com.formkiq.server.api.UsersController Maven / Gradle / Ivy

Go to download
/*
 * Copyright (C) 2016 FormKiQ Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package com.formkiq.server.api;

import java.util.List;

import javax.servlet.http.HttpServletRequest;
import javax.transaction.Transactional;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.mail.MailSender;
import org.springframework.mail.SimpleMailMessage;
import org.springframework.security.access.annotation.Secured;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

import com.formkiq.server.domain.type.FolderPermission;
import com.formkiq.server.domain.type.UserDTO;
import com.formkiq.server.domain.type.UserListDTO;
import com.formkiq.server.domain.type.UserRole;
import com.formkiq.server.domain.type.UserStatus;
import com.formkiq.server.service.AuthenticationFailureException;
import com.formkiq.server.service.PreconditionFailedException;
import com.formkiq.server.service.SpringSecurityService;
import com.formkiq.server.service.SystemPropertyService;
import com.formkiq.server.service.UserService;

/**
 * User Rest Service.
 *
 */
@RestController
public class UsersController extends AbstractRestController {

    /** OAuth Token URL. */
    public static final String OAUTH_TOKEN = "/oauth/token";

	/** Change Password. */
    public static final String API_USER_RESET_PASSWORD
        = "/api/users/resetpassword";

	/** Reset Lost Password. */
    public static final String API_USER_LOST_PASSWORD
        = "/api/users/lostpassword";

    /** User Add. */
    public static final String API_USER_SAVE = "/api/users/save";

    /** User Get. */
    public static final String API_USER_GET = "/api/users/get";

    /** User List. */
    public static final String API_USER_LIST = "/api/users/list";

    /** User Delete. */
    public static final String API_USER_DELETE = "/api/users/delete";

    /** Invite User to Client. */
    public static final String API_USER_INVITE = "/api/users/invite";

    /** System Properties URL. */
    public static final String API_USER_CAN_CREATE = "/api/users/cancreate";

	/** MailSender. */
    @Autowired
    private MailSender mailSender;

	/** UserService. */
	@Autowired
	private UserService userservice;

    /** SpringSecurityService. */
    @Autowired
    private SpringSecurityService securityService;

    /** SystemPropertyService. */
    @Autowired
    private SystemPropertyService systemProperties;

    /**
     * Whether Server supports creating users.
     * @return {@link ApiMessageResponse}
     */
    @Transactional
    @RequestMapping(API_USER_CAN_CREATE)
    public ApiMessageResponse canCreateUser() {

        boolean inviteOnly = this.systemProperties.isInviteOnly();

        if (this.securityService.isAdmin()) {
            inviteOnly = false;
        }

        return new ApiMessageResponse("" + !(inviteOnly));
    }

    /**
     * Change User Password.
     * @param request {@link HttpServletRequest}
     * @param email {@link String}
     * @param resettoken {@link String}
     * @param newPassword {@link String}
     * @param confirmPassword {@link String}
     * @return {@link ApiMessageResponse}
     */
	@Transactional
	@RequestMapping(API_USER_RESET_PASSWORD)
	public ApiMessageResponse changePassword(
	        final HttpServletRequest request,
            @RequestParam(value = "email", required = true)
            final String email,
			@RequestParam(value = "resettoken", required = true)
			final String resettoken,
			@RequestParam(value = "password", required = true)
			final String newPassword,
			@RequestParam(value = "confirmpassword", required = true)
            final String confirmPassword) {

	    getApiVersion(request);

	    if (!newPassword.equals(confirmPassword)) {
	        throw new PreconditionFailedException("Passwords do not match");
	    }

        this.userservice.updatePassword(email, resettoken, newPassword);
		return new ApiMessageResponse("Password has been Reset");
	}

	/**
     * Get Users in system.
     * @param request {@link HttpServletRequest}
     * @param email {@link String}
     * @return {@link ApiMessageResponse}
     */
    @Transactional
    @Secured({ "ROLE_ADMIN" })
    @RequestMapping(API_USER_DELETE)
    public ApiMessageResponse delete(
            final HttpServletRequest request,
            @RequestParam(value = "email", required = true)
            final String email) {

        this.userservice.deleteUser(email);
        return new ApiMessageResponse("User deleted");
    }

    /**
     * Gets a User information.
     * @param request {@link HttpServletRequest}
     * @param email {@link String}
     * @return {@link UserListDTO}
     */
    @Transactional
    @RequestMapping(API_USER_GET)
    public UserDTO get(
            final HttpServletRequest request,
            @RequestParam(value = "email", required = false)
            final String email) {

        String emailString = !StringUtils.isEmpty(email) ? email
                : this.securityService.getUsername();

        if (this.securityService.isUser(emailString)
                || this.securityService.isAdmin()) {
            getApiVersion(request);

            return this.userservice.findUser(emailString, false);
        }

        throw new AuthenticationFailureException("access denied");
    }

	/**
	 * Invites User to Client.
	 * @param request {@link HttpServletRequest}
	 * @param email {@link String}
	 * @param folder {@link String}
	 * @param permissions {@link String[]}
	 * @return {@link ApiMessageResponse}
	 */
    @Transactional
    @RequestMapping(API_USER_INVITE)
    public ApiMessageResponse invite(
            final HttpServletRequest request,
            @RequestParam(value = "email", required = true)
            final String email,
            @RequestParam(value = "folder", required = true)
            final String folder,
            @RequestParam(value = "permissions", required = true)
            final String[] permissions) {

        ApiMessageResponse resp = null;

        getApiVersion(request);

        UserDetails user = this.securityService.getUserDetails();

        List perms = this.securityService
                .toPermissions(permissions);

        boolean isNew = this.userservice.inviteUserToFolder(user, email, folder,
                perms);

        if (isNew) {

            SimpleMailMessage msg = new SimpleMailMessage();
            msg.setTo(email);
            msg.setSubject("FormKiQ invite");

            String text = "Hi there,\n\n" + "You've been invited by "
                    + user.getUsername() + " to join their FormKiQ folder.\n"
                    + "FormKiQ is a app to store and share "
                    + "information on your iOS device.\n"
                    + "It make work simpler, more pleasant, "
                    + "and more productive!\n"
                    + "Get the App..\n\n" + "Thanks!" + "- The FormKiQ Team";

            msg.setText(text);
            this.mailSender.send(msg);

            resp = new ApiMessageResponse("Invite has been sent to " + email);

        } else {

            resp = new ApiMessageResponse(
                    "Permission have been updated for " + email);
        }

        return resp;
    }

    /**
     * Lists Users in system.
     * @param request {@link HttpServletRequest}
     * @param token {@link String}
     * @return {@link UserListDTO}
     */
    @Transactional
    @Secured({ "ROLE_ADMIN" })
    @RequestMapping(API_USER_LIST)
    public UserListDTO list(final HttpServletRequest request,
            @RequestParam(value = "token", required = false)
            final String token) {

        UserListDTO dto = this.userservice.findUsers(token);
        return dto;
    }

    /**
	 * Resets password.
	 * @param request {@link HttpServletRequest}
	 * @param email {@link String}
	 * @return {@link ApiMessageResponse}
	 */
	@Transactional
	@RequestMapping(API_USER_LOST_PASSWORD)
	public ApiMessageResponse lostpassword(
	        final HttpServletRequest request,
			@RequestParam(value = "email", required = true)
			final String email) {

		try {

		    String hostname = this.systemProperties.getSystemHostname();
			String resetToken = this.userservice.generateResetToken(email);

			SimpleMailMessage msg = new SimpleMailMessage();
	        msg.setTo(email);
	        msg.setSubject("Lost Password");

            String text = "Hi there,\n\n"
                    + "Someone recently requested a password change "
                    + "for your FormKiQ account.  "
                    + "If this was you, you can enter this reset token "
                    + "into the app to change your password.\n\n"
                    + "Reset your password"
                    + "\n\n"
                    + "If you don't want to change your password or didn't "
                    + "request this, just ignore and delete this message."
                    + "\n\n"
                    + "Thanks!"
                    + "- The FormKiQ Team";

	        msg.setText(text);
            this.mailSender.send(msg);

            return new ApiMessageResponse(
                    "Reset Password Link has been sent to your email");

		} catch (AuthenticationFailureException e) {

		    throw new PreconditionFailedException(email + " not found");
		}
	}

    /**
     * Adds User to System.
     * @param request {@link HttpServletRequest}
     * @param email {@link String}
     * @param password {@link String}
     * @param confirmPassword {@link String}
     * @param role {@link String}
     * @param status {@link String}
     * @return {@link ApiMessageResponse}
     */
	@Transactional
    @RequestMapping(API_USER_SAVE)
    public ApiMessageResponse save(
            final HttpServletRequest request,
            @RequestParam(value = "email", required = true)
            final String email,
            @RequestParam(value = "password", required = false)
            final String password,
            @RequestParam(value = "confirmpassword", required = false)
            final String confirmPassword,
            @RequestParam(value = "role", required = false)
            final String role,
            @RequestParam(value = "status", required = false)
            final String status) {

        UserRole ur = UserRole.ROLE_USER;
        UserStatus us = UserStatus.ACTIVE;

	    getApiVersion(request);

	    if (this.securityService.isAdmin()) {

	        if (!StringUtils.isEmpty(role)) {
	            ur = UserRole.valueOf(role.trim());
	        }

	        if (!StringUtils.isEmpty(status)) {
	            us = UserStatus.valueOf(status.trim());
	        }

	    } else {

            String authorization = request.getHeader("authorization");
    	    this.securityService.checkBasicAuthorization(authorization);
	    }

        if (password != null && !password.equals(confirmPassword)) {
            throw new PreconditionFailedException("Passwords do not match");
        }

        this.userservice.saveUser(email, password, ur, us);

        return new ApiMessageResponse("User has been saved");
    }
}