/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 *  contributor license agreements.  See the NOTICE file distributed with
 *  this work for additional information regarding copyright ownership.
 *  The ASF licenses this file to You under the Apache License, Version 2.0
 *  (the "License"); you may not use this file except in compliance with
 *  the License.  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 *
 */
package org.apache.lenya.cms.cocoon.acting;

import java.util.Collections;
import java.util.Map;

import org.apache.avalon.framework.parameters.Parameters;
import org.apache.avalon.framework.service.ServiceSelector;
import org.apache.cocoon.acting.ConfigurableServiceableAction;
import org.apache.cocoon.environment.ObjectModelHelper;
import org.apache.cocoon.environment.Redirector;
import org.apache.cocoon.environment.Request;
import org.apache.cocoon.environment.SourceResolver;
import org.apache.lenya.ac.AccessController;
import org.apache.lenya.ac.AccessControllerResolver;
import org.apache.lenya.ac.Policy;
import org.apache.lenya.ac.PolicyManager;
import org.apache.lenya.cms.linking.LinkRewriter;
import org.apache.lenya.cms.linking.OutgoingLinkRewriter;
import org.apache.lenya.cms.repository.RepositoryUtil;
import org.apache.lenya.cms.repository.Session;
import org.apache.lenya.util.ServletHelper;

/**
 * Returns a map if the current request needs a redirect to the <code>https://</code> protocol.
 * This is the case if the policy requires SSL protection and the current request is not secure. The
 * map contains the redirect URI as value for the key <em>redirectUri</em>. Otherwise,
 * <code>null</code> is returned.
 */
public class SslRedirectAction extends ConfigurableServiceableAction {

    /**
     * The key to obtain the redirect URI from the returned map.
     */
    public static final String KEY_REDIRECT_URI = "redirectUri";

    public Map act(Redirector redirector, SourceResolver sourceResolver, Map objectModel,
            String source, Parameters parameters) throws Exception {

        ServiceSelector selector = null;
        AccessControllerResolver resolver = null;
        AccessController accessController = null;

        Request request = ObjectModelHelper.getRequest(objectModel);

        try {
            selector = (ServiceSelector) this.manager.lookup(AccessControllerResolver.ROLE
                    + "Selector");

            resolver = (AccessControllerResolver) selector
                    .select(AccessControllerResolver.DEFAULT_RESOLVER);

            String url = ServletHelper.getWebappURI(request);
            accessController = resolver.resolveAccessController(url);

            if (accessController != null) {

                PolicyManager policyManager = accessController.getPolicyManager();
                Policy policy = policyManager.getPolicy(accessController.getAccreditableManager(),
                        url);
                if (policy.isSSLProtected() && !request.getScheme().equals("https")) {
                    Session session = RepositoryUtil.getSession(this.manager, request);
                    LinkRewriter rewriter = new OutgoingLinkRewriter(this.manager, session, url,
                            false, true, false);
                    String sslUri = rewriter.rewrite(url);
                    return Collections.singletonMap(KEY_REDIRECT_URI, sslUri);
                }
            }

        } finally {
            if (selector != null) {
                if (resolver != null) {
                    if (accessController != null) {
                        resolver.release(accessController);
                    }
                    selector.release(resolver);
                }
                this.manager.release(selector);
            }
        }
        return null;
    }
}

@@ -2635,25 +2635,72 @@
 jectModel);%0A
+        
 %0A
+        if (!request.isSecure()) %7B%0A    
         try 
@@ -2697,24 +2697,28 @@
       try %7B%0A
+    
             
@@ -2816,16 +2816,20 @@
         
+    
 + %22Selec
@@ -2835,17 +2835,25 @@
 ctor%22);%0A
-%0A
+    %0A    
         
@@ -2923,16 +2923,20 @@
         
+    
 .select(
@@ -2979,17 +2979,23 @@
 OLVER);%0A
-%0A
+    %0A  
         
@@ -2994,24 +2994,26 @@
             
+  
 String url =
@@ -3042,32 +3042,36 @@
 ppURI(request);%0A
+    
             acce
@@ -3124,17 +3124,25 @@
 r(url);%0A
-%0A
+    %0A    
         
@@ -3177,17 +3177,20 @@
 null) %7B%0A
-%0A
+    
         
@@ -3264,16 +3264,20 @@
 ager();%0A
+    
         
@@ -3391,16 +3391,20 @@
         
+    
 url);%0A  
@@ -3413,24 +3413,28 @@
             
+ 
+   
 if (policy.i
@@ -3452,48 +3452,8 @@
 ed()
- && !request.getScheme().equals(%22https%22)
 ) %7B%0A
@@ -3472,16 +3472,20 @@
         
+    
 Session 
@@ -3536,32 +3536,36 @@
 ager, request);%0A
+    
                 
@@ -3673,16 +3673,20 @@
         
+    
 false, t
@@ -3710,32 +3710,36 @@
                 
+   
+ 
 String sslUri = 
@@ -3757,24 +3757,28 @@
 write(url);%0A
+    
             
@@ -3852,34 +3852,42 @@
                 
-%7D%0A
+    %7D%0A    
             %7D%0A%0A 
@@ -3884,17 +3884,25 @@
       %7D%0A
-%0A
+    %0A    
         
@@ -3909,24 +3909,28 @@
 %7D finally %7B%0A
+    
             
@@ -3945,32 +3945,36 @@
 ctor != null) %7B%0A
+    
                 
@@ -4009,32 +4009,36 @@
                 
+    
 if (accessContro
@@ -4045,32 +4045,36 @@
 ller != null) %7B%0A
+    
                 
@@ -4129,34 +4129,40 @@
                 
-%7D%0A
+    %7D%0A  
                 
@@ -4157,32 +4157,34 @@
                 
+  
 selector.release
@@ -4203,32 +4203,36 @@
                 
+    
 %7D%0A              
@@ -4233,16 +4233,20 @@
         
+ 
+   
 this.man
@@ -4265,24 +4265,42 @@
 (selector);%0A
+                %7D%0A
             

Use request.isSecure() instead of protocol string comparison. Moved check out of try block for better performance. Tested with mod_proxy_ajp.