/*-
 * #%L
 * Eureka! Clinical User Webapp
 * %%
 * Copyright (C) 2016 Emory University
 * %%
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 * #L%
 */
package org.eurekaclinical.common.filter;

import java.io.IOException;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.google.inject.Singleton;

/**
 *
 * @author miaoai
 */
@Singleton
public class HasAuthenticatedSessionFilter implements Filter {

    private static final Logger LOGGER
            = LoggerFactory.getLogger(HasAuthenticatedSessionFilter.class);

    public HasAuthenticatedSessionFilter() {
    }

    @Override
    public void init(FilterConfig inFilterConfig) throws ServletException {
    }

    @Override
    public void doFilter(ServletRequest inRequest, ServletResponse inResponse, FilterChain inFilterChain) throws IOException, ServletException {

        HttpServletRequest servletRequest = (HttpServletRequest) inRequest;
        HttpServletResponse servletResponse = (HttpServletResponse) inResponse;

        String remoteUser = servletRequest.getRemoteUser();

        if (remoteUser != null) {
            HttpSession session = servletRequest.getSession(false);
            if (session != null) {
                inFilterChain.doFilter(inRequest, inResponse);
            } else {
                goHome(servletRequest, servletResponse);
            }
        } else {
            servletResponse.sendError(HttpServletResponse.SC_BAD_REQUEST);
        }
    }

    private void goHome(HttpServletRequest inRequest, HttpServletResponse inResponse) throws IOException {
        inResponse.sendRedirect(inRequest.getContextPath() + "/logout?goHome=true");
    }

    @Override
    public void destroy() {
    }

}

@@ -889,109 +889,187 @@
 n;%0A%0A
+%0A
 import 
-org.slf4j.Logger;%0Aimport org.slf4j.LoggerFactory;%0A%0Aimport com.google.inject.Singleton;%0A%0A/**
+com.google.inject.Singleton;%0A%0A/**%0A * Filter that sets a request attribute, %3Ccode%3EuserIsActivated%3C/code%3E, if there %0A * is an active session with a non-null remote user.
 %0A *
+ 
 %0A * 
@@ -1171,267 +1171,802 @@
    p
-rivate static final Logger LOGGER
+ublic HasAuthenticatedSessionFilter() %7B
 %0A    
+%7D%0A%0A
     
-    = LoggerFactory.getLogger(HasAuthenticatedSessionFilter.class);%0A%0A    public HasAuthenticatedSessionFilter() %7B%0A    %7D%0A%0A    @Override%0A    public void init(FilterConfig inFilterConfig) throws ServletException %7B%0A    %7D%0A
+/**%0A     * Initializes the filter. Does nothing.%0A     * %0A     * @param inFilterConfig the filter's configuration.%0A     */%0A    @Override%0A    public void init(FilterConfig inFilterConfig) %7B%0A    %7D%0A%0A    /**%0A     * Sets the request attribute and passes the request and response onto the%0A     * next filter. If there is no session or the remote user is not set,%0A     * the response status is set to 400 (Bad Request).%0A     * %0A     * @param inRequest the HTTP request.%0A     * @param inResponse the HTTP response.%0A     * @param inFilterChain the filter chain.%0A     * @throws IOException if there is an error in subsequent filters or in%0A     * the subsequent response.%0A     * @throws ServletException if there is an error in subsequent filters.%0A     */
 %0A   
@@ -2343,52 +2343,16 @@
 ();%0A
-%0A        if (remoteUser != null) %7B%0A 
         
    H
@@ -2343,27 +2343,24 @@
 ();%0A        
-   
 HttpSession 
@@ -2415,16 +2415,34 @@
     
-    
 if (
+remoteUser != null && 
 sess
@@ -2472,110 +2472,102 @@
     
-    inFilterChain.doFilter(inRequest, inResponse);%0A            %7D else %7B%0A                goHome(servlet
+inRequest.setAttribute(%22userIsActivated%22, Boolean.TRUE);%0A            inFilterChain.doFilter(in
 Requ
@@ -2571,23 +2571,18 @@
 equest, 
-servlet
+in
 Response
@@ -2588,22 +2588,8 @@
 e);%0A
-            %7D%0A
     
@@ -2701,202 +2701,61 @@
     
-private void goHome(HttpServletRequest inRequest, HttpServletResponse inResponse) throws IOException %7B%0A        inResponse.sendRedirect(inRequest.getContextPath() + %22/logout?goHome=true%22);%0A    %7D%0A
+/**%0A     * Destroys the filter. Does nothing.%0A     */
 %0A   

Set the userIsActivated request attribute, which had gotten lost. Just respond with 400 status code when there is missing session/user information. Don’t try to go back to the login screen.