com.formkiq.server.api.UsersController Maven / Gradle / Ivy

Go to download
package com.formkiq.server.api;

import javax.servlet.http.HttpServletRequest;
import javax.transaction.Transactional;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.mail.MailSender;
import org.springframework.mail.SimpleMailMessage;
import org.springframework.security.access.annotation.Secured;
import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

import com.formkiq.server.domain.type.UserDTO;
import com.formkiq.server.domain.type.UserListDTO;
import com.formkiq.server.domain.type.UserRole;
import com.formkiq.server.domain.type.UserStatus;
import com.formkiq.server.service.AuthenticationFailureException;
import com.formkiq.server.service.InvalidEmailException;
import com.formkiq.server.service.OAuthService;
import com.formkiq.server.service.PreconditionFailedException;
import com.formkiq.server.service.UserService;

/**
 * User Rest Service.
 *
 */
@RestController
public class UsersController extends AbstractRestController {

    /** OAuth Token URL. */
    public static final String OAUTH_TOKEN = "/oauth/token";

	/** Save User. */
    public static final String API_USER_SAVE = "/api/users/save";

	/** Change Password. */
    public static final String API_USER_RESET_PASSWORD
        = "/api/users/resetpassword";

	/** Reset Lost Password. */
    public static final String API_USER_LOST_PASSWORD
        = "/api/users/lostpassword";

    /** User Create. */
    public static final String API_USER_CREATE = "/api/users/create";

    /** User Get. */
    public static final String API_USER_GET = "/api/users/get";

    /** User List. */
    public static final String API_USER_LIST = "/api/users/list";

    /** User Delete. */
    public static final String API_USER_DELETE = "/api/users/delete";

	/** MailSender. */
    @Autowired
    private MailSender mailSender;

    /** OAuthService. */
    @Autowired
    private OAuthService oauthservice;

	/** UserService. */
	@Autowired
	private UserService userservice;

	/**
     * Change User Password.
     * @param email {@link String}
     * @param request {@link HttpServletRequest}
     * @param resettoken {@link String}
     * @param newPassword {@link String}
     * @param confirmPassword {@link String}
     * @return {@link ApiMessageResponse}
     */
	@Transactional
	@RequestMapping(API_USER_RESET_PASSWORD)
	public ApiMessageResponse changePassword(
	        final HttpServletRequest request,
	        @RequestParam(value = "email", required = true)
            final String email,
			@RequestParam(value = "resettoken", required = true)
			final String resettoken,
			@RequestParam(value = "password", required = true)
			final String newPassword,
			@RequestParam(value = "confirmpassword", required = true)
            final String confirmPassword) {

	    getApiVersion(request);

	    if (!newPassword.equals(confirmPassword)) {
	        throw new PreconditionFailedException("Passwords do not match");
	    }

        this.userservice.updatePassword(email, resettoken, newPassword);
		return new ApiMessageResponse("password changed");
	}

    /**
	 * Create User.
	 * @param request {@link HttpServletRequest}
	 * @param client {@link String}
	 * @param clientSecret {@link String}
	 * @param email {@link String}
	 * @param password {@link String}
	 * @param confirmPassword {@link String}
	 * @return {@link ApiMessageResponse}
	 */
    @Transactional
    @RequestMapping(API_USER_CREATE)
    public ApiMessageResponse create(
            final HttpServletRequest request,
            @RequestParam(value = "client", required = false)
            final String client,
            @RequestParam(value = "clientsecret", required = false)
            final String clientSecret,
            @RequestParam(value = "email", required = true)
            final String email,
            @RequestParam(value = "password", required = false)
            final String password,
            @RequestParam(value = "confirmpassword", required = false)
            final String confirmPassword) {

        getApiVersion(request);

        if (!password.equals(confirmPassword)) {
            throw new PreconditionFailedException("Passwords do not match");
        }

        if (!this.oauthservice.isValidClient(client, clientSecret)) {
            throw new PreconditionFailedException(
                    "Invalid Client / Secret combination");
        }

        this.userservice.createUser(client, email, password,
                UserStatus.ACTIVE, UserRole.ROLE_USER);

        return new ApiMessageResponse("User has been created");
    }

	/**
     * Get Users in system.
     * @param request {@link HttpServletRequest}
     * @param email {@link String}
     * @return {@link ApiMessageResponse}
     */
    @Transactional
    @Secured({ "ROLE_ADMIN" })
    @RequestMapping(API_USER_DELETE)
    public ApiMessageResponse delete(
            final HttpServletRequest request,
            @RequestParam(value = "email", required = true)
            final String email) {

        getApiVersion(request);
        this.userservice.deleteUser(email);
        return new ApiMessageResponse("User deleted");
    }

    /**
     * Deletes a User.
     * @param request {@link HttpServletRequest}
     * @param email {@link String}
     * @return {@link UserListDTO}
     */
    @Transactional
    @Secured({ "ROLE_ADMIN" })
    @RequestMapping(API_USER_GET)
    public UserDTO get(
            final HttpServletRequest request,
            @RequestParam(value = "email", required = true)
            final String email) {

        getApiVersion(request);

        return this.userservice.findUser(email);
    }

    /**
     * Lists Users in system.
     * @param request {@link HttpServletRequest}
     * @param token {@link String}
     * @return {@link UserListDTO}
     */
    @Transactional
    @Secured({ "ROLE_ADMIN" })
    @RequestMapping(API_USER_LIST)
    public UserListDTO list(final HttpServletRequest request,
            @RequestParam(value = "token", required = false)
            final String token) {

        getApiVersion(request);
        UserListDTO dto = this.userservice.findUsers(token);
        return dto;
    }

    /**
	 * Resets password.
	 * @param request {@link HttpServletRequest}
	 * @param email {@link String}
	 * @return {@link ApiMessageResponse}
	 */
	@Transactional
	@RequestMapping(API_USER_LOST_PASSWORD)
	public ApiMessageResponse lostpassword(
	        final HttpServletRequest request,
			@RequestParam(value = "email", required = true)
			final String email) {

	    getApiVersion(request);

		try {

			String resetToken = this.userservice.generateResetToken(email);

			SimpleMailMessage msg = new SimpleMailMessage();
	        msg.setTo(email);
	        msg.setSubject("Lost Password");

            String text = "Hi there,\n\n"
                    + "Someone recently requested a password change "
                    + "for your FormKiQ account.  "
                    + "If this was you, you can enter this reset token "
                    + "into the app to change your password.\n\n"
                    + resetToken + "\n\n"
                    + "If you don't want to change your password or didn't "
                    + "request this, just ignore and delete this message."
                    + "\n\n"
                    + "Thanks!"
                    + "- The FormKiQ Team";

	        msg.setText(text);
            this.mailSender.send(msg);

            return new ApiMessageResponse(
                    "reset token has been sent your email");

		} catch (AuthenticationFailureException e) {

		    throw new InvalidEmailException(email);
		}
	}

	/**
     * Save User.
     * @param request {@link HttpServletRequest}
     * @param client {@link String}
     * @param email {@link String}
     * @param password {@link String}
     * @param role {@link String}
     * @param status {@link String}
     * @return {@link ApiMessageResponse}
     */
	@Secured({ "ROLE_ADMIN" })
    @Transactional
    @RequestMapping(API_USER_SAVE)
    public ApiMessageResponse save(
            final HttpServletRequest request,
            @RequestParam(value = "client", required = false)
            final String client,
            @RequestParam(value = "email", required = true)
            final String email,
            @RequestParam(value = "pass", required = false)
            final String password,
            @RequestParam(value = "role", required = false)
            final String role,
            @RequestParam(value = "status", required = false)
            final String status) {

	    getApiVersion(request);

	    UserRole ur = null;
	    UserStatus us = null;

	    if (!StringUtils.isEmpty(role)) {
	        ur = UserRole.valueOf(role.trim());
	    }

	    if (!StringUtils.isEmpty(status)) {
	        us = UserStatus.valueOf(status.trim());
	    }

	    this.userservice.saveUser(client, email, password, ur, us);
        return new ApiMessageResponse("user saved", email);
    }
}