package fr.insee.pogues.webservice.rest;

import fr.insee.pogues.persistence.service.QuestionnairesService;
import fr.insee.pogues.user.query.UserServiceQuery;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.glassfish.jersey.server.ContainerRequest;
import org.json.simple.JSONObject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;

import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerRequestFilter;
import javax.ws.rs.ext.Provider;
import java.io.IOException;
import java.security.Principal;

/**
 * Created by acordier on 06/07/17.
 */
@Provider
@OwnerRestricted
public class OwnerRestrictedFilter implements ContainerRequestFilter {

	static final Logger logger = LogManager.getLogger(OwnerRestrictedFilter.class);

	@Value("${fr.insee.pogues.authentication}")
	Boolean authentication;

	@Autowired
	private UserServiceQuery userServiceQuery;

	@Autowired
	private QuestionnairesService questionnairesService;

	@Override
	public void filter(ContainerRequestContext requestContext) throws IOException {

		try {
			ContainerRequest request = (ContainerRequest) requestContext;
			request.bufferEntity();
			String id = requestContext.getUriInfo().getPathParameters().getFirst("id");
			if (null == id) {
				// need a body to continue
				String message = "No id path param found to perform authorization";
				logger.error(message);
				throw new PoguesException(400, "Bad Request", message);
			}
			JSONObject questionnaire = questionnairesService.getQuestionnaireByID(id);
			if (null == questionnaire) {
				return;
			}
			Object owner = questionnaire.get("owner");
			if (null == owner) {
				// need a body to continue
				String message = "Could not perform security checks: Entity does not contains a owner attribute";
				logger.error(message);
				throw new PoguesException(500, "Invalid Data", message);
			}
			// Filter request
			Principal principal = requestContext.getSecurityContext().getUserPrincipal();
			if (null == principal) {
				throw new PoguesException(401, "Unauthenticated", "You are not logged in");
			}
			String permission = userServiceQuery.getNameAndPermissionByID(principal.getName()).getPermission();
			if (null == permission || !permission.equals(owner.toString())) {
				throw new PoguesException(403, "Unauthorized", "This object is not yours");
			}
		} catch (PoguesException e) {
			throw e;
		} catch (Exception e) {
			e.printStackTrace();
			logger.error(e.getMessage());
			throw new PoguesException(500, "Unexpected error", e.getMessage());
		}

	}
}

@@ -446,16 +446,65 @@
 n.Value;
+%0Aimport org.springframework.stereotype.Component;
 %0A%0Aimport
@@ -752,16 +752,27 @@
 rovider%0A
+@Component%0A
 @OwnerRe
@@ -2043,16 +2043,37 @@
 %09%09%09%7D%0A%09%09%09
+if (authentication) %7B
 // Filte
@@ -2082,16 +2082,17 @@
 request%0A
+%09
 %09%09%09Princ
@@ -2163,24 +2163,25 @@
 cipal();%0A%09%09%09
+%09
 if (null == 
@@ -2189,24 +2189,25 @@
 rincipal) %7B%0A
+%09
 %09%09%09%09throw ne
@@ -2277,18 +2277,20 @@
 n%22);%0A%09%09%09
+%09
 %7D%0A
+%09
 %09%09%09Strin
@@ -2383,24 +2383,25 @@
 ssion();%0A%09%09%09
+%09
 if (null == 
@@ -2450,24 +2450,25 @@
 tring())) %7B%0A
+%09
 %09%09%09%09throw ne
@@ -2535,16 +2535,22 @@
 ours%22);%0A
+%09%09%09%09%7D%0A
 %09%09%09%7D%0A%09%09%7D

Fix anonymous acces when the ui call a PUT method