/**
 *  AccessServlet
 *  Copyright 11.10.2015 by Michael Peter Christen, @0rb1t3r
 *
 *  This library is free software; you can redistribute it and/or
 *  modify it under the terms of the GNU Lesser General Public
 *  License as published by the Free Software Foundation; either
 *  version 2.1 of the License, or (at your option) any later version.
 *  
 *  This library is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 *  Lesser General Public License for more details.
 *  
 *  You should have received a copy of the GNU Lesser General Public License
 *  along with this program in the file lgpl21.txt
 *  If not, see <http://www.gnu.org/licenses/>.
 */

package org.loklak.api.server;

import java.io.IOException;
import java.util.Collection;
import java.util.Map;

import javax.servlet.ServletException;
import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.elasticsearch.common.xcontent.XContentBuilder;
import org.elasticsearch.common.xcontent.XContentFactory;
import org.loklak.data.DAO;
import org.loklak.data.AccessTracker.Track;

public class AccessServlet extends HttpServlet {

    private static final long serialVersionUID = 257718432475091648L;

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        doGet(request, response);
    }
    
    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        RemoteAccess.Post post = RemoteAccess.evaluate(request);
        if (!post.isLocalhostAccess()) {response.sendError(503, "unauthorized"); return;}
        
        String callback = post.get("callback", "");
        boolean jsonp = callback != null && callback.length() > 0;
        
        post.setResponse(response, "application/javascript");
        Collection<Track> tracks = DAO.access.getTrack();
        
        // generate json
        XContentBuilder json = XContentFactory.jsonBuilder().prettyPrint().lfAtEnd();
        json.startObject();
        json.field("access").startArray();
        int maxcount = 1000;
        for (Track track: tracks) {
            json.startObject();
            for (Map.Entry<String, Object> entry: track.entrySet()) {
                json.field(entry.getKey(), entry.getValue());
            }
            json.endObject();
            if (maxcount-- <= 0) break;
        }
        json.endArray();
        json.endObject(); // of root

        // write json
        ServletOutputStream sos = response.getOutputStream();
        if (jsonp) sos.print(callback + "(");
        sos.print(json.string());
        if (jsonp) sos.println(");");
        sos.println();
        post.finalize();
    }
    
}

@@ -1827,85 +1827,218 @@
 if (
-!
 post.is
-LocalhostAccess()) %7Bresponse.sendError(503, %22unauthorized%22); return;%7D
+DoS_servicereduction() %7C%7C post.isDoS_blackout()) %7Bresponse.sendError(503, %22your request frequency is too high%22); return;%7D // DoS protection%0A        %0A        boolean anonymize = !post.isLocalhostAccess();
 %0A   
@@ -2504,16 +2504,34 @@
 xcount =
+ anonymize ? 100 :
  1000;%0A 
@@ -2613,66 +2613,356 @@
     
-for (Map.Entry%3CString, Object%3E entry: track.entrySet()) %7B%0A
+if (anonymize && !track.get(%22class%22).equals(%22SearchServlet%22)) continue;%0A            for (Map.Entry%3CString, Object%3E entry: track.entrySet()) %7B%0A                if (anonymize && %22host%22.equals(entry.getKey())) %7B%0A                    json.field(%22host-anonymized%22, Integer.toHexString(Math.abs(entry.getValue().hashCode())));%0A                %7D else %7B%0A    
     
@@ -3015,24 +3015,42 @@
 etValue());%0A
+                %7D%0A
             

allow non-localhost access to access.json servlet for debugging. IP addresses are anonymized