/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
package org.ocelotds.security;

import java.io.Serializable;
import java.lang.reflect.Method;
import java.security.Principal;
import javax.inject.Inject;
import javax.interceptor.AroundInvoke;
import javax.interceptor.Interceptor;
import javax.interceptor.InvocationContext;
import javax.websocket.server.HandshakeRequest;
import org.ocelotds.Constants;
import org.ocelotds.annotations.OcelotLogger;
import org.slf4j.Logger;
import org.ocelotds.annotations.RolesAllowed;
import org.ocelotds.context.ThreadLocalContextHolder;

/**
 * This class apply security check
 * @author hhfrancois
 */
@Interceptor
@RolesAllowed
public class RolesAllowedInterceptor implements Serializable {

	private static final long serialVersionUID = -849762977471230875L;

	@Inject
	@OcelotLogger
	private transient Logger logger;
	
	@Inject
	private Principal principal;

	/**
	 *
	 * @param ctx
	 * @return
	 * @throws Exception
	 */
	@AroundInvoke
	public Object checkRolesAllowed(InvocationContext ctx) throws Exception {
		Method method = ctx.getMethod();
		RolesAllowed rolesAllowedAnno = method.getAnnotation(RolesAllowed.class);
		String[] rolesAllowed = rolesAllowedAnno.value();
		HandshakeRequest handshakeRequest = getHandshakeRequest();
		for (String roleAllowed : rolesAllowed) {
			if(handshakeRequest.isUserInRole(roleAllowed)) {
				if(logger.isDebugEnabled()) {
					logger.debug("Check method {}.{} : role {} is allowed", method.getDeclaringClass().getSimpleName(), method.getName(), roleAllowed);
				}
				return ctx.proceed();
			}
		}
		throw new IllegalAccessException("'"+principal+"' is not allowed to execute "+method.getDeclaringClass().getSimpleName()+"."+method.getName());
	}

	HandshakeRequest getHandshakeRequest() {
		return (HandshakeRequest) ThreadLocalContextHolder.get(Constants.HANDSHAKEREQUEST);
	}
}

@@ -1282,16 +1282,123 @@
 hod();%0D%0A
+%09%09String methodid = String.format(%22%25s.%25s%22, method.getDeclaringClass().getSimpleName(), method.getName());%0D%0A
 %09%09RolesA
@@ -1581,16 +1581,49 @@
 est();%0D%0A
+%09%09if(handshakeRequest!=null) %7B%0D%0A%09
 %09%09for (S
@@ -1659,16 +1659,17 @@
 wed) %7B%0D%0A
+%09
 %09%09%09if(ha
@@ -1717,16 +1717,17 @@
  %7B%0D%0A%09%09%09%09
+%09
 if(logge
@@ -1754,16 +1754,17 @@
 %7B%0D%0A%09%09%09%09%09
+%09
 logger.d
@@ -1788,11 +1788,8 @@
 d %7B%7D
-.%7B%7D
  : r
@@ -1818,62 +1818,10 @@
 thod
-.getDeclaringClass().getSimpleName(), method.getName()
+id
 , ro
@@ -1837,19 +1837,21 @@
 );%0D%0A%09%09%09%09
+%09
 %7D%0D%0A
+%09
 %09%09%09%09retu
@@ -1872,19 +1872,148 @@
 ();%0D%0A%09%09%09
+%09
 %7D%0D%0A
+%09%09%09%7D%0D%0A%09%09%7D else %7B%0D%0A%09%09%09throw new NullPointerException(%22'HandshakeRequest' is not in threadlocal for roles testing : %22+methodid);%0D%0A
 %09%09%7D%0D%0A%09%09t
@@ -2099,65 +2099,10 @@
 thod
-.getDeclaringClass().getSimpleName()+%22.%22+method.getName()
+id
 );%0D%0A

fix coverity 38132 Dereference null return value