UserBean.java

package fi.insomnia.bortal.beans;

import java.security.Principal;
import java.util.ArrayList;
import java.util.Calendar;
import java.util.Collection;
import java.util.HashSet;
import java.util.List;
import java.util.Set;

import javax.annotation.Resource;
import javax.ejb.EJB;
import javax.ejb.LocalBean;
import javax.ejb.SessionContext;
import javax.ejb.Stateless;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import fi.insomnia.bortal.enums.Permission;
import fi.insomnia.bortal.enums.RolePermission;
import fi.insomnia.bortal.exceptions.PermissionDeniedException;
import fi.insomnia.bortal.facade.AccessRightFacade;
import fi.insomnia.bortal.facade.RoleFacade;
import fi.insomnia.bortal.facade.RoleRightFacade;
import fi.insomnia.bortal.facade.UserFacade;
import fi.insomnia.bortal.model.AccessRight;
import fi.insomnia.bortal.model.Role;
import fi.insomnia.bortal.model.RoleRight;
import fi.insomnia.bortal.model.User;
import fi.insomnia.bortal.utilities.ThreadLocalContextHolder;

/**
 * Session Bean implementation class UserBean
 */
@LocalBean
@Stateless
public class UserBean implements UserBeanLocal {

    private static final Logger logger = LoggerFactory.getLogger(UserBean.class);
    public static final String DEFAULT_USER_LOGIN = "ANONYMOUS";

    @EJB
    private RoleRightFacade rrfacade;

    /**
     * Java EE container injektoi tämän luokkamuuttujan luokan luonnin
     * yhteydessä.
     */
    @EJB
    private UserFacade userFacade;
    @Resource
    private SessionContext context;

    @EJB
    private RoleBeanLocal rolebean;
    @EJB
    private AccessRightFacade accessRightFacade;

    @EJB
    private SecurityBeanLocal secubean;

    @EJB
    private EventBeanLocal eventBean;
    @EJB
    private RoleFacade rolefacade;

    /**
     * Default constructor.
     */
    public UserBean() {
        // TODO Auto-generated constructor stub
    }

    @Override
    public User createNewUser(String login, String password) {
        User returnUser = new User();
        returnUser.setLogin(login);
        returnUser.resetPassword(password);
        // Tallennetaan olio kantaan...
        userFacade.create(returnUser);
        return returnUser;
    }

    public List<User> getUsers() {
        fatalPermission(Permission.USER_MANAGEMENT, RolePermission.READ);

        List<User> ret = userFacade.findAll();
        logger.info("Found {} users from database ", ret.size());
        return ret;
    }

    @Override
    public User mergeChanges(User user) {
        fatalPermission(Permission.USER_MANAGEMENT, RolePermission.WRITE);

        return userFacade.merge(user);
    }

    public User getUser(String nick) {
        return userFacade.findByLogin(nick);
    }

    public boolean isCurrentUser(User user) {
        return (context.getCallerPrincipal() == null || user == null) ? false : context.getCallerPrincipal().getName().equals(user.getNick());
    }

    public boolean isLoggedIn() {
        return !getAnonUser().equals(getCurrentUser());
    }

    @Override
    public User getCurrentUser() {
        Principal principal = context.getCallerPrincipal();

        User ret = userFacade.findByLogin(principal.getName());
        if (ret == null) {
            ret = getAnonUser();
        }
        return ret;
    }

    /**
     * Makes sure default user and public role exist and the user is member of
     * the role.
     */
    public User getAnonUser() {
        User defaultUser = userFacade.findByLogin(DEFAULT_USER_LOGIN);
        if (defaultUser == null) {
            defaultUser = new User();
            defaultUser.setLogin(DEFAULT_USER_LOGIN);
            userFacade.create(defaultUser);

            ArrayList<Role> userRoles = new ArrayList<Role>();
            userRoles.add(rolebean.getOrCreatePublicRole());

            defaultUser.setRoles(userRoles);
        }
        return defaultUser;
    }

    // TODO: Voisi olla hyvä idea cachettaa... Tätä kutsutaan aika paljon..
    public boolean hasPermission(Permission target, RolePermission permission) {

        User user = getCurrentUser();
        logger.info("checking permission {}, {}", target, permission);
        Calendar start = Calendar.getInstance();

        AccessRight expectedRight = accessRightFacade.findByPermission(target);

        Set<Role> checkedRoles = new HashSet<Role>();

        List<Role> rolelist = rolefacade.findForUser(user, eventBean.getCurrentEvent());
        if (getRights(rolelist, expectedRight, permission, checkedRoles)) {
            return true;
        }

        long diffMs = Calendar.getInstance().getTimeInMillis() - start.getTimeInMillis();
        logger.debug("");
        // TODO: FIX THIS!! really bad idea....

        if (user.isSuperadmin()) {
            logger.debug("Returning true for superadmin for {} perm {}", target.name(), permission);
            return true;
        }
        return false;
    }

    private boolean getRights(Collection<Role> roles, AccessRight expectedRight, RolePermission permission, Set<Role> checkedRoles) {

        if(roles == null || roles.isEmpty())
        {
            return false;
        }
        for (RoleRight rr : rrfacade.find(roles, expectedRight)) {

            switch (permission) {
            case READ:
                if (rr.isRead()) {
                    return true;
                }
                break;
            case WRITE:
                if (rr.isWrite()) {
                    return true;
                }
                break;
            case EXECUTE:
                if (rr.isExecute()) {
                    return true;
                }

            }
        }
        checkedRoles.addAll(roles);
        
        return getRights(rolefacade.findAllParentsExcluding(roles,checkedRoles), expectedRight,permission, checkedRoles);
        


    }

    @Override
    public boolean hasCurrentUserPermission(Permission permission, RolePermission rolePermission) {
        return this.hasPermission(permission, rolePermission);
    }

    @Override
    public void fatalPermission(Permission target, RolePermission permission, Object... failmessage) {
        boolean ret = hasPermission(target, permission);
        if (!ret) {
            String message = null;
            if (failmessage == null || failmessage.length == 0) {
                message = new StringBuilder("SessionHandler mbean permission exception: Target: ")
                        .append(target.toString())
                        .append(", Permission: ")
                        .append(permission.toString())
                        .toString();
            } else {
                StringBuilder msgbuilder = new StringBuilder();
                for (Object part : failmessage) {
                    msgbuilder.append(part.toString());
                }
                message = msgbuilder.toString();
            }
            throw new PermissionDeniedException(secubean, getCurrentUser(), message);
        }
    }

    @Override
    public void fatalNotLoggedIn() {
        if (!isLoggedIn()) {
            throw new PermissionDeniedException(secubean, getCurrentUser(), "User is not logged in!");
        }
    }

}