package org.owasp.appsensor.handler;

import java.util.Collection;

import javax.ws.rs.GET;
import javax.ws.rs.POST;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.QueryParam;
import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.MediaType;

import org.owasp.appsensor.AppSensorServer;
import org.owasp.appsensor.Attack;
import org.owasp.appsensor.ClientApplication;
import org.owasp.appsensor.Event;
import org.owasp.appsensor.RequestHandler;
import org.owasp.appsensor.Response;
import org.owasp.appsensor.accesscontrol.Action;
import org.owasp.appsensor.exceptions.NotAuthorizedException;

/**
 * This is the restful endpoint that handles requests on the server-side. 
 * 
 * @author John Melton (jtmelton@gmail.com) http://www.jtmelton.com/
 */
@Path("/api/v1.0")
@Produces("application/json")
public class RestRequestHandler implements RequestHandler {

	public static String APPSENSOR_CLIENT_APPLICATION_IDENTIFIER_ATTR = "APPSENSOR_CLIENT_APPLICATION_IDENTIFIER_ATTR";
	
	@Context
	private ContainerRequestContext requestContext;
	
	/**
	 * {@inheritDoc}
	 */
	@Override
	@POST
	@Path("/events")
	public void addEvent(Event event) throws NotAuthorizedException {
		checkAuthorization(Action.ADD_EVENT);
		AppSensorServer.getInstance().getEventStore().addEvent(event);
	}

	/**
	 * {@inheritDoc}
	 */
	@Override
	@POST
	@Path("/attacks")
	public void addAttack(Attack attack) throws NotAuthorizedException {
		checkAuthorization(Action.ADD_ATTACK);
		AppSensorServer.getInstance().getAttackStore().addAttack(attack);
	}

	/**
	 * {@inheritDoc}
	 */
	@Override
	@GET
	@Path("/responses")
	@Produces(MediaType.APPLICATION_JSON)
	public Collection<Response> getResponses(@QueryParam("earliest") long earliest) throws NotAuthorizedException {
		checkAuthorization(Action.GET_RESPONSES);
		
		String clientApplicationName = (String)requestContext.getProperty(APPSENSOR_CLIENT_APPLICATION_IDENTIFIER_ATTR);
		return AppSensorServer.getInstance().getResponseStore().findResponses(clientApplicationName, earliest);
	}
	
	/**
	 * Check authz before performing action.
	 * @param action desired action
	 * @throws NotAuthorizedException thrown if user does not have role.
	 */
	private void checkAuthorization(Action action) throws NotAuthorizedException {
		String clientApplicationName = (String)requestContext.getProperty(APPSENSOR_CLIENT_APPLICATION_IDENTIFIER_ATTR);

		ClientApplication clientApplication = AppSensorServer.getInstance().getConfiguration().findClientApplication(clientApplicationName);
		
		org.owasp.appsensor.accesscontrol.Context context = new org.owasp.appsensor.accesscontrol.Context();
		
		AppSensorServer.getInstance().getAccessController().assertAuthorized(clientApplication, action, context);
	}
}

@@ -61,16 +61,45 @@
 ction;%0A%0A
+import javax.ws.rs.Consumes;%0A
 import j
@@ -430,54 +430,8 @@
 ck;%0A
-import org.owasp.appsensor.ClientApplication;%0A
 impo
@@ -589,16 +589,68 @@
 Action;%0A
+import org.owasp.appsensor.criteria.SearchCriteria;%0A
 import o
@@ -702,16 +702,113 @@
 ception;
+%0Aimport org.owasp.appsensor.rest.AccessControlUtils;%0Aimport org.owasp.appsensor.util.StringUtils;
 %0A%0A/**%0A *
@@ -990,207 +990,134 @@
 ces(
-%22application/json%22)%0Apublic class RestRequestHandler implements RequestHandler %7B%0A%0A%09public static String APPSENSOR_CLIENT_APPLICATION_IDENTIFIER_ATTR = %22APPSENSOR_CLIENT_APPLICATION_IDENTIFIER_ATTR%22;%0A%09
+MediaType.APPLICATION_JSON)%0A@Consumes(MediaType.APPLICATION_JSON)%0Apublic class RestRequestHandler implements RequestHandler %7B%0A
 %0A%09@C
@@ -1299,32 +1299,51 @@
 edException %7B%0A%09%09
+AccessControlUtils.
 checkAuthorizati
@@ -1361,16 +1361,32 @@
 DD_EVENT
+, requestContext
 );%0A%09%09App
@@ -1578,32 +1578,51 @@
 edException %7B%0A%09%09
+AccessControlUtils.
 checkAuthorizati
@@ -1641,16 +1641,32 @@
 D_ATTACK
+, requestContext
 );%0A%09%09App
@@ -1903,17 +1903,17 @@
 liest%22) 
-l
+L
 ong earl
@@ -1952,16 +1952,35 @@
 ion %7B%0A%09%09
+AccessControlUtils.
 checkAut
@@ -2010,16 +2010,32 @@
 ESPONSES
+, requestContext
 );%0A%09%09%0A%09%09
@@ -2151,576 +2151,105 @@
 R);%0A
+%0A
 %09%09
-return AppSensorServer.getInstance().getResponseStore().findResponses(clientApplicationName, earliest);%0A%09%7D%0A%09%0A%09/**%0A%09 * Check authz before performing action.%0A%09 * @param action desired action%0A%09 * @throws NotAuthorizedException thrown if user does not have role.%0A%09 */%0A%09private void checkAuthorization(Action action) throws NotAuthorizedException %7B%0A%09%09String clientApplicationName = (String)requestContext.getProperty(APPSENSOR_CLIENT_APPLICATION_IDENTIFIER_ATTR);%0A%0A%09%09ClientApplication clientApplication = AppSensorServer.getInstance().getConfiguration().findClientApplica
+SearchCriteria criteria = new SearchCriteria().%0A%09%09%09%09setDetectionSystemIds(StringUtils.toCollec
 tion
@@ -2275,121 +2275,43 @@
 ame)
-;
+).
 %0A%09%09
-%0A
 %09%09
-org.owasp.appsensor.accesscontrol.Context context = new org.owasp.appsensor.accesscontrol.Context(
+setEarliest(earliest
 );%0A%09%09%0A%09%09
 AppS
@@ -2306,16 +2306,23 @@
 );%0A%09%09%0A%09%09
+return 
 AppSenso
@@ -2350,82 +2350,52 @@
 .get
-AccessController().assertAuthorized(clientApplication, action, context
+ResponseStore().findResponses(criteria
 );%0A%09%7D%0A
+%09%0A
 %7D%0A

use access control helper - clean up api usage