datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/FeedServlet.java

   1 /*******************************************************************************
   2  * ============LICENSE_START==================================================
   3  * * org.onap.dmaap
   4  * * ===========================================================================
   5  * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
   6  * * ===========================================================================
   7  * * Licensed under the Apache License, Version 2.0 (the "License");
   8  * * you may not use this file except in compliance with the License.
   9  * * You may obtain a copy of the License at
  10  * *
  11  *  *      http://www.apache.org/licenses/LICENSE-2.0
  12  * *
  13  *  * Unless required by applicable law or agreed to in writing, software
  14  * * distributed under the License is distributed on an "AS IS" BASIS,
  15  * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * * See the License for the specific language governing permissions and
  17  * * limitations under the License.
  18  * * ============LICENSE_END====================================================
  19  * *
  20  * * ECOMP is a trademark and service mark of AT&T Intellectual Property.
  21  * *
  22  ******************************************************************************/
  23
  24
  25 package org.onap.dmaap.datarouter.provisioning;
  26
  27 import static org.onap.dmaap.datarouter.provisioning.utils.HttpServletUtils.sendResponseError;
  28
  29 import com.att.eelf.configuration.EELFLogger;
  30 import com.att.eelf.configuration.EELFManager;
  31 import java.io.IOException;
  32 import java.io.InvalidObjectException;
  33 import javax.servlet.http.HttpServletRequest;
  34 import javax.servlet.http.HttpServletResponse;
  35 import org.json.JSONException;
  36 import org.json.JSONObject;
  37 import org.onap.dmaap.datarouter.authz.AuthorizationResponse;
  38 import org.onap.dmaap.datarouter.provisioning.beans.EventLogRecord;
  39 import org.onap.dmaap.datarouter.provisioning.beans.Feed;
  40 import org.onap.dmaap.datarouter.provisioning.eelf.EelfMsgs;
  41
  42
  43
  44 /**
  45  * This servlet handles provisioning for the &lt;feedURL&gt; which is generated by the provisioning
  46  * server to handle a particular feed. It supports DELETE to mark the feed as deleted,
  47  * and GET to retrieve information about the feed, and PUT to modify the feed.
  48  *
  49  * @author Robert Eby
  50  * @version $Id$
  51  */
  52 @SuppressWarnings("serial")
  53
  54 public class FeedServlet extends ProxyServlet {
  55
  56     //Adding EELF Logger Rally:US664892
  57     private static EELFLogger eelfLogger = EELFManager.getInstance().getLogger(FeedServlet.class);
  58
  59     /**
  60      * Delete the Feed at the address /feed/&lt;feednumber&gt;.
  61      * See the <i>Deleting a Feed</i> section in the <b>Provisioning API</b>
  62      * document for details on how this method should be invoked.
  63      */
  64     @Override
  65     public void doDelete(HttpServletRequest req, HttpServletResponse resp) {
  66         setIpFqdnRequestIDandInvocationIDForEelf("doDelete", req);
  67         eelfLogger.info(EelfMsgs.ENTRY);
  68         try {
  69             eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID,
  70                     req.getHeader(BEHALF_HEADER),getIdFromPath(req) + "");
  71             EventLogRecord elr = new EventLogRecord(req);
  72             String message = isAuthorizedForProvisioning(req);
  73             if (message != null) {
  74                 elr.setMessage(message);
  75                 elr.setResult(HttpServletResponse.SC_FORBIDDEN);
  76                 eventlogger.error(elr.toString());
  77                 sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
  78                 return;
  79             }
  80             if (isProxyServer()) {
  81                 super.doDelete(req, resp);
  82                 return;
  83             }
  84             String bhdr = req.getHeader(BEHALF_HEADER);
  85             if (bhdr == null) {
  86                 message = MISSING_ON_BEHALF;
  87                 elr.setMessage(message);
  88                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
  89                 eventlogger.error(elr.toString());
  90                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
  91                 return;
  92             }
  93             int feedid = getIdFromPath(req);
  94             if (feedid < 0) {
  95                 message = MISSING_FEED;
  96                 elr.setMessage(message);
  97                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
  98                 eventlogger.error(elr.toString());
  99                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 100                 return;
 101             }
 102             Feed feed = Feed.getFeedById(feedid);
 103             if (feed == null || feed.isDeleted()) {
 104                 message = MISSING_FEED;
 105                 elr.setMessage(message);
 106                 elr.setResult(HttpServletResponse.SC_NOT_FOUND);
 107                 eventlogger.error(elr.toString());
 108                 sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
 109                 return;
 110             }
 111             /*
 112              * START - AAF changes
 113              * TDP EPIC US# 307413
 114              * CADI code - check on permissions based on Legacy/AAF users to allow to delete/remove feed
 115              */
 116             String aafInstance = feed.getAafInstance();
 117             if (aafInstance == null || "".equals(aafInstance) || "legacy".equalsIgnoreCase(aafInstance)) {
 118                 AuthorizationResponse aresp = authz.decide(req);
 119                 if (! aresp.isAuthorized()) {
 120                     message = POLICY_ENGINE;
 121                     elr.setMessage(message);
 122                     elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 123                     eventlogger.error(elr.toString());
 124                     sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 125                     return;
 126                 }
 127             } else {
 128                 String permission = getFeedPermission(aafInstance, BaseServlet.DELETE_PERMISSION);
 129                 eventlogger.info("FeedServlet.doDelete().. Permission String - " + permission);
 130                 if (!req.isUserInRole(permission)) {
 131                     message = "AAF disallows access to permission - " + permission;
 132                     elr.setMessage(message);
 133                     elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 134                     eventlogger.error(elr.toString());
 135                     sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 136                     return;
 137                 }
 138             }
 139             /*
 140              * END - AAF changes
 141              */
 142             // Delete FEED table entry (set DELETED flag)
 143             feed.setDeleted(true);
 144             if (doUpdate(feed)) {
 145                 activeFeeds--;
 146                 // send response
 147                 elr.setResult(HttpServletResponse.SC_NO_CONTENT);
 148                 eventlogger.info(elr.toString());
 149                 resp.setStatus(HttpServletResponse.SC_NO_CONTENT);
 150                 provisioningDataChanged();
 151             } else {
 152                 // Something went wrong with the UPDATE
 153                 elr.setResult(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
 154                 eventlogger.error(elr.toString());
 155                 sendResponseError(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG, eventlogger);
 156             }
 157         } finally {
 158             eelfLogger.info(EelfMsgs.EXIT);
 159         }
 160     }
 161
 162     /**
 163      * Get information on the feed at the address /feed/&lt;feednumber&gt;.
 164      * See the <i>Retrieving Information about a Feed</i> section in the <b>Provisioning API</b>
 165      * document for details on how this method should be invoked.
 166      */
 167     @Override
 168     public void doGet(HttpServletRequest req, HttpServletResponse resp) {
 169         setIpFqdnRequestIDandInvocationIDForEelf("doGet", req);
 170         eelfLogger.info(EelfMsgs.ENTRY);
 171         try {
 172             eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID,
 173                     req.getHeader(BEHALF_HEADER),getIdFromPath(req) + "");
 174             EventLogRecord elr = new EventLogRecord(req);
 175             String message = isAuthorizedForProvisioning(req);
 176             if (message != null) {
 177                 elr.setMessage(message);
 178                 elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 179                 eventlogger.error(elr.toString());
 180                 sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 181                 return;
 182             }
 183             if (isProxyServer()) {
 184                 super.doGet(req, resp);
 185                 return;
 186             }
 187             String bhdr = req.getHeader(BEHALF_HEADER);
 188             if (bhdr == null) {
 189                 message = MISSING_ON_BEHALF;
 190                 elr.setMessage(message);
 191                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 192                 eventlogger.error(elr.toString());
 193                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 194                 return;
 195             }
 196             int feedid = getIdFromPath(req);
 197             if (feedid < 0) {
 198                 message = MISSING_FEED;
 199                 elr.setMessage(message);
 200                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 201                 eventlogger.error(elr.toString());
 202                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 203                 return;
 204             }
 205             Feed feed = Feed.getFeedById(feedid);
 206             if (feed == null || feed.isDeleted()) {
 207                 message = MISSING_FEED;
 208                 elr.setMessage(message);
 209                 elr.setResult(HttpServletResponse.SC_NOT_FOUND);
 210                 eventlogger.error(elr.toString());
 211                 sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
 212                 return;
 213             }
 214             // Check with the Authorizer
 215             AuthorizationResponse aresp = authz.decide(req);
 216             if (! aresp.isAuthorized()) {
 217                 message = POLICY_ENGINE;
 218                 elr.setMessage(message);
 219                 elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 220                 eventlogger.error(elr.toString());
 221                 sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 222                 return;
 223             }
 224
 225             // send response
 226             elr.setResult(HttpServletResponse.SC_OK);
 227             eventlogger.info(elr.toString());
 228             resp.setStatus(HttpServletResponse.SC_OK);
 229             resp.setContentType(FEEDFULL_CONTENT_TYPE);
 230             try {
 231                 resp.getOutputStream().print(feed.asJSONObject(true).toString());
 232             } catch (IOException ioe) {
 233                 eventlogger.error("PROV0101 FeedServlet.doGet: " + ioe.getMessage(), ioe);
 234             }
 235         } finally {
 236             eelfLogger.info(EelfMsgs.EXIT);
 237         }
 238     }
 239
 240     /**
 241      * PUT on the &lt;feedURL&gt; for a feed.
 242      * See the <i>Modifying a Feed</i> section in the <b>Provisioning API</b>
 243      * document for details on how this method should be invoked.
 244      */
 245     @Override
 246     public void doPut(HttpServletRequest req, HttpServletResponse resp) {
 247         setIpFqdnRequestIDandInvocationIDForEelf("doPut", req);
 248         eelfLogger.info(EelfMsgs.ENTRY);
 249         try {
 250             eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID,
 251                     req.getHeader(BEHALF_HEADER),getIdFromPath(req) + "");
 252             EventLogRecord elr = new EventLogRecord(req);
 253             String message = isAuthorizedForProvisioning(req);
 254             if (message != null) {
 255                 elr.setMessage(message);
 256                 elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 257                 eventlogger.error(elr.toString());
 258                 sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 259                 return;
 260             }
 261             if (isProxyServer()) {
 262                 super.doPut(req, resp);
 263                 return;
 264             }
 265             String bhdr = req.getHeader(BEHALF_HEADER);
 266             if (bhdr == null) {
 267                 message = MISSING_ON_BEHALF;
 268                 elr.setMessage(message);
 269                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 270                 eventlogger.error(elr.toString());
 271                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 272                 return;
 273             }
 274             int feedid = getIdFromPath(req);
 275             if (feedid < 0) {
 276                 message = MISSING_FEED;
 277                 elr.setMessage(message);
 278                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 279                 eventlogger.error(elr.toString());
 280                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 281                 return;
 282             }
 283             Feed oldFeed = Feed.getFeedById(feedid);
 284             if (oldFeed == null || oldFeed.isDeleted()) {
 285                 message = MISSING_FEED;
 286                 elr.setMessage(message);
 287                 elr.setResult(HttpServletResponse.SC_NOT_FOUND);
 288                 eventlogger.error(elr.toString());
 289                 sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
 290                 return;
 291             }
 292             // check content type is FEED_CONTENT_TYPE, version 1.0
 293             ContentHeader ch = getContentHeader(req);
 294             String ver = ch.getAttribute("version");
 295             if (!ch.getType().equals(FEED_BASECONTENT_TYPE) || !("1.0".equals(ver) || "2.0".equals(ver))) {
 296                 message = "Incorrect content-type";
 297                 elr.setMessage(message);
 298                 elr.setResult(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE);
 299                 eventlogger.error(elr.toString());
 300                 sendResponseError(resp, HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE, message, eventlogger);
 301                 return;
 302             }
 303             JSONObject jo = getJSONfromInput(req);
 304             if (jo == null) {
 305                 message = BAD_JSON;
 306                 elr.setMessage(message);
 307                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 308                 eventlogger.error(elr.toString());
 309                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 310                 return;
 311             }
 312             Feed feed;
 313             try {
 314                 feed = new Feed(jo);
 315             } catch (InvalidObjectException e) {
 316                 message = e.getMessage();
 317                 elr.setMessage(message);
 318                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 319                 eventlogger.error(elr.toString(), e);
 320                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 321                 return;
 322             }
 323             feed.setFeedid(feedid);
 324             feed.setPublisher(bhdr);    // set from X-DMAAP-DR-ON-BEHALF-OF header
 325
 326             //Adding for group feature:Rally US708115
 327             String subjectgroup = (req.getHeader("X-DMAAP-DR-ON-BEHALF-OF-GROUP"));
 328             if (!oldFeed.getPublisher().equals(feed.getPublisher()) && subjectgroup == null) {
 329                 message = "This feed must be modified by the same publisher that created it.";
 330                 elr.setMessage(message);
 331                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 332                 eventlogger.error(elr.toString());
 333                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 334                 return;
 335             }
 336             if (!oldFeed.getName().equals(feed.getName())) {
 337                 message = "The name of the feed may not be updated.";
 338                 elr.setMessage(message);
 339                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 340                 eventlogger.error(elr.toString());
 341                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 342                 return;
 343             }
 344             //  US DSCDR-19 for DCAE if version is not null, version can't be changed
 345             if ((oldFeed.getVersion() != null) && (feed.getVersion() != null)
 346                         && !oldFeed.getVersion().equals(feed.getVersion())) {
 347                 message = "The version of the feed may not be updated.";
 348                 elr.setMessage(message);
 349                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 350                 eventlogger.error(elr.toString());
 351                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 352                 return;
 353             }
 354
 355             /*
 356              * START - AAF changes
 357              * TDP EPIC US# 307413
 358              * CADI code - check on permissions based on Legacy/AAF users to allow feed edit/update/modify
 359              */
 360             String aafInstance = feed.getAafInstance();
 361             if (aafInstance == null || "".equals(aafInstance) || "legacy".equalsIgnoreCase(aafInstance)) {
 362                 // Check with the Authorizer
 363                 AuthorizationResponse aresp = authz.decide(req);
 364                 if (!aresp.isAuthorized()) {
 365                     message = POLICY_ENGINE;
 366                     elr.setMessage(message);
 367                     elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 368                     eventlogger.error(elr.toString());
 369                     sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 370                     return;
 371                 }
 372             } else {
 373                 String permission = getFeedPermission(aafInstance, BaseServlet.EDIT_PERMISSION);
 374                 eventlogger.info("FeedServlet.doPut().. Permission String - " + permission);
 375                 if (!req.isUserInRole(permission)) {
 376                     message = "AAF disallows access to permission - " + permission;
 377                     elr.setMessage(message);
 378                     elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 379                     eventlogger.error(elr.toString());
 380                     sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 381                     return;
 382                 }
 383             }
 384             /*
 385              * END - AAF changes
 386              */
 387
 388             // Update FEEDS table entries
 389             if (doUpdate(feed)) {
 390                 // send response
 391                 elr.setResult(HttpServletResponse.SC_OK);
 392                 eventlogger.info(elr.toString());
 393                 resp.setStatus(HttpServletResponse.SC_OK);
 394                 resp.setContentType(FEEDFULL_CONTENT_TYPE);
 395                 try {
 396                     resp.getOutputStream().print(feed.asLimitedJSONObject().toString());
 397                 } catch (IOException ioe) {
 398                     eventlogger.error("PROV0102 FeedServlet.doPut: " + ioe.getMessage(), ioe);
 399                 }
 400
 401
 402                 /**Change Owner ship of Feed //Adding for group feature. :Rally US708115*/
 403                 if (jo.has("changeowner") && subjectgroup != null) {
 404                     try {
 405                         Boolean changeowner = (Boolean) jo.get("changeowner");
 406                         if (changeowner != null && changeowner.equals(true)) {
 407                             feed.setPublisher(req.getHeader(BEHALF_HEADER));
 408                             feed.changeOwnerShip();
 409                         }
 410                     } catch (JSONException je) {
 411                         eventlogger.error("PROV0103 FeedServlet.doPut: " + je.getMessage(), je);
 412                     }
 413                 }
 414                 /***End of change ownership.*/
 415
 416                 provisioningDataChanged();
 417             } else {
 418                 // Something went wrong with the UPDATE
 419                 elr.setResult(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
 420                 eventlogger.error(elr.toString());
 421                 sendResponseError(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG, eventlogger);
 422             }
 423         } finally {
 424             eelfLogger.info(EelfMsgs.EXIT);
 425         }
 426     }
 427
 428     /**
 429      * POST on the &lt;feedURL&gt; -- not supported.
 430      */
 431     @Override
 432     public void doPost(HttpServletRequest req, HttpServletResponse resp) {
 433         setIpFqdnRequestIDandInvocationIDForEelf("doPost", req);
 434         eelfLogger.info(EelfMsgs.ENTRY);
 435         try {
 436             eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF, req.getHeader(BEHALF_HEADER));
 437             String message = "POST not allowed for the feedURL.";
 438             EventLogRecord elr = new EventLogRecord(req);
 439             elr.setMessage(message);
 440             elr.setResult(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
 441             eventlogger.error(elr.toString());
 442             sendResponseError(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED, message, eventlogger);
 443         } finally {
 444             eelfLogger.info(EelfMsgs.EXIT);
 445         }
 446     }
 447 }