UserBean.java

package fi.insomnia.bortal.beans;

import java.security.Principal;
import java.util.ArrayList;
import java.util.HashSet;
import java.util.List;
import java.util.Set;

import javax.annotation.Resource;
import javax.ejb.EJB;
import javax.ejb.LocalBean;
import javax.ejb.SessionContext;
import javax.ejb.Stateless;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import fi.insomnia.bortal.enums.Permission;
import fi.insomnia.bortal.enums.RolePermission;
import fi.insomnia.bortal.exceptions.PermissionDeniedException;
import fi.insomnia.bortal.facade.UserFacade;
import fi.insomnia.bortal.model.AccessRight;
import fi.insomnia.bortal.model.Role;
import fi.insomnia.bortal.model.RoleRight;
import fi.insomnia.bortal.model.User;

/**
 * Session Bean implementation class UserBean
 */
@LocalBean
@Stateless
public class UserBean implements UserBeanLocal {

    private static final Logger logger = LoggerFactory.getLogger(UserBean.class);
    public static final String DEFAULT_USER_LOGIN = "ANONYMOUS";

    /**
     * Java EE container injektoi tämän luokkamuuttujan luokan luonnin
     * yhteydessä.
     */
    @EJB
    private UserFacade userFacade;
    @Resource
    private SessionContext context;

    @EJB
    private RoleBeanLocal rolebean;
    @EJB
    private AccessRightBeanLocal accessRightBeanLocal;

    @EJB
    private SecurityBeanLocal secubean;

    @EJB
    private EventBeanLocal eventBean;

    /**
     * Default constructor.
     */
    public UserBean() {
        // TODO Auto-generated constructor stub
    }

    @Override
    public User createNewUser(String login, String password) {
        User returnUser = new User();
        returnUser.setLogin(login);
        returnUser.resetPassword(password);
        // Tallennetaan olio kantaan...
        userFacade.create(returnUser);
        return returnUser;
    }

    public List<User> getUsers() {
        User curruser = getCurrentUser();
        if (curruser == null || !hasPermission(Permission.USER_MANAGEMENT, curruser, RolePermission.READ)) {
            throw new PermissionDeniedException(secubean, curruser, "User tried to execute getUsers function with insufficient permissions");
        }

        List<User> ret = userFacade.findAll();
        logger.info("Found {} users from database ", ret.size());
        return ret;
    }

    @Override
    public User mergeChanges(User user) {
        User curruser = getCurrentUser();
        if (curruser == null || !hasPermission(Permission.USER_MANAGEMENT, curruser, RolePermission.WRITE) || !user.equals(curruser)) {
            throw new PermissionDeniedException(secubean, curruser, "User tried to merge someone others data with insufficient permissions");
        }
        return userFacade.merge(user);
    }

    public User getUser(String nick) {
        return userFacade.findByLogin(nick);
    }

    public boolean isCurrentUser(User user) {
        return (context.getCallerPrincipal() == null || user == null) ? false : context.getCallerPrincipal().getName().equals(user.getNick());
    }

    public boolean isLoggedIn() {
        return !getAnonUser().equals(getCurrentUser());
    }

    @Override
    public User getCurrentUser() {
        Principal principal = context.getCallerPrincipal();

        User ret = userFacade.findByLogin(principal.getName());
        if (ret == null) {
            ret = getAnonUser();
        }
        return ret;
    }

    /**
     * Makes sure default user and public role exist and the user is member of
     * the role.
     */
    public User getAnonUser() {
        User defaultUser = userFacade.findByLogin(DEFAULT_USER_LOGIN);
        if (defaultUser == null) {
            defaultUser = new User();
            defaultUser.setLogin(DEFAULT_USER_LOGIN);
            userFacade.create(defaultUser);

            ArrayList<Role> userRoles = new ArrayList<Role>();
            userRoles.add(rolebean.getOrCreatePublicRole());

            defaultUser.setRoles(userRoles);
        }
        return defaultUser;
    }

    public boolean hasPermission(Permission target, User user, RolePermission permission) {

        if (user == null) {
            return false;
        }

        AccessRight expectedRight = accessRightBeanLocal.findOrCreate(target);

        User dbusr = userFacade.find(user.getId());
        if (dbusr != null) {
            Set<Role> checkedRoles = new HashSet<Role>();
            for (Role r : dbusr.getRoles()) {
                if (getRights(r, expectedRight, permission, checkedRoles)) {
                    return true;
                }
            }
        }
        // TODO: FIX THIS!! really bad idea....

        if (user.isSuperadmin()) {
            logger.debug("Returning true for superadmin for {} perm {}", target.name(), permission);
            return true;
        }
        return false;
    }

    private static boolean getRights(Role role, AccessRight expectedRight, RolePermission permission, Set<Role> checkedRoles) {

        if (checkedRoles.contains(role)) {
            return false;
        }

        for (RoleRight rr : role.getRoleRights()) {
            if (rr.getAccessRight().equals(expectedRight)) {
                switch (permission) {
                case READ:
                    if (rr.isRead()) {
                        return true;
                    }
                    break;
                case WRITE:
                    if (rr.isWrite()) {
                        return true;
                    }
                    break;
                case EXECUTE:
                    if (rr.isExecute()) {
                        return true;
                    }
                }
            }
        }
        checkedRoles.add(role);

        for (Role r : role.getParents()) {
            if (getRights(r, expectedRight, permission, checkedRoles)) {
                return true;
            }

        }
        return false;

    }

    @Override
    public boolean hasCurrentUserPermission(Permission permission, RolePermission rolePermission) {
        return this.hasPermission(permission, getCurrentUser(), rolePermission);
    }

    @Override
    public void fatalPermission(Permission target, RolePermission permission, Object... failmessage) {
        fatalPermission(getCurrentUser(), target, permission, failmessage);
    }

    @Override
    public void fatalPermission(User user, Permission target, RolePermission permission, Object... failmessage) {
        boolean ret = hasPermission(target, user, permission);
        if (!ret) {
            String message = null;
            if (failmessage == null || failmessage.length == 0) {
                message = new StringBuilder("SessionHandler mbean permission exception: Target: ")
                        .append(target.toString())
                        .append(", Permission: ")
                        .append(permission.toString())
                        .toString();
            } else {
                StringBuilder msgbuilder = new StringBuilder();
                for (Object part : failmessage) {
                    msgbuilder.append(part.toString());
                }
                message = msgbuilder.toString();
            }
            throw new PermissionDeniedException(secubean, getCurrentUser(), message);
        }
    }


}