datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/FeedServlet.java

   1 /*******************************************************************************
   2  * ============LICENSE_START==================================================
   3  * * org.onap.dmaap
   4  * * ===========================================================================
   5  * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
   6  * * ===========================================================================
   7  * * Licensed under the Apache License, Version 2.0 (the "License");
   8  * * you may not use this file except in compliance with the License.
   9  * * You may obtain a copy of the License at
  10  * *
  11  *  *      http://www.apache.org/licenses/LICENSE-2.0
  12  * *
  13  *  * Unless required by applicable law or agreed to in writing, software
  14  * * distributed under the License is distributed on an "AS IS" BASIS,
  15  * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * * See the License for the specific language governing permissions and
  17  * * limitations under the License.
  18  * * ============LICENSE_END====================================================
  19  * *
  20  * * ECOMP is a trademark and service mark of AT&T Intellectual Property.
  21  * *
  22  ******************************************************************************/
  23
  24
  25 package org.onap.dmaap.datarouter.provisioning;
  26
  27 import java.io.IOException;
  28 import java.io.InvalidObjectException;
  29
  30 import javax.servlet.http.HttpServletRequest;
  31 import javax.servlet.http.HttpServletResponse;
  32
  33 import org.json.JSONException;
  34 import org.json.JSONObject;
  35 import org.onap.dmaap.datarouter.authz.AuthorizationResponse;
  36 import org.onap.dmaap.datarouter.provisioning.beans.EventLogRecord;
  37 import org.onap.dmaap.datarouter.provisioning.beans.Feed;
  38 import org.onap.dmaap.datarouter.provisioning.eelf.EelfMsgs;
  39
  40 import com.att.eelf.configuration.EELFLogger;
  41 import com.att.eelf.configuration.EELFManager;
  42
  43 import static org.onap.dmaap.datarouter.provisioning.utils.HttpServletUtils.sendResponseError;
  44
  45 /**
  46  * This servlet handles provisioning for the &lt;feedURL&gt; which is generated by the provisioning
  47  * server to handle a particular feed. It supports DELETE to mark the feed as deleted,
  48  * and GET to retrieve information about the feed, and PUT to modify the feed.
  49  *
  50  * @author Robert Eby
  51  * @version $Id$
  52  */
  53 @SuppressWarnings("serial")
  54 public class FeedServlet extends ProxyServlet {
  55
  56     //Adding EELF Logger Rally:US664892
  57     private static EELFLogger eelfLogger = EELFManager.getInstance().getLogger(FeedServlet.class);
  58
  59     /**
  60      * Delete the Feed at the address /feed/&lt;feednumber&gt;.
  61      * See the <i>Deleting a Feed</i> section in the <b>Provisioning API</b>
  62      * document for details on how this method should be invoked.
  63      */
  64     @Override
  65     public void doDelete(HttpServletRequest req, HttpServletResponse resp) {
  66         setIpFqdnRequestIDandInvocationIDForEelf("doDelete", req);
  67         eelfLogger.info(EelfMsgs.ENTRY);
  68         try {
  69             eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader(BEHALF_HEADER),getIdFromPath(req)+"");
  70             EventLogRecord elr = new EventLogRecord(req);
  71             String message = isAuthorizedForProvisioning(req);
  72             if (message != null) {
  73                 elr.setMessage(message);
  74                 elr.setResult(HttpServletResponse.SC_FORBIDDEN);
  75                 eventlogger.error(elr.toString());
  76                 sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
  77                 return;
  78             }
  79             if (isProxyServer()) {
  80                 super.doDelete(req, resp);
  81                 return;
  82             }
  83             String bhdr = req.getHeader(BEHALF_HEADER);
  84             if (bhdr == null) {
  85                 message = MISSING_ON_BEHALF;
  86                 elr.setMessage(message);
  87                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
  88                 eventlogger.error(elr.toString());
  89                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
  90                 return;
  91             }
  92             int feedid = getIdFromPath(req);
  93             if (feedid < 0) {
  94                 message = MISSING_FEED;
  95                 elr.setMessage(message);
  96                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
  97                 eventlogger.error(elr.toString());
  98                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
  99                 return;
 100             }
 101             Feed feed = Feed.getFeedById(feedid);
 102             if (feed == null || feed.isDeleted()) {
 103                 message = MISSING_FEED;
 104                 elr.setMessage(message);
 105                 elr.setResult(HttpServletResponse.SC_NOT_FOUND);
 106                 eventlogger.error(elr.toString());
 107                 sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
 108                 return;
 109             }
 110             /*
 111              * START - AAF changes
 112              * TDP EPIC US# 307413
 113              * CADI code - check on permissions based on Legacy/AAF users to allow to delete/remove feed
 114              */
 115             String aafInstance = feed.getAafInstance();
 116             if (aafInstance == null || "".equals(aafInstance) || "legacy".equalsIgnoreCase(aafInstance)) {
 117                 AuthorizationResponse aresp = authz.decide(req);
 118                 if (! aresp.isAuthorized()) {
 119                     message = POLICY_ENGINE;
 120                     elr.setMessage(message);
 121                     elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 122                     eventlogger.error(elr.toString());
 123                     sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 124                     return;
 125                 }
 126             } else {
 127                 String permission = getFeedPermission(aafInstance, BaseServlet.DELETE_PERMISSION);
 128                 eventlogger.info("FeedServlet.doDelete().. Permission String - " + permission);
 129                 if (!req.isUserInRole(permission)) {
 130                     message = "AAF disallows access to permission - " + permission;
 131                     elr.setMessage(message);
 132                     elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 133                     eventlogger.error(elr.toString());
 134                     sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 135                     return;
 136                 }
 137             }
 138             /*
 139              * END - AAF changes
 140              */
 141             // Delete FEED table entry (set DELETED flag)
 142             feed.setDeleted(true);
 143             if (doUpdate(feed)) {
 144                 activeFeeds--;
 145                 // send response
 146                 elr.setResult(HttpServletResponse.SC_NO_CONTENT);
 147                 eventlogger.info(elr.toString());
 148                 resp.setStatus(HttpServletResponse.SC_NO_CONTENT);
 149                 provisioningDataChanged();
 150             } else {
 151                 // Something went wrong with the UPDATE
 152                 elr.setResult(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
 153                 eventlogger.error(elr.toString());
 154                 sendResponseError(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG, eventlogger);
 155             }
 156         } finally {
 157             eelfLogger.info(EelfMsgs.EXIT);
 158         }
 159     }
 160     /**
 161      * Get information on the feed at the address /feed/&lt;feednumber&gt;.
 162      * See the <i>Retrieving Information about a Feed</i> section in the <b>Provisioning API</b>
 163      * document for details on how this method should be invoked.
 164      */
 165     @Override
 166     public void doGet(HttpServletRequest req, HttpServletResponse resp) {
 167         setIpFqdnRequestIDandInvocationIDForEelf("doGet", req);
 168         eelfLogger.info(EelfMsgs.ENTRY);
 169         try {
 170             eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader(BEHALF_HEADER),getIdFromPath(req)+"");
 171             EventLogRecord elr = new EventLogRecord(req);
 172             String message = isAuthorizedForProvisioning(req);
 173             if (message != null) {
 174                 elr.setMessage(message);
 175                 elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 176                 eventlogger.error(elr.toString());
 177                 sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 178                 return;
 179             }
 180             if (isProxyServer()) {
 181                 super.doGet(req, resp);
 182                 return;
 183             }
 184             String bhdr = req.getHeader(BEHALF_HEADER);
 185             if (bhdr == null) {
 186                 message = MISSING_ON_BEHALF;
 187                 elr.setMessage(message);
 188                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 189                 eventlogger.error(elr.toString());
 190                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 191                 return;
 192             }
 193             int feedid = getIdFromPath(req);
 194             if (feedid < 0) {
 195                 message = MISSING_FEED;
 196                 elr.setMessage(message);
 197                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 198                 eventlogger.error(elr.toString());
 199                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 200                 return;
 201             }
 202             Feed feed = Feed.getFeedById(feedid);
 203             if (feed == null || feed.isDeleted()) {
 204                 message = MISSING_FEED;
 205                 elr.setMessage(message);
 206                 elr.setResult(HttpServletResponse.SC_NOT_FOUND);
 207                 eventlogger.error(elr.toString());
 208                 sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
 209                 return;
 210             }
 211             // Check with the Authorizer
 212             AuthorizationResponse aresp = authz.decide(req);
 213             if (! aresp.isAuthorized()) {
 214                 message = POLICY_ENGINE;
 215                 elr.setMessage(message);
 216                 elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 217                 eventlogger.error(elr.toString());
 218                 sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 219                 return;
 220             }
 221
 222             // send response
 223             elr.setResult(HttpServletResponse.SC_OK);
 224             eventlogger.info(elr.toString());
 225             resp.setStatus(HttpServletResponse.SC_OK);
 226             resp.setContentType(FEEDFULL_CONTENT_TYPE);
 227             try {
 228                 resp.getOutputStream().print(feed.asJSONObject(true).toString());
 229             } catch (IOException ioe) {
 230                 eventlogger.error("PROV0101 FeedServlet.doGet: " + ioe.getMessage(), ioe);
 231             }
 232         } finally {
 233             eelfLogger.info(EelfMsgs.EXIT);
 234         }
 235     }
 236     /**
 237      * PUT on the &lt;feedURL&gt; for a feed.
 238      * See the <i>Modifying a Feed</i> section in the <b>Provisioning API</b>
 239      * document for details on how this method should be invoked.
 240      */
 241     @Override
 242     public void doPut(HttpServletRequest req, HttpServletResponse resp) {
 243         setIpFqdnRequestIDandInvocationIDForEelf("doPut", req);
 244         eelfLogger.info(EelfMsgs.ENTRY);
 245         try {
 246             eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF_AND_FEEDID, req.getHeader(BEHALF_HEADER),getIdFromPath(req)+"");
 247             EventLogRecord elr = new EventLogRecord(req);
 248             String message = isAuthorizedForProvisioning(req);
 249             if (message != null) {
 250                 elr.setMessage(message);
 251                 elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 252                 eventlogger.error(elr.toString());
 253                 sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 254                 return;
 255             }
 256             if (isProxyServer()) {
 257                 super.doPut(req, resp);
 258                 return;
 259             }
 260             String bhdr = req.getHeader(BEHALF_HEADER);
 261             if (bhdr == null) {
 262                 message = MISSING_ON_BEHALF;
 263                 elr.setMessage(message);
 264                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 265                 eventlogger.error(elr.toString());
 266                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 267                 return;
 268             }
 269             int feedid = getIdFromPath(req);
 270             if (feedid < 0) {
 271                 message = MISSING_FEED;
 272                 elr.setMessage(message);
 273                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 274                 eventlogger.error(elr.toString());
 275                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 276                 return;
 277             }
 278             Feed oldFeed = Feed.getFeedById(feedid);
 279             if (oldFeed == null || oldFeed.isDeleted()) {
 280                 message = MISSING_FEED;
 281                 elr.setMessage(message);
 282                 elr.setResult(HttpServletResponse.SC_NOT_FOUND);
 283                 eventlogger.error(elr.toString());
 284                 sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
 285                 return;
 286             }
 287             // check content type is FEED_CONTENT_TYPE, version 1.0
 288             ContentHeader ch = getContentHeader(req);
 289             String ver = ch.getAttribute("version");
 290             if (!ch.getType().equals(FEED_BASECONTENT_TYPE) || !("1.0".equals(ver) || "2.0".equals(ver))) {
 291                 message = "Incorrect content-type";
 292                 elr.setMessage(message);
 293                 elr.setResult(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE);
 294                 eventlogger.error(elr.toString());
 295                 sendResponseError(resp, HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE, message, eventlogger);
 296                 return;
 297             }
 298             JSONObject jo = getJSONfromInput(req);
 299             if (jo == null) {
 300                 message = BAD_JSON;
 301                 elr.setMessage(message);
 302                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 303                 eventlogger.error(elr.toString());
 304                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 305                 return;
 306             }
 307             if (intlogger.isDebugEnabled())
 308                 intlogger.debug(jo.toString());
 309             Feed feed;
 310             try {
 311                 feed = new Feed(jo);
 312             } catch (InvalidObjectException e) {
 313                 message = e.getMessage();
 314                 elr.setMessage(message);
 315                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 316                 eventlogger.error(elr.toString(), e);
 317                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 318                 return;
 319             }
 320             feed.setFeedid(feedid);
 321             feed.setPublisher(bhdr);    // set from X-DMAAP-DR-ON-BEHALF-OF header
 322
 323             String subjectgroup = (req.getHeader("X-DMAAP-DR-ON-BEHALF-OF-GROUP"));  //Adding for group feature:Rally US708115
 324             if (!oldFeed.getPublisher().equals(feed.getPublisher()) && subjectgroup == null) {
 325                 message = "This feed must be modified by the same publisher that created it.";
 326                 elr.setMessage(message);
 327                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 328                 eventlogger.error(elr.toString());
 329                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 330                 return;
 331             }
 332             if (!oldFeed.getName().equals(feed.getName())) {
 333                 message = "The name of the feed may not be updated.";
 334                 elr.setMessage(message);
 335                 elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 336                 eventlogger.error(elr.toString());
 337                 sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 338                 return;
 339             }
 340             //  US DSCDR-19 for DCAE if version is not null, version can't be changed
 341             if ((oldFeed.getVersion() != null) && (feed.getVersion() != null)) {
 342                 if (!oldFeed.getVersion().equals(feed.getVersion())) {
 343                     message = "The version of the feed may not be updated.";
 344                     elr.setMessage(message);
 345                     elr.setResult(HttpServletResponse.SC_BAD_REQUEST);
 346                     eventlogger.error(elr.toString());
 347                     sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
 348                     return;
 349                 }
 350             }
 351
 352             /*
 353              * START - AAF changes
 354              * TDP EPIC US# 307413
 355              * CADI code - check on permissions based on Legacy/AAF users to allow feed edit/update/modify
 356              */
 357             String aafInstance = feed.getAafInstance();
 358             if (aafInstance == null || "".equals(aafInstance) || "legacy".equalsIgnoreCase(aafInstance)) {
 359                 // Check with the Authorizer
 360                 AuthorizationResponse aresp = authz.decide(req);
 361                 if (!aresp.isAuthorized()) {
 362                     message = POLICY_ENGINE;
 363                     elr.setMessage(message);
 364                     elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 365                     eventlogger.error(elr.toString());
 366                     sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 367                     return;
 368                 }
 369             } else {
 370                 String permission = getFeedPermission(aafInstance, BaseServlet.EDIT_PERMISSION);
 371                 eventlogger.info("FeedServlet.doPut().. Permission String - " + permission);
 372                 if (!req.isUserInRole(permission)) {
 373                     message = "AAF disallows access to permission - " + permission;
 374                     elr.setMessage(message);
 375                     elr.setResult(HttpServletResponse.SC_FORBIDDEN);
 376                     eventlogger.error(elr.toString());
 377                     sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
 378                     return;
 379                 }
 380             }
 381             /*
 382              * END - AAF changes
 383              */
 384
 385             // Update FEEDS table entries
 386             if (doUpdate(feed)) {
 387                 // send response
 388                 elr.setResult(HttpServletResponse.SC_OK);
 389                 eventlogger.info(elr.toString());
 390                 resp.setStatus(HttpServletResponse.SC_OK);
 391                 resp.setContentType(FEEDFULL_CONTENT_TYPE);
 392                 try {
 393                     resp.getOutputStream().print(feed.asLimitedJSONObject().toString());
 394                 } catch (IOException ioe) {
 395                     eventlogger.error("PROV0102 FeedServlet.doPut: " + ioe.getMessage(), ioe);
 396                 }
 397
 398
 399                 /**Change Owner ship of Feed //Adding for group feature:Rally US708115*/
 400                 if (jo.has("changeowner") && subjectgroup != null) {
 401                     try {
 402                         Boolean changeowner = (Boolean) jo.get("changeowner");
 403                         if (changeowner != null && changeowner.equals(true)) {
 404                             feed.setPublisher(req.getHeader(BEHALF_HEADER));
 405                             feed.changeOwnerShip();
 406                         }
 407                     } catch (JSONException je) {
 408                         eventlogger.error("PROV0103 FeedServlet.doPut: " + je.getMessage(), je);
 409                     }
 410                 }
 411                 /***End of change ownership*/
 412
 413                 provisioningDataChanged();
 414             } else {
 415                 // Something went wrong with the UPDATE
 416                 elr.setResult(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
 417                 eventlogger.error(elr.toString());
 418                 sendResponseError(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, DB_PROBLEM_MSG, eventlogger);
 419             }
 420         } finally {
 421             eelfLogger.info(EelfMsgs.EXIT);
 422         }
 423     }
 424     /**
 425      * POST on the &lt;feedURL&gt; -- not supported.
 426      */
 427     @Override
 428     public void doPost(HttpServletRequest req, HttpServletResponse resp) {
 429         setIpFqdnRequestIDandInvocationIDForEelf("doPost", req);
 430         eelfLogger.info(EelfMsgs.ENTRY);
 431         try {
 432             eelfLogger.info(EelfMsgs.MESSAGE_WITH_BEHALF, req.getHeader(BEHALF_HEADER));
 433             String message = "POST not allowed for the feedURL.";
 434             EventLogRecord elr = new EventLogRecord(req);
 435             elr.setMessage(message);
 436             elr.setResult(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
 437             eventlogger.error(elr.toString());
 438             sendResponseError(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED, message, eventlogger);
 439         } finally {
 440         eelfLogger.info(EelfMsgs.EXIT);
 441     }
 442     }
 443 }