package org.gbif.registry.ws.util;

import org.gbif.api.model.occurrence.Download;
import org.gbif.api.model.registry.DatasetOccurrenceDownloadUsage;
import org.gbif.registry.ws.security.SecurityContextCheck;
import org.gbif.ws.WebApplicationException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpStatus;
import org.springframework.security.core.Authentication;

import java.util.Collection;

import static org.gbif.registry.ws.security.UserRoles.ADMIN_ROLE;

/**
 * Class that exposes common functions used by services that expose data about occurrence downloads.
 */
public final class DownloadSecurityUtils {

  private static final Logger LOG = LoggerFactory.getLogger(DownloadSecurityUtils.class);

  private DownloadSecurityUtils() {
    // private constructor
  }

  /**
   * Checks if the user has the ADMIN_ROLE or is the same user in the current context.
   */
  public static void checkUserIsInSecurityContext(String user, Authentication authentication) {
    // A null securityContext means that the class is executed locally
    if (isUserNotAuthorizedInContext(authentication, user)) {
      LOG.warn("Unauthorized access detected, authenticated use, requested user {}", user);
      throw new WebApplicationException(HttpStatus.UNAUTHORIZED);
    }
  }

  /**
   * Checks if the user has the ADMIN_ROLE or is the same user in the current context.
   */
  private static boolean isUserNotAuthorizedInContext(Authentication authentication, String user) {
    return (authentication != null && authentication.getName() !=null
      && !SecurityContextCheck.checkUserInRole(authentication, ADMIN_ROLE)
      && !authentication.getName().equals(user));
  }

  /**
   * Remove data that shouldn't be publicly exposed.
   */
  public static void clearSensitiveData(Authentication authentication, Download download) {
    if (download != null
        && isUserNotAuthorizedInContext(authentication, download.getRequest().getCreator())) {
      download.getRequest().setNotificationAddresses(null);
      download.getRequest().setCreator(null);
    }
  }

  /**
   * Remove data that shouldn't be publicly exposed.
   */
  public static void clearSensitiveData(Authentication authentication,
                                        Collection<DatasetOccurrenceDownloadUsage> downloadUsages) {
    for (DatasetOccurrenceDownloadUsage downloadUsage : downloadUsages) {
      clearSensitiveData(authentication, downloadUsage.getDownload());
    }
  }
}

@@ -1518,14 +1518,10 @@
     
-return
+if
  (au
@@ -1537,18 +1537,18 @@
 ion 
-!
+=
 = null 
-&&
+%7C%7C
  aut
@@ -1573,23 +1573,131 @@
 e() 
-!
 =
+= 
 null
+) %7B
 %0A      
-&&
+return true;%0A    %7D%0A%0A    if (authentication.getName().equals(user)) %7B%0A      return false;%0A    %7D%0A%0A    return
  !Se
@@ -1762,57 +1762,8 @@
 OLE)
-%0A      && !authentication.getName().equals(user))
 ;%0A  
@@ -1947,18 +1947,16 @@
 != null%0A
-  
       &&

Fix bug DownloadSecurityUtils#isUserNotAuthorizedInContext