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 280                 eventlogger.error(elr.toString());
 281                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 282                 return;
 283             }
 284             Feed oldFeed = Feed.getFeedById(feedid);
 285             if (oldFeed == null || oldFeed.isDeleted()) {
 286                 message = MISSING_FEED;
 287                 elr.setMessage(message);
 288                 elr.setResult(HttpServletResponse.SC_NOT_FOUND);
 289                 eventlogger.error(elr.toString());
 290                 sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
 291                 return;
 292             }
 293             // check content type is FEED_CONTENT_TYPE, version 1.0
 294             ContentHeader ch = getContentHeader(req);
 295             String ver = ch.getAttribute("version");
 296             if (!ch.getType().equals(FEED_BASECONTENT_TYPE) || !("1.0".equals(ver) || "2.0".equals(ver))) {
 297                 message = "Incorrect content-type";
 298                 elr.setMessage(message);
 299                 elr.setResult(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE);
 300                 eventlogger.error(elr.toString());
 301                 sendResponseError(resp, HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE, message, eventlogger);
 302                 return;
 303             }
 304             JSONObject jo = getJSONfromInput(req);
 305             if (jo == null) {
 306                 message = BAD_JSON;
 307                 elr.setMessage(message);
 308                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 309                 eventlogger.error(elr.toString());
 310                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 311                 return;
 312             }
 313             if (intlogger.isDebugEnabled()) {
 314                 intlogger.debug(jo.toString());
 315             }
 316             Feed feed;
 317             try {
 318                 feed = new Feed(jo);
 319             } catch (InvalidObjectException e) {
 320                 message = e.getMessage();
 321                 elr.setMessage(message);
 322                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 323                 eventlogger.error(elr.toString(), e);
 324                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 325                 return;
 326             }
 327             feed.setFeedid(feedid);
 328             feed.setPublisher(bhdr);    // set from X-DMAAP-DR-ON-BEHALF-OF header
 329
 330             //Adding for group feature:Rally US708115
 331             String subjectgroup = (req.getHeader("X-DMAAP-DR-ON-BEHALF-OF-GROUP"));
 332             if (!oldFeed.getPublisher().equals(feed.getPublisher()) && subjectgroup == null) {
 333                 message = "This feed must be modified by the same publisher that created it.";
 334                 elr.setMessage(message);
 335                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 336                 eventlogger.error(elr.toString());
 337                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 338                 return;
 339             }
 340             if (!oldFeed.getName().equals(feed.getName())) {
 341                 message = "The name of the feed may not be updated.";
 342                 elr.setMessage(message);
 343                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 344                 eventlogger.error(elr.toString());
 345                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 346                 return;
 347             }
 348             //  US DSCDR-19 for DCAE if version is not null, version can't be changed
 349             if ((oldFeed.getVersion() != null) && (feed.getVersion() != null)
 350                         && !oldFeed.getVersion().equals(feed.getVersion())) {
 351                 message = "The version of the feed may not be updated.";
 352                 elr.setMessage(message);
 353                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 354                 eventlogger.error(elr.toString());
 355                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 356                 return;
 357             }
 358
 359             /*
 360              * START - AAF changes
 361              * TDP EPIC US# 307413
 362              * CADI code - check on permissions based on Legacy/AAF users to allow feed edit/update/modify
 363              */
 364             String aafInstance = feed.getAafInstance();
 365             if (aafInstance == null || "".equals(aafInstance) || "legacy".equalsIgnoreCase(aafInstance)) {
 366                 // Check with the Authorizer
 367                 AuthorizationResponse aresp = authz.decide(req);
 368                 if (!aresp.isAuthorized()) {
 369                     message = POLICY_ENGINE;
 370                     elr.setMessage(message);
 371                     elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 372                     eventlogger.error(elr.toString());
 373                     sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 374                     return;
 375                 }
 376             } else {
 377                 String permission = getFeedPermission(aafInstance, BaseServlet.EDIT_PERMISSION);
 378                 eventlogger.info("FeedServlet.doPut().. Permission String - " + permission);
 379                 if (!req.isUserInRole(permission)) {
 380                     message = "AAF disallows access to permission - " + permission;
 381                     elr.setMessage(message);
 382                     elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 383                     eventlogger.error(elr.toString());
 384                     sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 385                     return;
 386                 }
 387             }
 388             /*
 389              * END - AAF changes
 390              */
 391
 392             // Update FEEDS table entries
 393             if (doUpdate(feed)) {
 394                 // send response
 395                 elr.setResult(HttpServletResponse.SC_OK);
 396                 eventlogger.info(elr.toString());
 397                 resp.setStatus(HttpServletResponse.SC_OK);
 398                 resp.setContentType(FEEDFULL_CONTENT_TYPE);
 399                 try {
 400                     resp.getOutputStream().print(feed.asLimitedJSONObject().toString());
 401                 } catch (IOException ioe) {
 402                     eventlogger.error("PROV0102 FeedServlet.doPut: " + ioe.getMessage(), ioe);
 403                 }
 404
 405
 406                 /**Change Owner ship of Feed //Adding for group feature:Rally US708115*/
 407                 if (jo.has("changeowner") && subjectgroup != null) {
 408                     try {
 409                         Boolean changeowner = (Boolean) jo.get("changeowner");
 410                         if (changeowner != null && changeowner.equals(true)) {
 411                             feed.setPublisher(req.getHeader(BEHALF_HEADER));
 412                             feed.changeOwnerShip();
 413                         }
 414                     } catch (JSONException je) {
 415                         eventlogger.error("PROV0103 FeedServlet.doPut: " + je.getMessage(), je);
 416                     }
 417                 }
 418                 /***End of change ownership*/
 419
 420                 provisioningDataChanged();
 421             } else {
 422                 // Something went wrong with the UPDATE
 423                 elr.setResult(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
 424                 eventlogger.error(elr.toString());
 425                 sendResponseError(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG, eventlogger);
 426             }
 427         } finally {
 428             eelfLogger.info(EelfMsgs.EXIT);
 429         }
 430     }
 431
 432     /**
 433      * POST on the &lt;feedURL&gt; -- not supported.
 434      */
 435     @Override
 436     public void doPost(HttpServletRequest req, HttpServletResponse resp) {
 437         setIpFqdnRequestIDandInvocationIDForEelf("doPost", req);
 438         eelfLogger.info(EelfMsgs.ENTRY);
 439         try {
 440             eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF, req.getHeader(BEHALF_HEADER));
 441             String message = "POST not allowed for the feedURL.";
 442             EventLogRecord elr = new EventLogRecord(req);
 443             elr.setMessage(message);
 444             elr.setResult(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
 445             eventlogger.error(elr.toString());
 446             sendResponseError(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED, message, eventlogger);
 447         } finally {
 448             eelfLogger.info(EelfMsgs.EXIT);
 449         }
 450     }
 451 }